AAIR Practice Test 15 — 15 Questions

Question 1

What is the primary responsibility of a 'Model Owner' in an AI risk framework?

Accepted Answer

Maintaining the risk profile and performance of the model. The Model Owner is accountable for the model's risk profile and performance throughout its lifecycle, including ensuring it operates within approved risk tolerances, monitoring for drift or degradation, and maintaining documentation for governance and audit. This role bridges technical teams and governance bodies, ensuring the model continues to meet business, ethical, and regulatory requirements. It is an accountability role, not necessarily a hands-on coding role.

Answer

Writing all the Python code for the model

Answer

Approving company-wide bonuses

Answer

Fixing broken office furniture

Question 2

What is the goal of an AI 'Model Inventory'?

Accepted Answer

To maintain visibility over all AI models and their associated risk profiles.. An AI Model Inventory is a centralized register that maintains visibility over all AI models in use, including their purpose, owner, data sources, version, and risk classification. Its primary goal is governance and risk management — you cannot govern what you cannot see. It enables oversight, audit, and lifecycle management rather than deployment speed or data sharing.

Answer

To automatically delete old models.

Answer

To provide marketing data to competitors.

Answer

To increase the speed of model deployment.

Question 3

Which TWO factors are essential when documenting a model for risk management?

Accepted Answer

The model's intended use cases and operational boundaries.. Option A is correct because documenting a model for risk management must clearly state its intended use cases and operational boundaries, as these define the context in which the model is valid and where its risk exposure begins and ends. Option D is correct because recording the performance metrics and limitations observed during testing provides the quantitative evidence needed to assess residual risk, monitor degradation, and set appropriate controls or thresholds. Together, A and D establish both the scope of applicability and the empirical behavior of the model, which are foundational to any risk assessment. Option B is incorrect because the developers' coffee brand is irrelevant to model risk. Option C is incorrect because personal hobbies of team members have no bearing on model risk documentation. Option E is incorrect because listing all users who access the model is an access-control or audit concern, not an essential factor for documenting the model itself for risk management.

Answer

The specific brand of coffee used by the developers.

Answer

The specific team member's personal hobbies.

Answer

The names of all users who access the model.

Question 4

Which document should a practitioner review to determine the organization's threshold for acceptable AI model bias?

Accepted Answer

The Enterprise Risk Appetite Statement.. The Enterprise Risk Appetite Statement is the governing document that defines how much risk the organization is willing to accept across its operations, including acceptable thresholds for AI model bias. It translates board-level risk tolerance into measurable limits that AI teams must design and validate against. Reviewing it tells a practitioner what bias level is tolerable versus what would breach organizational policy.

Answer

The vendor's Service Level Agreement (SLA).

Answer

The software's End User License Agreement (EULA).

Answer

The AI development team's sprint backlog.

Question 5

Your organization is implementing an AI Risk Register. Which approach provides the most effective cross-functional coordination for identifying bias in a new HR recruitment AI?

Accepted Answer

Conduct a mandatory tabletop exercise involving HR, legal, and data science teams to simulate potential discriminatory outcomes.. A tabletop exercise brings together HR, legal, and data science teams to simulate discriminatory outcomes, which is the most effective cross-functional coordination method because it surfaces bias risks that no single discipline can identify alone. HR understands job role requirements and historical hiring patterns, legal understands anti-discrimination law and liability, and data science understands model mechanics and data distributions. This collaborative simulation aligns with NIST AI RMF and ISO/IEC 42001 expectations for stakeholder engagement in AI risk identification.

Answer

Perform a technical audit on the training dataset distribution.

Answer

Automate all bias detection using internal library scripts without human review.

Answer

Update the AI policy to forbid the use of demographic attributes in training data.

Question 6

A manufacturing firm is adopting a 'Privacy by Design' approach for AI. How does this integrate with the AI Risk Governance framework?

Accepted Answer

Privacy controls are integrated into the MLOps pipeline as automated gates.. Privacy by Design (PbD) is a proactive principle that requires embedding privacy protections into systems from the outset, not as an afterthought. In an AI Risk Governance framework, this translates to operationalizing privacy controls—such as data minimization, consent checks, and anonymization—as automated gates within the MLOps pipeline. This ensures that every model training, evaluation, and deployment step adheres to privacy requirements before progressing, making privacy an integral, continuous part of the AI lifecycle rather than a one-time or post-hoc review.

Answer

Privacy becomes the responsibility of the vendor, not the company.

Answer

Privacy is only reviewed after the model is deployed.

Answer

Privacy impact assessments are excluded to speed up model deployment.

Question 7

What is the primary reason for maintaining an 'AI Model Inventory'?

Accepted Answer

To identify and mitigate shadow AI risks. The primary reason for maintaining an AI Model Inventory is to identify and mitigate shadow AI risks by providing a centralized record of all models in use. This visibility helps ensure compliance, track model lifecycle, and manage risks such as unauthorized deployments. It is not for sharing code or backing up databases.

Answer

To share model code with competitors

Answer

To make the database easier to back up

Answer

To increase the size of the IT department

Question 8

Which TWO items are considered 'AI Infrastructure' risks?

