AAIA Practice Questions 2 — 50 Questions

Question 1

Which THREE components are critical for a robust 'AI Governance' framework?

Accepted Answer

Established AI ethics and compliance policies. Effective governance requires policy, accountability, and continuous monitoring.

Answer

Increasing the size of the marketing team

Answer

Choosing the most expensive cloud platform

Question 2

During an audit of an AI system, you notice that 'Model validation' is performed by the same team that developed the model. Why is this a concern?

Accepted Answer

Lack of independence compromises the integrity of the validation process. Self-validation lacks the independence required to identify errors, bias, or lack of robustness effectively.

Answer

The team might be too friendly with each other

Answer

The validation team might work too slowly

Answer

It is not a concern

Answer

The model will be too accurate

Question 3

When setting up a containerized deployment of an AI model using Docker, what is the primary purpose of a 'multi-stage build'?

Accepted Answer

To reduce the final image size and attack surface. The primary purpose of a multi-stage build in Docker is to reduce the final image size and attack surface by separating the build environment from the runtime environment. Build tools, compilers, and intermediate dependencies are used in an early stage but are not copied into the final image, leaving only the necessary runtime artifacts. This results in a leaner, more secure production image.

Answer

To run multiple versions of the model simultaneously

Answer

To train the model during the container startup

Answer

To automatically scale the deployment based on traffic

Question 4

What is the primary function of an 'AI Model Gateway'?

Accepted Answer

Centralized request management and security. A gateway acts as a security and management layer for AI requests, providing throttling, logging, and authentication.

Answer

Storing model weights

Answer

Training the model

Answer

Labeling data

Question 5

When auditing fairness metrics, what does the 'Demographic Parity' metric measure?

Accepted Answer

Equal positive outcome rates. Demographic Parity (also called statistical parity) requires that the probability of a positive prediction is equal across protected groups — i.e., P(Ŷ=1 | A=0) = P(Ŷ=1 | A=1). It measures outcome-rate parity, not error rates or accuracy. It is one of the simplest group fairness definitions and is often used in hiring, lending, and admissions audits.

Answer

Equal training data representation

Answer

Equal error rates

Answer

Equal accuracy rates

Question 6

To verify the provenance of a model in Google Cloud Vertex AI, which service should the auditor inspect to review the lineage graph of the artifacts?

Accepted Answer

Vertex AI ML Metadata. Vertex AI ML Metadata tracks the lineage of artifacts and executions within the pipeline.

Answer

Vertex AI Feature Store

Answer

Cloud Logging

Answer

Vertex AI Model Registry

Question 7

When auditing fairness using the 'Aequitas' toolkit, what is the first step an auditor should take?

Accepted Answer

Select bias metrics. The first step when auditing fairness using the Aequitas toolkit is to select the bias metrics that will be used to evaluate the model. Aequitas requires the auditor to choose from a set of fairness metrics (e.g., disparate impact, false positive rate parity) based on the context and protected attributes. Only after selecting metrics can the toolkit compute and visualize them. This step ensures the audit is tailored to the specific fairness concerns.

Answer

Encrypt the dataset

Answer

Train a new model

Answer

Delete sensitive attributes

Question 8

What is the goal of an AI 'Rollout' plan?

Accepted Answer

Controlled deployment to users. An AI rollout plan governs the controlled deployment of a model to users, typically through phased stages such as pilot, limited release, and general availability. The goal is to manage risk, gather feedback, and ensure readiness before full-scale exposure. It is fundamentally a deployment governance artifact, not a resource optimization or training activity.

Answer

Reducing disk space

Answer

Deleting logs

Answer

Increasing training time

Question 9

Which TWO are standard practices for securing AI model endpoints?

