AAIR Practice Test 14 — 15 Questions

Question 1

Which THREE risks are associated with 'Automated Deployment' of AI models without a human-in-the-loop?

Accepted Answer

Rapid propagation of faulty or biased models to production.. Option A is correct because automated deployment pipelines can push a faulty or biased model artifact straight to production without any manual review gate, so errors propagate at machine speed across all serving instances. Option C is correct because without a human reviewing the deployment configuration (IAM roles, exposed endpoints, secrets handling, container/image provenance), misconfigurations and security vulnerabilities can be merged and applied automatically. Option D is correct because human intuition and contextual judgment are often what catch edge-case or out-of-distribution failures that automated tests and metrics do not cover, and removing the human-in-the-loop eliminates that safeguard. Option B is not a risk of automation — automated deployment is generally faster, not slower, than manual release. Option E is not a risk of automated deployment; disk space consumption depends on model size and artifact retention, not on whether a human approves the deployment.

Answer

The deployment takes too long to run.

Answer

Increased use of disk space.

Question 2

An enterprise is establishing an AI Governance Committee. Which organizational structure best ensures that risk management is integrated into the AI development lifecycle?

Accepted Answer

Cross-functional membership including Legal, Security, and Engineering. A cross-functional AI Governance Committee including Legal, Security, and Engineering ensures that legal/regulatory, security/privacy, and technical feasibility perspectives are all represented in AI risk decisions. This integration embeds risk management into the development lifecycle because engineering is at the table alongside the functions that define constraints and obligations, enabling risks to be identified and mitigated during design rather than after deployment.

Answer

Centralized control under the Chief Data Officer

Answer

External advisory board oversight

Answer

Automated AI risk assessment tools alone

Question 3

During the AI lifecycle, when should a 'Data Quality' assessment be performed to minimize long-term risk?

Accepted Answer

During the data ingestion and preprocessing stage.. Data quality assessment must happen during data ingestion and preprocessing, because that is when data is collected, cleaned, validated, and transformed before it reaches model training. Catching quality issues here prevents garbage-in-garbage-out propagation and is far cheaper than remediating after deployment. This early-stage control minimizes long-term risk across the entire AI lifecycle.

Answer

After model deployment in production.

Answer

During the final model sign-off.

Answer

During the decommission phase.

Question 4

Which TWO of the following governance actions should a Chief Risk Officer (CRO) implement to align AI risk with the COSO Enterprise Risk Management (ERM) framework?

Accepted Answer

Establish a cross-functional AI Risk Committee. Option A is correct because the COSO ERM framework emphasizes governance and operating structures, and a cross-functional AI Risk Committee establishes the oversight body needed to integrate AI risk across the enterprise and align it with strategic objectives. Option E is correct because COSO ERM requires defining risk appetite and tolerance, so AI-specific risk appetite statements embedded in the ERM policy ensure AI risks are governed within the organization's overall risk posture. Option B is incorrect because assigning AI risk ownership solely to individual data scientists fragments accountability and ignores COSO's principle of enterprise-level ownership and oversight. Option C is incorrect because disabling all open-source AI libraries is a blunt technical control, not a governance action, and would impede innovation without addressing risk alignment. Option D is incorrect because mandating daily model training cycles is an operational/technical decision unrelated to COSO ERM governance alignment.

Answer

Assign AI risk ownership to individual data scientists

Answer

Disable all open-source AI libraries

Answer

Mandate daily model training cycles

Question 5

Which TWO of the following are key components of a robust AI lifecycle risk management program?

Accepted Answer

Continuous model performance and data quality monitoring.. Option A is correct because continuous monitoring of model performance and data quality is essential for detecting drift, degradation, and data issues throughout the AI lifecycle, enabling timely retraining or remediation. Option D is correct because comprehensive versioning of data, code, and model artifacts provides traceability, reproducibility, and auditability, which are foundational to managing risk across the AI lifecycle. Options B, C, and E are not key components of AI lifecycle risk management: using only open-source libraries, adhering to a single coding language, and increasing team size do not by themselves address risk controls, governance, or model reliability.

Answer

Using only open-source libraries.

Answer

Strict adherence to a single coding language.

Answer

Increasing the number of developers on the team.

Question 6

Which TWO of the following are considered 'High-Risk' AI use cases that require enhanced oversight by the Governance Committee?

Accepted Answer

AI-powered biometric identification for facility access.. Option B is correct because AI-powered biometric identification for facility access processes sensitive biometric data and controls physical security, making it a high-risk use case that demands enhanced oversight by the Governance Committee. Option C is correct because automated recruitment and hiring filtering tools directly affect individuals' employment opportunities and can introduce bias or discrimination, which places them in the high-risk category requiring stricter governance. Options A and D are not high-risk since basic spell-checking and email auto-complete are low-impact productivity features with minimal risk to rights or safety. Option E is also not high-risk because internal cafeteria menu suggestions have negligible impact on individuals and pose no significant compliance or ethical concerns.

Answer

Basic spell-checking software.

Answer

Email auto-complete features.

Answer

AI systems used for internal cafeteria menu suggestions.

Question 7

Which THREE items are necessary for a comprehensive 'AI Governance Policy'?

Accepted Answer

Standard Operating Procedures (SOPs) for model lifecycle management.. Option A is correct because a comprehensive AI Governance Policy must include Standard Operating Procedures (SOPs) that define the repeatable processes for model lifecycle management, covering stages such as data collection, training, validation, deployment, monitoring, and retirement, which ensures consistency and accountability. Option D is correct because an AI risk classification framework (e.g., Low, Medium, High) is essential for tiering AI systems by potential impact, so that controls, review rigor, and approval levels are proportionate to the risk each system presents. Option E is correct because clearly defining roles and responsibilities for AI risk oversight establishes ownership and accountability — for example, who approves models, who monitors drift, and who handles incidents — which is a foundational element of any governance policy. Option B is not appropriate because listing every single line of code is an impractical and unnecessary level of detail for a governance policy; governance addresses principles, controls, and processes rather than source code inventories. Option C is not appropriate because collecting developers' personal home addresses is irrelevant to AI governance and would raise serious privacy and data protection concerns.

