AAIR Practice Test 13 — 15 Questions

Question 1

Which THREE components must be included in an AI Risk Register to satisfy ISO/IEC 42001 requirements?

Accepted Answer

Identification of relevant stakeholders. ISO/IEC 42001 requires an AI risk register to capture the context and scope of each AI system, so option E (AI system description and intended use) is correct because the register must document what the system does, its purpose, and boundaries to properly frame the associated risks. Option C (identification of relevant stakeholders) is correct because ISO/IEC 42001 emphasizes accountability and interested-party considerations, requiring the register to name the parties affected by or responsible for the AI system. Option D (assessment of AI risk levels with likelihood and impact) is correct because the standard follows a risk-based approach where each identified risk must be evaluated for likelihood and impact to prioritize treatment. Option A (hardware procurement schedules) is not part of the risk register content under ISO/IEC 42001, as procurement logistics are operational records rather than risk documentation. Option B (technical documentation of model architecture) is also not a required register component, since architecture details belong to technical documentation and model cards, not the risk register itself.

Answer

Hardware procurement schedules

Answer

Technical documentation of model architecture

Question 2

Which THREE factors should be considered when assessing the 'Risk Level' of an AI application?

Accepted Answer

The sensitivity of the input data.. Option A is correct because the sensitivity of the input data directly determines the potential harm if that data is exposed or misused, so higher-sensitivity data (e.g., PII, health, biometric data) raises the assessed Risk Level. Option B is correct because the criticality of the automated decision-making process reflects how consequential errors or failures would be, and automating high-stakes decisions (e.g., credit, medical triage) elevates risk. Option D is correct because potential impact on human rights and individual safety is a core risk dimension in AI risk frameworks, capturing harms such as discrimination, loss of liberty, or physical injury. Option C does not belong because neural network architectural complexity is an implementation detail that does not by itself determine risk level. Option E does not belong because user interface color scheme is a cosmetic design choice with no bearing on AI risk assessment.

Answer

The complexity of the neural network architecture.

Answer

The color scheme of the user interface.

Question 3

A cross-functional committee is evaluating the deployment of a high-impact AI model. Which TWO factors are critical to include in the initial AI risk assessment to ensure comprehensive coverage?

Accepted Answer

The socio-technical implications and potential impact on protected groups.. Option B is correct because a comprehensive AI risk assessment must evaluate socio-technical implications, including how the model's deployment could disproportionately affect protected groups (e.g., by race, gender, age, or disability), which is central to fairness, equity, and regulatory compliance concerns such as those in the EU AI Act and NIST AI RMF. Option C is correct because understanding training data lineage—provenance, collection methods, and embedded bias sources—is essential to identifying data-driven risks like historical bias, sampling bias, and label bias that propagate into model outputs. Options A, D, and E are not critical initial risk-assessment factors: patching frequency (A) is a general infrastructure hygiene concern, the vendor name (D) is a procurement detail rather than a risk dimension, and the programming language (E) is an implementation choice that does not materially affect AI risk exposure.

Answer

The frequency of software patching for the underlying cloud infrastructure.

Answer

The name of the vendor providing the cloud compute resources.

Answer

The specific programming language used for the model development.

Question 4

Which THREE activities are part of the 'AI Risk Management' lifecycle?

Accepted Answer

Risk Treatment/Mitigation.. The AI Risk Management lifecycle follows the standard risk management process, which includes Risk Identification (C), where AI-related risks such as bias, data privacy issues, model drift, and security threats are systematically discovered and documented. Risk Treatment/Mitigation (B) is the phase where controls, safeguards, and remediation actions are selected and applied to reduce identified risks to acceptable levels. Ongoing Monitoring and Review (D) is essential because AI systems evolve through retraining, data changes, and environmental shifts, requiring continuous tracking of risk indicators and periodic reassessment of controls. Option A (manual approval of all company emails) is an operational email-handling procedure, not an AI risk management lifecycle activity, and option E (writing press releases about AI success) is a communications/marketing task unrelated to identifying, treating, or monitoring AI risk.

Answer

Manual approval of all company emails.

Answer

Writing press releases about AI success.

Question 5

When reporting AI risks to the Board of Directors, which THREE elements should be included to ensure informed decision-making?

Accepted Answer

Qualitative overview of ethical AI alignment with company values.. Option C is correct because a qualitative overview of ethical AI alignment with company values gives the Board the governance-level context needed to judge whether AI use is consistent with the organization's stated principles and risk culture. Option D is correct because reporting the current AI risk appetite together with any threshold breaches tells the Board whether actual risk exposure remains within the limits they approved, which is essential for informed oversight and escalation. Option E is correct because a strategic assessment of regulatory compliance and potential legal exposure highlights material obligations, enforcement trends, and liabilities that could affect strategy, reputation, and financial standing. Options A and B are not appropriate for Board-level reporting: a list of developers is an operational staffing detail, and granular technical logs of model inference errors are too low-level and tactical, belonging instead to engineering or model-risk teams rather than the Board.

