AAIA AI Governance And Risk Practice Test 4 — 15 Questions

Question 1

Which THREE risks should be explicitly managed in an 'AI Governance' program?

Accepted Answer

Operational performance degradation. Governance must manage bias, security, and performance risks.

Answer

The choice of font for the final report

Answer

The color of the server room lights

Question 2

What is the primary objective of 'Board-level AI Governance'?

Accepted Answer

To ensure AI aligns with the organization's business strategy and risk appetite. Board-level AI governance exists to ensure that AI investments, deployments, and risks are aligned with the organization's strategic objectives and stated risk appetite. The board sets direction, approves risk tolerances, and holds management accountable — it does not perform engineering tasks. This strategic alignment function is what distinguishes governance from operational management.

Answer

To decide which programming language is used

Answer

To fix bugs in the model code

Answer

To organize the annual team lunch

Question 3

During an audit of an AI system, you notice that 'Model validation' is performed by the same team that developed the model. Why is this a concern?

Accepted Answer

Lack of independence compromises the integrity of the validation process. Self-validation lacks the independence required to identify errors, bias, or lack of robustness effectively.

Answer

The team might be too friendly with each other

Answer

The validation team might work too slowly

Answer

It is not a concern

Answer

The model will be too accurate

Question 4

You are auditing a 'Model Lifecycle' and find that the decommissioning process is not defined. What is the impact?

Accepted Answer

Increased risk of using outdated or insecure models in production. Without a decommissioning process, deprecated or risky models may remain in production, posing security and performance risks.

Answer

The office wifi will stop working

Answer

The company's stock price will drop immediately

Answer

The data scientists will leave the company

Question 5

You are auditing an organization's AI deployment in Microsoft Azure. The Chief Risk Officer requires a central dashboard to monitor AI model performance drift and data quality metrics across all deployed services. Which tool should you confirm is configured to provide these insights?

Accepted Answer

Azure Machine Learning Model Monitor. Azure Machine Learning Model Monitor is the service designed to continuously track model performance drift and data quality metrics for models deployed via Azure Machine Learning. It provides a central dashboard with metrics like feature attribution drift, data drift, and prediction drift, enabling the CRO to monitor all deployed services.

Answer

Microsoft Purview AI Compliance Manager

Answer

Azure Policy for AI

Answer

Azure AI Content Safety

Question 6

An organization uses AWS SageMaker. As an auditor, you need to verify that model lineage and versioning are being captured to satisfy the AI risk assessment requirement for reproducibility. Which feature ensures that every model training job is recorded with its data sources?

Accepted Answer

SageMaker Lineage Tracking. SageMaker Lineage Tracking automatically captures the relationship between data, models, and training jobs to ensure full auditability.

Answer

AWS CloudTrail

Answer

SageMaker Clarify

Answer

SageMaker Model Registry

Question 7

A board of directors requests a quarterly report on AI risk exposure. Which component of the NIST AI Risk Management Framework should you prioritize to demonstrate that the board's AI policy is being operationally enforced?

Accepted Answer

Govern. The Govern function of the NIST AI RMF establishes the policies, roles, and accountability structures that ensure AI risk management is operationalized across the organization. Demonstrating that a board-level AI policy is actually enforced requires evidence of governance mechanisms — assigned responsibilities, documented processes, and oversight — which is exactly what Govern covers.

Answer

Measure

Answer

Manage

Answer

Map

Question 8

You are reviewing a model risk management (MRM) framework for an AI system using NVIDIA NeMo Guardrails. What is the primary purpose of this tool in a risk mitigation strategy?

Accepted Answer

To enforce safety boundaries on LLM inputs and outputs. NeMo Guardrails allows developers to define programmatic boundaries for LLM behavior, effectively serving as an automated control for AI governance.

Answer

To automate model retraining

Answer

To improve model training speed

Answer

To encrypt training datasets

Question 9

When auditing model fairness in a production environment using IBM Watson OpenScale, which metric would you specifically validate to ensure the model is not violating protected class regulations?

