AAIA AI Governance And Risk Practice Test 3 — 15 Questions

Question 1

You find that the 'Inference API' for a model allows 'Prompt Injection' attacks. Which governance failure is most likely?

Accepted Answer

Inadequate input validation controls and adversarial testing. Prompt injection is a failure of input validation and security design within the model governance framework.

Answer

Lack of a social media presence for the company

Answer

Using a low-cost cloud provider

Answer

Failure to update the company logo

Question 2

Which AI risk is best mitigated by conducting a 'bias audit' on the training dataset?

Accepted Answer

Unfairness and discrimination in model outputs. Bias audits analyze datasets for underrepresented groups or historical prejudices that would lead to discriminatory outputs.

Answer

Hardware overheating

Answer

System latency

Answer

Server cost overruns

Question 3

A firm uses a 'Federated Learning' approach. Which governance benefit does this provide?

Accepted Answer

Enhanced data privacy by keeping raw data locally on devices. Federated learning allows training on decentralized data, keeping raw data on local devices, which enhances privacy.

Answer

Reduced usage of electricity

Answer

Faster model training times

Answer

Improved model interpretability

Question 4

What is the main role of the 'AI Risk Assessment' document in a project lifecycle?

Accepted Answer

To identify and evaluate potential risks before the model is deployed. The AI Risk Assessment document is a structured artifact used during the project lifecycle to systematically identify, analyze, and evaluate risks associated with an AI system before it goes into production. It covers potential harms such as bias, privacy violations, security vulnerabilities, and model performance failures, and it informs mitigation strategies and go/no-go deployment decisions. This aligns with governance frameworks like the NIST AI RMF and ISO/IEC 42001, which require risk assessment as a prerequisite for responsible AI deployment.

Answer

To provide a history of the company's annual profits

Answer

To record the names of all HR staff

Answer

To list the office parking spaces

Question 5

Which TWO of the following are typical 'Model Risk Management' (MRM) pillars?

Accepted Answer

Independent model validation. MRM is structured around independent validation and continuous monitoring.

Answer

Designing office holiday parties

Answer

Negotiating salaries for the data scientists

Answer

Public relations management

Question 6

Which THREE criteria are necessary for an AI system to be deemed 'Trustworthy' under most governance frameworks?

Accepted Answer

Reliability and consistent performance over time. Option A is correct because trustworthy AI frameworks (e.g., EU HLEG, NIST AI RMF, OECD) require reliability and consistent performance over time, meaning the system behaves as intended and maintains accuracy across varying conditions and lifecycles. Option B is correct because transparency of the decision-making process is a core principle, enabling stakeholders to understand how outputs are produced, supporting explainability, auditability, and accountability. Option D is correct because robustness and security against adversarial attacks ensure the system resists manipulation, data poisoning, and evasion, which is essential for safety and trustworthiness. Option C is not a governance criterion; revenue generation is a business objective, not a trustworthiness requirement. Option E is not a criterion either, as marketing buzzwords have no bearing on ethical, technical, or regulatory trustworthiness standards.

Answer

The ability to generate high revenue for the firm

Answer

The use of the latest marketing buzzwords

Question 7

What is the key difference between 'AI Ethics' and 'AI Compliance'?

Accepted Answer

Ethics focuses on societal values, while compliance focuses on legal and regulatory requirements. Ethics concerns what *should* be done based on values, while compliance concerns what *must* be done based on rules.

Answer

There is no difference between the two

Answer

Ethics is only for AI, while compliance is for all departments

Answer

Compliance is only for technical roles, while ethics is for executives

Question 8

What is the primary function of an 'AI Audit Log'?

Accepted Answer

To track and document all interactions and changes made to the AI system. An audit log records all actions performed by or on the AI system, ensuring accountability and traceability.

Answer

To automatically order pizza for the team

Answer

To store the personal contact information of the IT staff

Answer

To provide entertainment for employees during breaks

Question 9

What is the purpose of an 'AI Policy' within an organization?

Accepted Answer

To provide a structured set of guidelines for the responsible development and use of AI. An AI policy sets the standard for responsible, secure, and compliant AI usage across the enterprise.

Answer

To list the office coffee machine settings

Answer

To define the company's dress code policy

Answer

To describe the history of computer hardware

Question 10

A company's AI governance policy requires 'Model explainability'. Which tool or technique best satisfies this requirement for complex deep learning models?

Accepted Answer

Using SHAP (SHapley Additive exPlanations) to interpret model features. SHAP (SHapley Additive exPlanations) or LIME are industry-standard techniques for explaining deep learning decisions.

Answer

Asking the model's developer to write a summary of their feelings about the model

Answer

Printing the model's architecture as a JPEG file

Answer

Reducing the number of parameters in the model to one

Question 11

You are auditing a firm using LLMs (Large Language Models). Which risk is most specific to generative AI compared to traditional predictive models?

Accepted Answer

Hallucinations and generation of misinformation. Hallucination is a unique risk of generative models where they output plausible but factually incorrect information.

Answer

Database login credentials being shared

Answer

Server power consumption

Answer

Missing documentation for the training code

Question 12

Which 'AI Risk Mitigation' strategy is most effective for reducing 'Data Leakage' in training sets?

Accepted Answer

Implementing strict data partitioning and feature selection protocols. Data leakage occurs when information from the target variable leaks into the training features; strict separation and testing prevent this.

Answer

Using more colorful charts in the report

Answer

Increasing the number of servers

Answer

Changing the office seating arrangement

Question 13

Which action is required when a model is found to be 'Non-compliant' with the internal AI Governance policy?

Accepted Answer

Immediate remediation or removal from the production environment. Non-compliant models must be removed from production or restricted until remediated to prevent risk.

Answer

Writing a blog post about the failure

Answer

Ignoring the finding if the model is profitable

Answer

Giving the model a new name

Question 14

You are auditing a model's 'Robustness' against adversarial attacks. Which test is most appropriate?

Accepted Answer

Performing adversarial perturbation testing. Adversarial testing involves introducing perturbations to inputs to see if the model's output changes unexpectedly.

Answer

Checking if the server is plugged in

Answer

Checking the model's training accuracy

Answer

Asking the team to describe their favorite movies

Question 15

Which TWO of the following are examples of AI governance 'Inputs'?

Accepted Answer

Internal AI Policy and guidelines. Option B is correct because an Internal AI Policy and guidelines is a governance input: it supplies the organization's own rules, principles, and constraints that shape how AI systems are designed, deployed, and monitored. Option C is correct because external regulatory frameworks such as the EU AI Act are governance inputs: they impose legal and compliance requirements that the organization's AI governance program must incorporate. Option A is not a governance input; a photograph of the company founder has no bearing on AI policies, controls, or compliance obligations. Option D is not a governance input; a social media password is a credential and a security concern, not a source of AI governance requirements. Option E is not a governance input; an office printer manual documents hardware operation and is unrelated to AI governance.

Answer

A photograph of the company founder

Answer

The company's social media password

Answer

The office printer manual