AAIA AI Governance And Risk Practice Test 2 — 15 Questions

Question 1

What is the goal of a 'Human-in-the-loop' (HITL) control in an AI system?

Accepted Answer

To provide human oversight for automated decisions to mitigate risk and error. HITL ensures that a human makes final decisions for high-stakes AI outputs, reducing the risk of automation error.

Answer

To reduce the time spent on manual data entry

Answer

To replace all human employees with automated systems

Answer

To increase the speed of model training

Question 2

Which document is the primary source for establishing the scope of an AI audit?

Accepted Answer

The internal AI Policy and the organization's Risk Management Framework. The internal AI Policy defines the rules, boundaries, and requirements for AI use, while the Risk Management Framework establishes how risks are identified, assessed, and mitigated. Together they define what an AI audit must cover, including scope, criteria, and risk areas. Auditors use these documents to determine which systems, processes, and controls fall within the audit boundary.

Answer

A list of all employees who have taken an AI training course

Answer

The company's social media posting guidelines

Answer

The employee handbook for the engineering department

Question 3

During an audit, you find that the AI training data includes personally identifiable information (PII) that was not anonymized. Which regulation does this most likely violate?

Accepted Answer

GDPR (General Data Protection Regulation). GDPR Article 5(1)(f) and Article 32 require appropriate technical measures to protect personal data, and Article 6 requires a lawful basis for processing — training an AI on unanonymized PII without consent or another lawful basis violates these principles. GDPR also grants data subjects rights (access, erasure, objection) that are difficult to honor once PII is baked into model weights. This makes GDPR the clear regulatory fit.

Answer

The Model Building Standards Act

Answer

The Sarbanes-Oxley Act

Answer

The Internal Server Maintenance Code

Question 4

You are reviewing the 'AI Incident Response Plan'. Which element is essential for compliance?

Accepted Answer

Defined escalation paths for ethical or performance incidents. An AI Incident Response Plan must specify clear escalation paths for ethical or performance incidents to ensure that issues such as bias, safety violations, or model failures are promptly reported and addressed by the appropriate stakeholders. This is essential for compliance with regulations like the EU AI Act, which mandates incident reporting and accountability. Without defined escalation paths, organizations cannot demonstrate timely and effective response, risking legal and reputational damage.

Answer

The history of the company's founding

Answer

A log of all office supply purchases

Answer

A list of all cafeteria menus in the building

Question 5

Which technique is most appropriate for mitigating 'Concept Drift' in a production model?

Accepted Answer

Implementing an automated re-training pipeline based on performance threshold triggers. Continuous re-training or fine-tuning based on recent data is the standard mitigation for concept drift.

Answer

Increasing the number of neurons in the hidden layers

Answer

Moving the model to a larger GPU cluster

Answer

Restricting access to the training dataset

Question 6

You are assessing 'Model Security'. Which attack vector specifically exploits the AI training phase?

Accepted Answer

Data poisoning. Data poisoning involves injecting malicious data into the training set to influence the model's behavior.

Answer

Man-in-the-middle attack

Answer

Denial-of-service attack

Answer

Phishing attack

Question 7

Which artifact should an auditor request to verify 'Model Governance' during the model life cycle?

Accepted Answer

Independent model validation reports. Independent model validation reports are artifacts that provide objective evidence of a model's performance, limitations, and risks, as assessed by a party separate from the development team. They are a key governance control to ensure models are fit for purpose and comply with internal policies and regulations.

Answer

The personal notes of the lead developer

Answer

A photograph of the development team

Answer

A list of office keys issued to employees

Question 8

What is the primary function of an 'AI Ethics Board'?

Accepted Answer

Reviewing AI projects for alignment with corporate values and societal norms. The ethics board ensures that AI projects align with corporate values and societal standards.

Answer

Managing the HR payroll systems

Answer

Fixing bugs in the server infrastructure

Answer

Writing the code for all production models

Question 9

In the context of 'AI Compliance', what is a 'Model Card'?

Accepted Answer

A document providing transparency regarding model features, limitations, and training data. A Model Card is a structured transparency document (popularized by Mitchell et al., 2019) that describes a model's intended use, training data, evaluation metrics, limitations, ethical considerations, and performance across demographic groups. It is the standard artifact for AI compliance and responsible-AI reporting.

Answer

A physical access card for the data center

Answer

A credit card used for paying cloud compute bills

Answer

A list of all users authorized to access the AI

Question 10

Which THREE components are critical for a robust 'AI Governance' framework?

Accepted Answer

Established AI ethics and compliance policies. Effective governance requires policy, accountability, and continuous monitoring.

Answer

Increasing the size of the marketing team

Answer

Choosing the most expensive cloud platform

Question 11

Which TWO of the following are essential when performing an 'AI Risk Assessment'?

Accepted Answer

Assessing the likelihood and severity of identified risks. An assessment must identify both technical risks and potential impacts on stakeholders.

Answer

Listing the names of the team members' families

Answer

Choosing the best coffee brand for the office

Answer

Selecting the color scheme for the model's dashboard

Question 12

You are auditing a model's 'Data Pre-processing' step. Which practice is a major concern regarding data privacy?

Accepted Answer

Storing training data that can be re-identified without proper access controls. Storing training data that can be re-identified without proper access controls is the core privacy risk: even 'anonymized' datasets can often be re-linked to individuals via quasi-identifiers, and without RBAC, encryption, or tokenization, that data becomes a direct PII exposure. Auditors flag this because it violates data-minimization and purpose-limitation principles.

Answer

Documenting the transformations applied to the data

Answer

Compressing the data to save storage costs

Answer

Using open-source data transformation libraries

Question 13

Which role is primarily responsible for ensuring that the AI governance framework is followed in daily operations?

Accepted Answer

The Model Manager or Product Owner. The Model Manager or Product Owner is accountable for the day-to-day adherence to the AI governance framework, ensuring that models are developed, deployed, and monitored according to policy. This role bridges governance requirements and operational execution, making it the primary owner of daily compliance. They coordinate with data scientists, engineers, and risk teams to enforce controls.

Answer

The company's external auditor

Answer

The office manager

Answer

The chief financial officer

Question 14

When auditing an 'AI Model Lifecycle', which phase occurs immediately after the 'Model Training' phase?

Accepted Answer

Model Validation. After training, the model must be validated before it is deployed to production.

Answer

Writing the initial requirements

Answer

Marketing the model to customers

Answer

Decommissioning

Question 15

What is the purpose of 'Model Versioning' in an AI audit context?

Accepted Answer

To allow for reproducibility and auditability of past model versions. Versioning ensures that the specific state of a model used for a specific decision can be retrieved and audited.

Answer

To automatically delete old models to save space

Answer

To hide the model code from competitors

Answer

To reduce the number of files on the server