Accepted Answer

Unauthorized access to the model environment. Option D (Unauthorized access to the model environment) is a correct AI Infrastructure risk because the model environment—training pipelines, inference endpoints, model registries, and the underlying compute/storage—must be protected by identity and access controls; a breach there can lead to model theft, data exfiltration, tampering with weights, or poisoned outputs, making it a core infrastructure security concern. Option E (System uptime/availability) is also a correct AI Infrastructure risk because AI workloads depend on continuous availability of GPUs/TPUs, orchestration (e.g., Kubernetes), and serving infrastructure; downtime directly degrades or halts training and inference, so availability is a fundamental infrastructure risk. The remaining options—A (wall color), B (desk chair type), and C (number of windows)—are workplace ergonomics or facilities aesthetics and have no bearing on AI infrastructure security, performance, or reliability, so they are not AI Infrastructure risks.

Answer

The color of the server room walls

Answer

The type of desk chair in the office

Answer

The number of windows in the office

Question 9

Which THREE components must be included in an AI Model 'Control Framework' to ensure effective risk mitigation?

Accepted Answer

Access management controls restricting model usage.. Option B (Access management controls restricting model usage) is correct because enforcing authentication, authorization, and least-privilege access to AI models prevents unauthorized use, tampering, or data exfiltration, which are core risk-mitigation controls in any AI control framework. Option D (Manual approval gates for model deployment) is correct because human-in-the-loop approval before promoting a model to production ensures that risk, compliance, and performance checks are satisfied before the model can affect real users or systems. Option E (Automated version control for model training code) is correct because tracking code, data, and configuration changes with automated version control provides reproducibility, auditability, and rollback capability, which are essential for detecting and remediating model-related risks. Option A (Hardware power usage tracking) is not a required control-framework component for risk mitigation, as it addresses cost or sustainability monitoring rather than AI risk governance. Option C (Public disclosure of all model architecture details) is not required and would often increase risk by exposing intellectual property and attack surface, so it does not belong in a risk-mitigation control framework.

Answer

Hardware power usage tracking.

Answer

Public disclosure of all model architecture details.

Question 10

When designing an AI Risk Committee, which TWO of the following roles are essential for ensuring a holistic view of risk?

Accepted Answer

Chief Legal Counsel.. Option A, Chief Legal Counsel, is essential because this role supplies the legal and regulatory perspective on AI risk, covering compliance obligations, liability exposure, intellectual property, and data-protection statutes that a holistic risk view must incorporate. Option C, Lead Data Scientist, is essential because this role provides the technical perspective on model behavior, including data quality, bias, explainability, validation, and performance limitations that determine actual AI risk. Together these two roles balance legal/compliance governance with technical/algorithmic insight, which is exactly what a holistic AI Risk Committee requires. The unmarked options do not belong: the Office Assistant, Social Media Manager, and Facilities Manager address administrative, marketing, and physical-building concerns respectively, none of which provide the legal or technical risk expertise needed for AI risk oversight.

Answer

Office Assistant.

Answer

Social Media Manager.

Answer

Facilities Manager.

Question 11

You are auditing an AI project. Which finding suggests a failure in AI risk management governance?

Accepted Answer

No individual is designated as the accountable owner for the model's production outcomes.. The absence of a designated accountable owner for the model's production outcomes is a clear governance failure. AI risk management frameworks (NIST AI RMF, ISO/IEC 42001) require clear accountability structures so that someone is responsible for model performance, incident response, and compliance. Without an accountable owner, risks go unmanaged, issues go unreported, and remediation stalls.

Answer

The model was trained on historical data.

Answer

The team uses a cloud-based GPU provider.

Answer

The model has a 2% prediction error rate.

Question 12

Which document defines the 'AI Risk Appetite' for an organization?

Accepted Answer

The AI Risk Appetite Statement.. The AI Risk Appetite Statement is the document approved by the Board that defines the risk tolerance for AI activities.

Answer

The Employee Training Manual.

Answer

The IT Service Catalog.

Answer

The AI Project Status Report.

Question 13

Which document is the most appropriate starting point for an AI Risk assessment for a new machine learning project?

Accepted Answer

An AI Risk Assessment Protocol/Template.. An AI Risk Assessment Protocol/Template provides a standardized framework for identifying, evaluating, and mitigating risks specific to AI systems, such as bias, privacy, and model drift. It ensures the assessment is systematic, repeatable, and aligned with governance requirements. Starting with a template guarantees that all critical risk dimensions are considered from the outset, rather than ad-hoc or incomplete analysis.

Answer

The marketing slide deck for the AI feature.

Answer

The technical API documentation.

Answer

The project budget spreadsheet.

Question 14

A multinational corporation is establishing an AI Risk Governance Committee. Who should chair this committee to ensure alignment with enterprise-wide risk appetite?

Accepted Answer

The Chief Risk Officer (CRO).. The Chief Risk Officer (CRO) owns the enterprise risk management framework and is the executive accountable for aligning all risk domains — including AI risk — with the organization's stated risk appetite. Chairing the AI Risk Governance Committee ensures AI-specific risks (bias, model drift, regulatory exposure) are evaluated through the same lens as financial, operational, and strategic risks. This preserves a single, coherent risk taxonomy across the enterprise.

Answer

The Chief Technology Officer (CTO).

Answer

The Lead AI Data Scientist.

Answer

The Head of Marketing.

Question 15

When drafting an AI risk policy, which element must be defined to provide clear guidance on acceptable AI outcomes?

Accepted Answer

Risk appetite statement. A risk appetite statement defines the level and types of risk an organization is willing to accept in pursuit of its objectives, providing clear guidance on acceptable AI outcomes. It translates abstract risk tolerance into concrete boundaries that AI teams can apply when designing, deploying, and operating models. Without it, decision-makers lack a consistent benchmark for what constitutes acceptable versus unacceptable AI risk.

Answer

AI model training data source list

Answer

Vendor procurement list

Answer

Technical architecture diagram