AAIA AI Governance And Risk — Timed 10 Questions

Question 1

You are auditing a firm's AI policy and find that the 'Model Inventory' in the enterprise risk management platform lacks versioning metadata. Which specific control gap should be prioritized to align with NIST AI RMF?

10 minute time limit — choose an answer to begin.

Accepted Answer

Lack of immutable audit logs for model architecture changes. NIST AI RMF's Govern and Map functions require maintaining a model inventory with sufficient metadata to trace model lineage, changes, and approvals. Missing versioning metadata means there is no immutable record of architecture changes, so the prioritized control gap is the lack of immutable audit logs for model architecture changes, which directly undermines traceability and accountability.

Answer

Absence of automated model deployment pipelines

Answer

Failure to define the RPO for the primary database

Answer

Insufficient budget for cloud storage of historical data

Question 2

During an audit of AI procurement, you find that the 'Vendor AI Assessment' questionnaire is missing. What is the correct next step?

Accepted Answer

Immediately halt the use of the vendor until a formal risk assessment is completed. An auditor must ensure that third-party AI risks are evaluated using a formal, documented process.

Answer

None of the above

Answer

Update the office building safety guidelines

Answer

Ask the vendor for their marketing presentation

Answer

Ignore the missing document if the vendor is well-known

Question 3

During an audit of Google Cloud Vertex AI, you discover that sensitive PII is being logged during model inference. You need to implement a control that enforces privacy at the model serving layer. Which configuration should you verify?

Accepted Answer

Vertex AI Model privacy and data masking controls. Vertex AI Model privacy and data masking controls are the specific serving-layer feature that lets you redact or mask sensitive fields (such as PII) before they are written to prediction logs. Verifying this configuration ensures that inference requests/responses captured by Vertex AI logging pipelines are sanitized at the model serving layer, satisfying the audit requirement.

Answer

Vertex AI Model Monitoring for data drift

Answer

Vertex AI Feature Store access logs

Answer

Cloud IAM role binding for Vertex AI

Question 4

An organization is using 'Federated Learning' to maintain data privacy while training models. What is the primary audit risk associated with this architecture?

Accepted Answer

Model inversion attacks targeting the central aggregator. In Federated Learning, local model updates (gradients) can potentially reveal information about the underlying training data, necessitating 'Differential Privacy' as a control.

Answer

Increased training latency

Answer

Lack of access to training hardware

Answer

Centralized data breaches

Question 5

Which TWO of the following are legitimate 'AI Governance' concerns regarding third-party AI service providers (SaaS)?

Accepted Answer

Data residency and compliance with local regulations. Option B is correct because AI governance for third-party SaaS providers must address where training data, prompts, and outputs are stored and processed, since data residency directly affects compliance with regulations such as GDPR, HIPAA, or sector-specific data localization laws. Option C is correct because governance requires contractual third-party audit rights and transparency into how the vendor develops, trains, and validates its models, enabling accountability for bias, safety, and provenance. Option A is not a governance concern because the vendor's programming language is an implementation detail that does not affect compliance, risk, or accountability. Option D is not selected because, while model update and retraining frequency can be a technical or operational consideration, it is not one of the two governance concerns identified here. Option E is not selected because the physical location of a corporate office is distinct from data residency and does not by itself determine regulatory compliance.

Answer

The programming language used by the vendor

Answer

Vendor's model update and retraining frequency

Answer

The physical location of the vendor's corporate office

Question 6

When auditing an AI system for regulatory compliance, you find that data lineage is broken between the feature store and the training pipeline. Which control is most likely deficient?

Accepted Answer

Metadata logging and transformation documentation. Feature stores must maintain end-to-end traceability to ensure that data provenance is clear and auditable.

Answer

Access control lists for the model production environment

Answer

Encryption of data at rest in the data warehouse

Answer

Load balancing configuration for the inference API

Question 7

A firm uses a third-party AI service. Which control is most critical to ensure compliance with the firm's own AI governance policy?

Accepted Answer

Including AI-specific compliance requirements in the vendor service-level agreement (SLA). Supply chain risk management requires mapping vendor controls to internal governance requirements.

Answer

Conducting weekly penetration tests on the vendor's office premises

Answer

Requesting the vendor's employee turnover rates for the last fiscal year

Answer

Requiring the vendor to submit copies of all their marketing brochures

Question 8

You are auditing a 'Model Monitoring' dashboard. Which metric is most indicative of a potential degradation in the model's reliability over time?

Accepted Answer

Statistical drift between the production input data and training baseline. Data drift and concept drift are primary indicators that a model's performance may be degrading in a production environment.

Answer

The physical location of the cloud server hosting the model

Answer

The number of lines of code in the model deployment script

Answer

The number of users accessing the model API

Question 9

You are assessing a company's 'AI Governance Committee'. Which action best demonstrates effective board-level oversight?

Accepted Answer

Approving the annual AI strategy and corresponding risk mitigation plans. Board-level oversight in an AI Governance Committee centers on strategic direction and risk appetite, not operational execution. Approving the annual AI strategy and its corresponding risk mitigation plans is a fiduciary, governance-level action that sets direction, allocates accountability, and ensures risk is managed at the highest level. This mirrors how boards approve corporate strategy and enterprise risk registers rather than getting involved in tactical decisions.

Answer

Managing the day-to-day procurement of data labeling services

Answer

Reviewing individual code commits for AI model training

Answer

Selecting the machine learning framework used by data scientists

Question 10

Which component of an AI policy is most important for establishing organizational accountability?

Accepted Answer

Defining the roles and responsibilities of the AI Governance Committee and model owners. Accountability requires clearly defined roles and responsibilities for AI system oversight.

Answer

Describing the history of artificial intelligence research

Answer

Listing the hardware specifications of the training clusters

Answer

Providing the contact information for the company's PR department