Answer

List of all developers who worked on the model.

Answer

Granular technical logs of model inference errors.

Question 6

When building an AI Governance framework, which TWO of the following are essential for ensuring enterprise adoption?

Accepted Answer

Integration with existing GRC and software delivery workflows.. Option B is correct because embedding AI governance controls directly into existing GRC platforms and CI/CD software delivery workflows (e.g., policy gates, automated evidence capture, approval steps) makes compliance a native part of how teams already work, which dramatically lowers friction and drives enterprise adoption. Option C is correct because a clear, collaborative engagement model between risk teams and developers—such as shared review boards, defined RACI, and joint risk-assessment sessions—removes the us-versus-them dynamic and ensures governance requirements are practical and understood, which is essential for sustained adoption. The remaining options do not belong: A is wrong because mandatory 40-hour weekly training is excessive and impractical, creating resistance rather than adoption; D is wrong because manual, spreadsheet-based tracking does not scale, is error-prone, and cannot integrate with enterprise workflows; and E is wrong because requiring all developers to be lawyers is neither feasible nor necessary for effective AI governance.

Answer

Providing mandatory 40-hour weekly training sessions.

Answer

Using only manual, spreadsheet-based tracking.

Answer

Requiring all developers to be lawyers.

Question 7

In a cross-functional AI governance meeting, the Data Science team wants to deploy a new model, but the Legal team is concerned about data privacy. How should the AI Risk Manager resolve this?

Accepted Answer

Conduct a joint risk assessment to identify potential mitigations. The AI Risk Manager should facilitate a joint risk assessment that brings together Data Science and Legal to identify privacy risks and potential mitigations. This collaborative approach balances innovation with compliance, rather than unilaterally halting work or escalating to the CEO prematurely. It ensures both technical and legal perspectives inform the decision.

Answer

Order the Data Science team to stop work immediately

Answer

Ask the CEO to decide

Answer

Ignore the Legal team's concerns

Question 8

Which TWO aspects of 'Data Governance' are critical for AI risk management?

Accepted Answer

Data access control and security. Data governance for AI risk management hinges on controlling who can access data and ensuring that data is trustworthy. Option A, data access control and security, is correct because AI systems depend on sensitive datasets, and governance must enforce authentication, authorization, encryption, and audit logging to prevent unauthorized access, data leakage, and tampering that could corrupt model behavior or violate privacy regulations. Option E, data quality and consistency, is correct because AI models learn directly from data; inaccurate, incomplete, duplicated, or inconsistent data leads to biased predictions, poor generalization, and unreliable outputs, so governance must define data standards, validation rules, and stewardship processes. The remaining options are irrelevant to AI risk management: the number of pens in the supply closet (B), the speed of the local internet (C), and the interior design of the office (D) are office logistics or aesthetics and have no bearing on data governance or AI risk controls.

Answer

The number of pens in the supply closet

Answer

The speed of the local internet

Answer

The interior design of the office

Question 9

A retail bank's credit-scoring AI was validated on 2023 applicant data and deployed in early 2024. By Q4 2024, portfolio default rates among approved loans have crept up while the model's input feature distributions remain statistically unchanged. The risk team wants to isolate the most probable lifecycle cause before retraining. Which risk management activity best addresses this situation?

Accepted Answer

Recompute the model's discrimination metrics against a fresh outcome-labeled holdout and compare them to the validation baseline.. When input distributions are stable but realized outcomes worsen, the lifecycle risk is concept drift rather than data drift. The only control listed that measures the changed feature-to-outcome relationship is re-evaluating discrimination and calibration against newly labeled outcomes and comparing to the validation baseline. That evidence determines whether retraining, recalibration, or redesign is warranted.

Answer

Recalibrate the model's probability outputs using isotonic regression on the original 2023 validation set.

Answer

Increase the decision threshold for approval to reduce the volume of higher-risk applicants entering the portfolio.

Answer

Run a Kolmogorov-Smirnov test on each input feature to detect data drift in the production population.

Question 10

Which TWO actions should be taken when a model exhibits significant drift?

