AAIA AI Governance And Risk Practice Test 4 — 15 Questions

Question 1

You are auditing a 'Model Lifecycle' and find that the decommissioning process is not defined. What is the impact?

Accepted Answer

Increased risk of using outdated or insecure models in production. Without a decommissioning process, deprecated or risky models may remain in production, posing security and performance risks.

Answer

The office wifi will stop working

Answer

The company's stock price will drop immediately

Answer

The data scientists will leave the company

Question 2

You are auditing an organization's AI deployment in Microsoft Azure. The Chief Risk Officer requires a central dashboard to monitor AI model performance drift and data quality metrics across all deployed services. Which tool should you confirm is configured to provide these insights?

Accepted Answer

Azure Machine Learning Model Monitor. Azure Machine Learning Model Monitor provides the specific functionality to track performance drift, data quality, and model health, which is essential for AI governance compliance.

Answer

Microsoft Purview AI Compliance Manager

Answer

Azure Policy for AI

Answer

Azure AI Content Safety

Question 3

An organization uses AWS SageMaker. As an auditor, you need to verify that model lineage and versioning are being captured to satisfy the AI risk assessment requirement for reproducibility. Which feature ensures that every model training job is recorded with its data sources?

Accepted Answer

SageMaker Lineage Tracking. SageMaker Lineage Tracking automatically captures the relationship between data, models, and training jobs to ensure full auditability.

Answer

AWS CloudTrail

Answer

SageMaker Clarify

Answer

SageMaker Model Registry

Question 4

During an audit of Google Cloud Vertex AI, you discover that sensitive PII is being logged during model inference. You need to implement a control that enforces privacy at the model serving layer. Which configuration should you verify?

Accepted Answer

Vertex AI Model privacy and data masking controls. Vertex AI supports data masking and privacy controls during inference to ensure PII is not stored in logs, which is a key component of AI governance.

Answer

Vertex AI Model Monitoring for data drift

Answer

Vertex AI Feature Store access logs

Answer

Cloud IAM role binding for Vertex AI

Question 5

A board of directors requests a quarterly report on AI risk exposure. Which component of the NIST AI Risk Management Framework should you prioritize to demonstrate that the board's AI policy is being operationally enforced?

Accepted Answer

Govern. The 'Govern' function of the NIST AI RMF is the primary domain for board-level oversight and organizational policy enforcement.

Answer

Measure

Answer

Manage

Answer

Map

Question 6

You are reviewing a model risk management (MRM) framework for an AI system using NVIDIA NeMo Guardrails. What is the primary purpose of this tool in a risk mitigation strategy?

Accepted Answer

To enforce safety boundaries on LLM inputs and outputs. NeMo Guardrails allows developers to define programmatic boundaries for LLM behavior, effectively serving as an automated control for AI governance.

Answer

To automate model retraining

Answer

To improve model training speed

Answer

To encrypt training datasets

Question 7

When auditing model fairness in a production environment using IBM Watson OpenScale, which metric would you specifically validate to ensure the model is not violating protected class regulations?

Accepted Answer

Disparate Impact. Disparate Impact is the standard statistical metric used in OpenScale to identify bias against protected groups during inference.

Answer

Precision-Recall AUC

Answer

Model Latency

Answer

Root Mean Square Error

Question 8

An organization is scaling its AI governance program. You need to automate the identification of 'Shadow AI' in the corporate network. Which tool would be the most effective to gain visibility into unauthorized AI model API usage?

Accepted Answer

Microsoft Defender for Cloud Apps. Cloud Access Security Brokers (CASBs) like Microsoft Defender for Cloud Apps provide visibility into unsanctioned SaaS and API usage, including AI platforms.

Answer

Azure AI Content Safety

Answer

GitHub Copilot Business logs

Answer

Azure Policy

Question 9

As part of an AI audit, you are checking the 'AI Transparency' requirement. Which documentation artifact is essential to provide to external regulators to explain the model's design, intended use, and limitations?

Accepted Answer

Model Card. The Model Card is a standardized, transparent document that summarizes a model's characteristics, intended use, and limitations, as recommended by AI ethics standards.

Answer

Unit testing suite

Answer

API Swagger documentation

Answer

Infrastructure-as-Code (IaC) templates

Question 10

In a financial services firm, you are auditing the 'Explainability' of a credit scoring model. The model uses complex non-linear features. Which technique should you verify is being used to provide local explanations for individual credit decisions?

Accepted Answer

SHAP values. SHAP (SHapley Additive exPlanations) is a widely accepted, model-agnostic technique for providing local explanations of individual predictions.

Answer

Feature Importance Permutation

Answer

Model pruning

Answer

Data normalization

Question 11

You are reviewing the AI Incident Response Plan. Which scenario constitutes a 'High' severity AI incident that requires immediate board notification under most enterprise risk frameworks?

Accepted Answer

Systemic bias detected in a core automated lending model. An incident where a model makes a biased decision impacting a protected class carries significant regulatory and reputational risk, requiring board visibility.

Answer

A 200ms latency increase during inference

Answer

A minor change in the training dataset size

Answer

A 2% drop in model prediction accuracy

Question 12

You are assessing the risk of 'Data Poisoning' in a retail AI model. Which control should you implement during the data ingestion pipeline to mitigate this risk?

Accepted Answer

Input data validation and sanitization. Data validation and sanitization during the ingestion pipeline ensure that malicious or corrupted data samples are blocked before entering the training set.

Answer

Model version control

Answer

Increasing the GPU compute capacity

Answer

Enabling Multi-Factor Authentication (MFA) on the model registry

Question 13

An organization is using 'Federated Learning' to maintain data privacy while training models. What is the primary audit risk associated with this architecture?

Accepted Answer

Model inversion attacks targeting the central aggregator. In Federated Learning, local model updates (gradients) can potentially reveal information about the underlying training data, necessitating 'Differential Privacy' as a control.

Answer

Increased training latency

Answer

Lack of access to training hardware

Answer

Centralized data breaches

Question 14

When drafting an AI policy, you need to define the 'Human-in-the-Loop' (HITL) requirement. Which of the following represents a best-practice control for HITL?

Accepted Answer

Manual review of high-risk model outputs prior to execution. A requirement for human intervention in high-risk decisions ensures oversight and accountability.

Answer

Logging all model interactions for post-mortem analysis

Answer

Setting all model confidence thresholds to 100%

Answer

Automated approval for all decisions

Question 15

An auditor is asked to review the AI model inventory. What information must be present in the inventory for every model to satisfy basic regulatory requirements?

Accepted Answer

Model owner, business purpose, and status. An inventory must track model ownership, purpose, and lifecycle stage to ensure accountability and oversight.

Answer

The complete list of all training algorithms used

Answer

The total number of GPUs used during training

Answer

All hyperparameter values