Accepted Answer

Disparate Impact. Disparate Impact is the fairness metric in IBM Watson OpenScale that quantifies whether a model's favorable outcomes are disproportionately distributed across protected groups (e.g., race, gender). It is computed as the ratio of favorable outcome rates between the unprivileged and privileged groups, with values below 0.8 (the EEOC four-fifths rule) typically flagging potential regulatory violations. This directly addresses protected class compliance requirements under laws like ECOA and Title VII.

Answer

Precision-Recall AUC

Answer

Model Latency

Answer

Root Mean Square Error

Question 10

An organization is scaling its AI governance program. You need to automate the identification of 'Shadow AI' in the corporate network. Which tool would be the most effective to gain visibility into unauthorized AI model API usage?

Accepted Answer

Microsoft Defender for Cloud Apps. Cloud Access Security Brokers (CASBs) like Microsoft Defender for Cloud Apps provide visibility into unsanctioned SaaS and API usage, including AI platforms.

Answer

Azure AI Content Safety

Answer

GitHub Copilot Business logs

Answer

Azure Policy

Question 11

As part of an AI audit, you are checking the 'AI Transparency' requirement. Which documentation artifact is essential to provide to external regulators to explain the model's design, intended use, and limitations?

Accepted Answer

Model Card. A Model Card is the documentation artifact specifically designed to disclose a model's design, intended use, limitations, performance characteristics, and ethical considerations to external stakeholders. It provides regulators with a standardized, transparent summary of the model's purpose and constraints. This directly satisfies AI transparency requirements in audit and regulatory contexts.

Answer

Unit testing suite

Answer

API Swagger documentation

Answer

Infrastructure-as-Code (IaC) templates

Question 12

In a financial services firm, you are auditing the 'Explainability' of a credit scoring model. The model uses complex non-linear features. Which technique should you verify is being used to provide local explanations for individual credit decisions?

Accepted Answer

SHAP values. SHAP (SHapley Additive exPlanations) values are grounded in cooperative game theory and assign each feature a contribution to a single prediction, producing faithful local explanations even for complex non-linear models. For a credit-scoring audit, SHAP lets you explain why one specific applicant was approved or denied by decomposing that individual prediction into per-feature additive contributions. Permutation importance, pruning, and normalization do not provide per-instance local explanations.

Answer

Feature Importance Permutation

Answer

Model pruning

Answer

Data normalization

Question 13

You are reviewing the AI Incident Response Plan. Which scenario constitutes a 'High' severity AI incident that requires immediate board notification under most enterprise risk frameworks?

Accepted Answer

Systemic bias detected in a core automated lending model. An incident where a model makes a biased decision impacting a protected class carries significant regulatory and reputational risk, requiring board visibility.

Answer

A 200ms latency increase during inference

Answer

A minor change in the training dataset size

Answer

A 2% drop in model prediction accuracy

Question 14

You are assessing the risk of 'Data Poisoning' in a retail AI model. Which control should you implement during the data ingestion pipeline to mitigate this risk?

Accepted Answer

Input data validation and sanitization. Data validation and sanitization during the ingestion pipeline ensure that malicious or corrupted data samples are blocked before entering the training set.

Answer

Model version control

Answer

Increasing the GPU compute capacity

Answer

Enabling Multi-Factor Authentication (MFA) on the model registry

Question 15

When drafting an AI policy, you need to define the 'Human-in-the-Loop' (HITL) requirement. Which of the following represents a best-practice control for HITL?

Accepted Answer

Manual review of high-risk model outputs prior to execution. Human-in-the-Loop (HITL) is a control pattern where a human reviews and approves model outputs before consequential actions are taken. The best-practice control is targeted manual review of high-risk outputs prior to execution, which balances risk mitigation with operational efficiency by focusing human attention where the impact is greatest. This aligns with risk-based AI governance frameworks that scale oversight to the severity of the decision.

Answer

Logging all model interactions for post-mortem analysis

Answer

Setting all model confidence thresholds to 100%

Answer

Automated approval for all decisions