Accepted Answer

Perform a root cause analysis to determine the nature of the drift.. Option A is correct because when a model exhibits significant drift, the first step is to perform a root cause analysis to determine whether the drift is due to data quality issues, concept drift, or environmental change, which informs the appropriate remediation. Option B is correct because if the root cause analysis identifies the drift as environmental change (e.g., shifting user behavior or seasonal patterns), retraining the model on updated, representative data is the standard remedy to restore performance. Option C is incorrect because disabling logging removes the observability needed to detect and diagnose drift, and it does not address the underlying model degradation. Option D is incorrect because switching to a simpler architecture is not a targeted response to drift and may reduce performance without resolving the data or concept shift. Option E is incorrect because adding compute resources does not fix drift, since the issue is a mismatch between the model and current data distribution, not insufficient processing power.

Answer

Disable all logging to improve performance.

Answer

Change the model architecture to something simpler.

Answer

Immediately increase the compute resources.

Question 11

The AI Governance Committee is defining the roles for AI Risk oversight. Which TWO functions are essential for the 'Three Lines of Defense' model in AI Risk?

Accepted Answer

AI development teams performing self-assessments.. In the Three Lines of Defense model, the first line consists of the operational teams that own and manage risk directly, so option A (AI development teams performing self-assessments) is correct because these teams are the ones building and running AI systems and must perform self-assessments as their first-line risk ownership responsibility. The second line provides independent oversight, monitoring, and challenge to the first line, so option E (the AI Risk Management function providing independent oversight) is correct because it is the dedicated risk function that establishes policies, frameworks, and independent review over AI risks. Option B is incorrect because drafting external press releases is a communications activity, not a risk oversight function within the Three Lines of Defense. Option C is incorrect because managing AI infrastructure is an operational/technology responsibility that would sit in the first line, not a distinct defense layer for AI risk oversight. Option D is incorrect because external vendors supplying cloud infrastructure are third parties, not an internal line of defense in the model.

Answer

The AI Ethics Committee drafting external press releases.

Answer

The Chief Information Officer managing all AI infrastructure.

Answer

External vendors providing cloud infrastructure.

Question 12

A firm is using the NIST AI Risk Management Framework to document its AI risk program. Which approach best ensures that AI risk metrics are dynamic?

Accepted Answer

Integrating model performance metrics into operational dashboards. Integrating model performance metrics into operational dashboards ensures that AI risk metrics are dynamic, as they are continuously updated and monitored in real time. This allows for timely detection of drift, bias, or degradation. Annual assessments and static thresholds are not dynamic.

Answer

Conducting annual risk assessments

Answer

Setting static thresholds for model accuracy

Answer

Limiting AI deployment to offline systems

Question 13

Which TWO factors should be included in an AI risk appetite statement?

Accepted Answer

Financial thresholds for model-related incidents. Option D is correct because a risk appetite statement must quantify how much financial loss from model-related incidents (e.g., fraud, erroneous decisions, remediation costs) the organization is willing to tolerate, expressed as concrete monetary thresholds or limits. Option E is correct because AI-specific risk appetite must define the maximum acceptable level of model bias (e.g., disparate impact ratios or fairness metric tolerances), since bias is a core AI risk affecting ethics, compliance, and legal exposure. Options A, B, and C are not appropriate: intended revenue impact is a business outcome rather than a risk tolerance limit, programming language is an implementation/technical standard, and preferred office software is an unrelated productivity choice — none of these express acceptable risk levels for AI systems.

Answer

The intended impact on company revenue

Answer

The specific programming language allowed

Answer

The preferred office software

Question 14

In the context of AI risk management, what does the 'Human-in-the-Loop' (HITL) concept primarily aim to achieve?

Accepted Answer

To maintain accountability and oversight for AI-driven decisions.. Human-in-the-Loop (HITL) primarily ensures that a human reviews, approves, or can override AI-driven decisions, preserving accountability and meaningful oversight. It addresses the governance need that a responsible person remains answerable for outcomes, especially in high-risk or regulated contexts. This maps directly to accountability principles in the NIST AI RMF and OECD AI Principles.

Answer

To reduce the cost of model development.

Answer

To increase the speed of model inference.

Answer

To automate the labeling of training data.

Question 15

A practitioner is reviewing the 'Model Card' for an AI system. What is the primary purpose of this artifact in the AI lifecycle risk management process?

Accepted Answer

To provide transparency regarding the model's limitations, intended use cases, and performance metrics.. The Model Card is a standardized transparency artifact (popularized by Mitchell et al., 2019) that documents a model's intended use, limitations, performance metrics across subgroups, training data provenance, and ethical considerations. In AI lifecycle risk management, it enables downstream consumers, auditors, and governance teams to assess whether a model is appropriate for a given context and to identify residual risks. It is a documentation and disclosure mechanism, not an operational or security component.

Answer

To automate the retraining pipeline for the model.

Answer

To serve as the primary authentication token for API access.

Answer

To define the deployment strategy in Kubernetes.