AAIR Practice Test 10 — 10 Questions

Question 1

A company is utilizing a third-party LLM service. Which risk is specifically heightened by this arrangement?

Accepted Answer

Data leakage and privacy violations. Using a third-party LLM service means prompts, context, and potentially sensitive data are transmitted to and processed by an external provider, heightening data leakage and privacy violation risk. The organization loses direct control over data handling, retention, and secondary use, and may face regulatory exposure under GDPR, HIPAA, or similar regimes. This is the risk specifically amplified by the third-party arrangement.

Answer

Server downtime

Answer

Model training cost inflation

Answer

Lack of software updates

Question 2

You are analyzing the risk of a generative AI implementation. Which metric most effectively measures 'model transparency' for a risk dashboard?

Accepted Answer

Percentage of models deployed with a completed Model Card covering data provenance, limitations, and intended use.. Model transparency is best measured by the percentage of deployed models that have a completed Model Card documenting data provenance, limitations, and intended use. Model Cards (Mitchell et al., 2019) are the industry-standard artifact for transparency, and a coverage metric directly quantifies how transparent the model portfolio is. This gives risk dashboards an actionable, auditable indicator tied to governance requirements.

Answer

The number of unique contributors to the codebase.

Answer

The average latency of model inference.

Answer

The number of parameters in the neural network.

Question 3

Which THREE components are necessary for effective cross-functional AI risk coordination?

Accepted Answer

Clearly defined RACI matrix for AI initiatives. A clearly defined RACI matrix for AI initiatives (A) is necessary because it assigns explicit Responsible, Accountable, Consulted, and Informed roles across functions, eliminating ambiguity about who owns each AI risk decision and escalation path. A standardized AI risk taxonomy (C) is required so that legal, security, data science, and business teams classify and compare risks using the same categories, severity scales, and terminology, enabling consistent cross-functional assessment. A centralized AI risk register (D) is essential as the single source of truth that aggregates identified risks, owners, mitigations, and status, giving all functions shared visibility and traceability. Weekly team lunches (B) are a social nicety that may improve rapport but are not a structural mechanism for risk coordination, and unrestricted access to all production servers for all staff (E) violates least-privilege and actually increases risk rather than enabling effective coordination.

Answer

Weekly team lunches

Answer

Unrestricted access to all production servers for all staff

Question 4

Which THREE considerations must be addressed when designing a 'Training' pipeline to minimize data quality risk?

Accepted Answer

Recording full data lineage for every training run.. Option B is correct because recording full data lineage for every training run provides traceability of the exact datasets, transformations, and versions used, which is essential for detecting and remediating data quality issues and reproducing results. Option D is correct because automated outlier detection identifies noisy, anomalous, or corrupted records before they degrade model training, directly reducing data quality risk. Option E is correct because strict schema validation catches data type errors, missing fields, and format mismatches at ingestion time, preventing malformed data from entering the training pipeline. Options A and C are not correct because a high-end monitor and a specific server hardware brand are irrelevant to data quality; they concern display and procurement preferences rather than the integrity, validity, or traceability of training data.

Answer

Ensuring the training server has a high-end monitor.

Answer

Using a specific brand of server hardware.

Question 5

Which TWO items are considered 'AI Model Artifacts' that should be kept for audit purposes?

Accepted Answer

The training dataset version. Option A, the training dataset version, is a correct AI model artifact for audit purposes because it documents the exact data lineage and inputs used to train the model, which is essential for reproducibility, bias investigation, and compliance reviews. Option C, model hyperparameters and architecture configuration, is also correct because these settings define how the model was built and trained, and auditors need them to reproduce, validate, or explain model behavior. The unmarked options do not belong: the lunch menu (B), company mascot name (D), and local weather report (E) are unrelated to model development, training, or governance and have no audit value for AI artifacts.

Answer

The lunch menu for the developers

Answer

The name of the company's favorite mascot

Answer

The local weather report from last week

Question 6

During the 'Monitoring' phase, which activity is most critical for identifying model 'feedback loops'?

Accepted Answer

Tracking the distribution of prediction outputs over time for systemic shifts.. Feedback loops occur when a model's own predictions influence future input data, causing the model's output distribution to drift in a self-reinforcing way. Tracking the distribution of prediction outputs over time is the most direct way to detect these systemic shifts, because a feedback loop manifests as a gradual, self-amplifying change in what the model predicts. This is a monitoring-phase activity, distinct from training or infrastructure checks.

Answer

Validating the hardware security keys.

Answer

Checking for system uptime.

Answer

Analyzing the training pipeline latency.

Question 7

Which TWO tasks are part of the 'AI Risk Assessment' process?

Accepted Answer

Evaluating the likelihood and impact of identified risks. Option A is correct because a core step of AI Risk Assessment is risk analysis, where each identified risk is evaluated for its likelihood (probability of occurrence) and impact (severity of consequences) so risks can be prioritized and mitigated. Option D is correct because AI Risk Assessment begins with risk identification, systematically uncovering potential AI-related threats such as bias, data poisoning, model drift, privacy leakage, and adversarial attacks. Together, identifying threats (D) and evaluating their likelihood and impact (A) form the analytical backbone of the risk assessment process. The remaining options do not belong: B (choosing dashboard font color) is a UI/design decision, C (writing marketing copy) is a marketing activity, and E (hiring office staff) is an HR/administrative task, none of which involve identifying or analyzing AI risks.

Answer

Choosing the font color for the dashboard

Answer

Writing marketing copy for the AI product

Answer

Hiring new office staff

Question 8

Which of the following is a primary risk during the 'Deployment' stage of the AI lifecycle?

Accepted Answer

Unexpected performance degradation due to infrastructure differences between development and production.. During deployment, the model moves from a controlled development environment into production, where infrastructure, data distributions, and traffic patterns differ. This shift commonly causes unexpected performance degradation — for example, different hardware, library versions, or input distributions than those used during training and validation. The other options describe activities from earlier lifecycle stages (data preparation, research) or are not AI lifecycle risks at all.

Answer

Cleaning the initial dataset.

Answer

Writing the initial research paper.

Answer

Choosing the wrong programming language.

Question 9

If an AI model relies on an open-source library that is found to have a security vulnerability, who is responsible for managing this risk?

Accepted Answer

The AI Risk Manager and Security team. When an AI system depends on a vulnerable open-source library, the organization deploying the model owns the residual risk. The AI Risk Manager and Security team are responsible for identifying, assessing, and mitigating that risk through patching, compensating controls, or replacing the dependency. Responsibility cannot be outsourced to the library author or regulators simply because the code was third-party.

Answer

The government regulators

Answer

The library's author

Answer

The public at large

Question 10

When integrating AI risk into the corporate GRC (Governance, Risk, and Compliance) platform, what is the best practice for handling 'AI Model Drift' alerts?

Accepted Answer

Integrate drift alerts as risk indicators in the GRC platform for automated tracking.. Best practice is to integrate model drift alerts directly into the GRC platform as risk indicators, so they are tracked, scored, and routed through the same governance workflows as other enterprise risks. This enables automated tracking, trend analysis, and timely escalation. The other options either misroute alerts, ignore them, or suppress them, all of which defeat the purpose of drift monitoring.

Answer

Send all alerts to the help desk.

Answer

Ignore drift alerts until a manual audit happens annually.

Answer

Disable the alerts to prevent 'alert fatigue'.