Answer

A list of every single line of code in the production models.

Answer

The personal home addresses of all developers.

Question 8

Which THREE artifacts should be reviewed during a post-incident AI risk analysis?

Accepted Answer

The original Model Card and documentation.. The original Model Card and documentation (C) must be reviewed because it defines the model's intended purpose, training data characteristics, performance metrics, and known limitations, which are essential to determine whether the incident stemmed from out-of-scope use or undocumented behavior. The raw input and prediction output logs (D) are critical because they let analysts reconstruct the exact inference requests and responses surrounding the incident, revealing drift, adversarial inputs, or anomalous outputs that triggered the risk event. The model versioning and lineage logs (E) are also required to trace which model artifact, training dataset, and pipeline commit were actually serving at the time, since a regression or unauthorized model swap is a common root cause in AI incidents. By contrast, employee training certificates (A) and building access logs for the data center (B) are general physical or HR compliance records that do not capture model behavior, data provenance, or inference-time evidence needed for an AI-specific post-incident analysis.

Answer

The employee training certificates.

Answer

The building access logs for the data center.

Question 9

In the context of the Google Cloud Vertex AI Model Registry, what is the best approach to mitigate the risk associated with a model update that performs poorly on edge cases?

Accepted Answer

Implement traffic splitting with a shadow deployment.. Traffic splitting with a shadow deployment lets the new model version receive live traffic (or a copy of it) without affecting production responses, so its behaviour on edge cases can be observed before any real user impact. This directly mitigates the risk of a poorly performing update by gating promotion on measured performance. It is the standard safe-rollout pattern in Vertex AI Model Registry.

Answer

Increase the training epoch count for the new version.

Answer

Directly replace the active production model version.

Answer

Update the training data to remove edge case records.

Question 10

In the context of the Three Lines of Defense, which function constitutes the 'Second Line'?

Accepted Answer

The AI Risk Management and Compliance teams.. In the Three Lines of Defense model, the Second Line consists of risk management and compliance functions that provide oversight, guidance, and challenge to the First Line (operational/business teams). For AI governance, the AI Risk Management and Compliance teams own frameworks, policies, and monitoring that ensure AI development and deployment align with risk appetite and regulatory requirements. They are independent from day-to-day operations but not fully independent like Internal Audit.

Answer

The Internal Audit department.

Answer

The Board of Directors.

Answer

The AI Development team.

Question 11

A firm is establishing an AI Governance Committee. Which TWO groups should be represented to ensure comprehensive oversight?

Accepted Answer

Data Privacy Office. Legal/Compliance and Data Privacy are essential for addressing the regulatory and ethical risks inherent in AI deployments.

Answer

Public relations

Answer

Hardware vendors

Answer

External marketing agencies

Question 12

An organization is establishing an AI Risk Committee. Which stakeholder is most critical to include to ensure alignment between enterprise risk appetite and technical AI capabilities?

Accepted Answer

Chief Risk Officer (CRO).. The Chief Risk Officer (CRO) is the executive who owns the enterprise risk appetite and the ERM framework, making them the most critical member to align AI risk governance with the organization's overall risk posture. Including the CRO ensures AI risks are scored, escalated, and mitigated using the same taxonomy and tolerance thresholds applied to financial, operational, and strategic risks. Without CRO involvement, AI risk decisions can drift from enterprise risk appetite.

Answer

Chief Information Security Officer (CISO).

Answer

Lead Cloud Architect.

Answer

Head of Human Resources.

Question 13

When considering the 'Risk of Bias' in an AI system, which THREE components should be audited?

Accepted Answer

The post-processing decisions made on the model outputs.. Option B is correct because bias can be introduced or amplified after the model produces its raw outputs, so auditing post-processing decisions (such as thresholding, ranking, filtering, or business rules applied to scores) is essential to detect and mitigate discriminatory outcomes. Option C is correct because the composition and representativeness of the training dataset directly determine whether the model learns patterns that generalize fairly; auditing for sampling bias, label bias, and underrepresentation of protected groups is a core part of a Risk of Bias assessment. Option E is correct because the objective or loss function encodes what the model optimizes for, and a poorly chosen loss (for example, optimizing overall accuracy on imbalanced data) can systematically disadvantage certain groups, so it must be audited. Option A is not correct because the physical location of a cloud data center relates to data residency, sovereignty, or latency concerns, not to bias in model behavior. Option D is not correct because team break schedules have no bearing on algorithmic bias and are irrelevant to a Risk of Bias audit.

Answer

The physical location of the cloud data center.

Answer

The number of coffee breaks the data science team takes.

Question 14

A practitioner is setting up a model monitoring service in AWS SageMaker Model Monitor. They observe that the ground truth data is significantly delayed. What action ensures risk identification remains effective?

Accepted Answer

Configure Data Quality Monitoring on input features only.. When ground truth labels are delayed, SageMaker Model Monitor cannot compute model quality metrics (accuracy, precision, etc.) because those require labels. The effective fallback is to enable Data Quality Monitoring on input features, which detects drift, missing values, and distribution shifts without needing labels, preserving risk identification in the interim.

Answer

Disable monitoring until ground truth is available.

Answer

Manually force a model redeployment.

Answer

Reduce the sampling rate of the inference logs.