Accepted Answer

Mutual TLS (mTLS). Mutual TLS (mTLS) is correct because it enforces bidirectional certificate-based authentication, ensuring both the client and the AI model endpoint verify each other's identity before any inference request is processed, which prevents unauthorized or spoofed clients from reaching the model. API Rate Limiting is correct because it caps the number of requests per client or API key over a defined window, mitigating abuse, credential-stuffing, denial-of-service, and cost-exhaustion attacks against expensive model inference calls. Unprotected endpoints do not belong because exposing a model without authentication or encryption allows anyone to invoke it and exfiltrate data or consume resources. Storing logs on public S3 does not belong because publicly readable buckets leak prompts, responses, and potentially sensitive training or user data. Public internet access does not belong because unrestricted exposure of a model endpoint dramatically expands the attack surface instead of restricting access to trusted networks or identities.

Answer

Unprotected endpoints

Answer

Storing logs on public S3

Answer

Public internet access

Question 10

A data scientist proposes using a 'black-box' model for a high-stakes loan approval process. Which action does your AI audit framework require?

Accepted Answer

Mandating the use of XAI (Explainable AI) tools to interpret model decisions. In high-stakes domains like loan approval, regulations (e.g., ECOA, GDPR) and ethical AI principles require that decisions be explainable to affected individuals and auditors. XAI tools (e.g., LIME, SHAP, counterfactual explanations) provide post-hoc interpretability for black-box models, enabling justification of denials and detection of bias. Thus, an AI audit framework would mandate XAI to ensure transparency and accountability, making option A correct.

Answer

Requiring the data scientist to publish the code on an internal repository

Answer

Allowing the model if it achieves 99% accuracy on the test set

Answer

Asking the marketing team to verify the model's fairness

Question 11

You are assessing a company's 'AI Governance Committee'. Which action best demonstrates effective board-level oversight?

Accepted Answer

Approving the annual AI strategy and corresponding risk mitigation plans. Board-level oversight in an AI Governance Committee centers on strategic direction and risk appetite, not operational execution. Approving the annual AI strategy and its corresponding risk mitigation plans is a fiduciary, governance-level action that sets direction, allocates accountability, and ensures risk is managed at the highest level. This mirrors how boards approve corporate strategy and enterprise risk registers rather than getting involved in tactical decisions.

Answer

Managing the day-to-day procurement of data labeling services

Answer

Reviewing individual code commits for AI model training

Answer

Selecting the machine learning framework used by data scientists

Question 12

What is the risk of 'Feature Skew' in an AI pipeline?

Accepted Answer

Incorrect model predictions. Feature skew (also called training-serving skew) occurs when the feature values used at training time differ from those computed at inference time — for example, different preprocessing, aggregation windows, or data sources. Because the model learned relationships based on the training distribution, mismatched inputs at serving time cause it to produce incorrect predictions. This is a data/feature consistency problem, not an infrastructure failure.

Answer

Database corruption

Answer

Increased hardware costs

Answer

System crash

Question 13

What is the most effective way to address 'Adversarial Input' during inference?

Accepted Answer

Adversarial training and input filtering. Implementing input validation/sanitization and adversarial training (training on adversarial examples) improves robustness.

Answer

Reducing training time

Answer

Increasing model depth

Answer

Ignoring the input

Question 14

For a production LLM deployment, which operational metric is most critical to monitor to identify 'hallucination' or grounding failure in real-time?

Accepted Answer

Context faithfulness score. Retrieval metrics, specifically faithfulness or answer relevance, indicate if the model is hallucinating outside of retrieved context.

Answer

Throughput (TPS)

Answer

Token generation latency

Answer

Error code distribution

Answer

Memory footprint

Question 15

You are auditing a model's 'Data Pre-processing' step. Which practice is a major concern regarding data privacy?

Accepted Answer

Storing training data that can be re-identified without proper access controls. Storing training data that can be re-identified without proper access controls is the core privacy risk: even 'anonymized' datasets can often be re-linked to individuals via quasi-identifiers, and without RBAC, encryption, or tokenization, that data becomes a direct PII exposure. Auditors flag this because it violates data-minimization and purpose-limitation principles.

Answer

Documenting the transformations applied to the data

Answer

Compressing the data to save storage costs

Answer

Using open-source data transformation libraries

Question 16

Which THREE factors should an auditor consider when evaluating the suitability of an AI model for production?

Accepted Answer

Inference latency and throughput. Option A (Inference latency and throughput) is correct because production suitability depends on whether the model can serve requests within required response-time SLAs and handle the expected request volume, making latency and throughput key operational metrics. Option C (Fairness and bias metrics) is correct because an auditor must verify that the model does not produce discriminatory or skewed outcomes across protected groups, which is a core governance and compliance concern. Option D (Model accuracy metrics) is correct because accuracy, precision, recall, F1, or similar performance measures determine whether the model reliably performs its intended task in production. Options B (Developer age demographics) and E (Operating system color schemes) are irrelevant to model suitability, as neither affects the model's performance, fairness, or operational viability.

Answer

Developer age demographics

Answer

Operating system color schemes

Question 17

Which TWO of the following are core components of an AI incident response strategy?

Accepted Answer

Defined communication protocols for internal and external stakeholders. Option B is correct because a core part of any AI incident response strategy is having defined communication protocols that specify how internal teams (e.g., security, legal, engineering) and external stakeholders (e.g., customers, regulators) are notified during an AI-related incident, ensuring timely and coordinated disclosure. Option D is correct because procedures for rolling back or disabling the model are essential containment and remediation mechanisms—if an AI model behaves harmfully or is compromised, responders must be able to revert to a prior version or shut it down to stop the impact. In contrast, option A (marketing campaigns for AI product launches) relates to go-to-market activities, not incident response. Option C (software license management for all developers) is a compliance and asset-management concern, not an incident response component. Option E (automated email server maintenance) is routine IT operations and unrelated to handling AI incidents.

Answer

Marketing campaigns for AI product launches

Answer

Software license management for all developers

Answer

Automated email server maintenance

Question 18

Which THREE of the following are core components of a robust AI Governance and Risk Assessment Framework?

Accepted Answer

Standardized model risk assessment templates. A robust AI Governance and Risk Assessment Framework requires standardized model risk assessment templates (B) so that every AI/ML model is evaluated consistently against the same criteria, such as fairness, explainability, robustness, and data quality, enabling comparable and auditable risk scoring across the model portfolio. It also requires defined AI risk appetite and threshold levels (D), because governance depends on explicit, approved boundaries that determine which risks are acceptable and trigger escalation, mitigation, or rejection decisions. Finally, it requires clearly assigned roles and responsibilities for model ownership and accountability (E), since frameworks such as NIST AI RMF and ISO/IEC 42001 rely on named accountable owners (e.g., model owners, validators, and oversight committees) to enforce controls and remediation. Network bandwidth optimization plans (A) are an infrastructure/performance concern, not a governance or risk-assessment component, and automated model training hyperparameter tuning (C) is an MLOps/model-development activity that improves model performance but does not establish governance, risk appetite, or accountability structures.

Answer

Network bandwidth optimization plans

Answer

Automated model training hyperparameter tuning

Question 19

Which role is primarily responsible for ensuring that the AI governance framework is followed in daily operations?

Accepted Answer

The Model Manager or Product Owner. The Model Manager or Product Owner is accountable for the day-to-day adherence to the AI governance framework, ensuring that models are developed, deployed, and monitored according to policy. This role bridges governance requirements and operational execution, making it the primary owner of daily compliance. They coordinate with data scientists, engineers, and risk teams to enforce controls.

Answer

The company's external auditor

Answer

The office manager

Answer

The chief financial officer

Question 20

During an AI audit, what is a 'PII Scrubber' tool used for?

Accepted Answer

Anonymizing sensitive data. A PII Scrubber is used to detect and anonymize personally identifiable information such as names, addresses, SSNs, and emails so that sensitive data can be used in AI training or analysis without exposing individuals. It supports privacy compliance by removing or masking identifiers before data flows into models or logs. This is a core privacy-preserving control in AI audits.

Answer

Cleaning up logs

Answer

Compressing images

Answer

Improving accuracy