AAIR Practice Exam 1 — 20 Questions

Question 1

A developer is using 'Shadow Deployments' for a new AI model. What is the main risk being addressed?

Accepted Answer

Operational risk of deploying a poorly performing model to production.. Shadow deployments allow real-world data validation without exposing end-users to potential model failures.

Answer

Model documentation compliance.

Answer

Training data leakage.

Answer

Hardware infrastructure costs.

Question 2

A company is integrating an AI model that uses 'Online Inference'. What is the most significant risk regarding model security?

Accepted Answer

The risk of model inversion attacks on the inference endpoint.. Online inference endpoints are exposed to the public/network, creating surface area for adversarial attacks.

Answer

The risk of the training data being corrupted by the user.

Answer

The risk of high database storage costs.

Answer

The risk of the Python interpreter crashing.

Question 3

A practitioner is managing AI risk in a CI/CD pipeline. What should be the final gate before model promotion to production?

Accepted Answer

Automated performance validation against a hold-out test set with defined threshold gates.. Automated validation of performance metrics against a 'golden dataset' ensures the model meets the required threshold.

Answer

Increasing the memory of the production server.

Answer

Updating the project's documentation.

Answer

A peer review of the training code.

Question 4

Which TWO metrics are standard in 'Monitoring' for identifying performance-related AI risks?

Accepted Answer

Inference request latency.. Latency and error rates are the primary operational indicators of model performance risk.

Answer

The number of lines of documentation.

Answer

The color of the deployment dashboard.

Answer

The total number of servers available.

Question 5

A company is implementing 'Human-in-the-Loop' (HITL) for its AI decision system. What is the primary risk of relying on HITL?

Accepted Answer

The 'automation bias' or 'rubber stamping' of decisions by human reviewers.. Human fatigue and cognitive bias can lead to poor oversight, potentially creating a false sense of security.

Answer

It requires expensive API calls.

Answer

It causes the model to become slower.

Answer

It forces the model to use a specific programming language.

Question 6

Why is 'AI Literacy' for the board of directors a key component of AI Governance?

Accepted Answer

To enable effective decision-making regarding AI adoption and risk management.. Directors must understand AI risks and benefits to provide informed oversight and define the organization's risk appetite.

Answer

To allow directors to code their own AI models.

Answer

To replace the need for the Chief Risk Officer.

Answer

To reduce the cost of IT infrastructure.

Question 7

When deploying a generative AI model, what 'Governance Control' is most critical for preventing the generation of harmful/inappropriate content?

Accepted Answer

Implement output guardrails and moderation layers.. Guardrails are technical controls placed on top of models to intercept and filter output, which is a vital part of risk governance.

Answer

Increase the number of GPUs to make it faster.

Answer

Only use the model in an internal environment without internet access.

Answer

Allow users to provide feedback directly to the model.

Question 8

You are mapping AI risks to the NIST AI RMF. Which step is essential when documenting the 'Map' function for a high-risk autonomous system?

Accepted Answer

Identifying and documenting the context and intended use. Identifying and documenting the context and intended use is the foundation of mapping AI risks to an enterprise framework.

Answer

Updating the SOC2 Type II report

Answer

Automating the model deployment pipeline

Answer

Conducting a quarterly penetration test

Question 9

An organization is considering outsourcing its AI development. How should the 'AI Risk Governance' policy be adjusted for third-party vendors?

Accepted Answer

Include mandatory audit rights, model validation requirements, and risk-sharing clauses in the vendor contract.. Third-party risk management must include audit rights and clear accountability for the vendor's models.

Answer

Assume that the vendor's own governance is sufficient.

Answer

Only evaluate the vendor for financial stability.

Answer

Exclude outsourced AI from the internal risk assessment.

Question 10

When building an AI Governance framework, which TWO of the following are essential for ensuring enterprise adoption?

Accepted Answer

Integration with existing GRC and software delivery workflows.. Adoption requires alignment with existing processes and clear communication.

Answer

Providing mandatory 40-hour weekly training sessions.

Answer

Using only manual, spreadsheet-based tracking.

Answer

Requiring all developers to be lawyers.

Question 11

When assessing the organizational readiness for AI risk governance, which TWO areas must be evaluated to ensure the framework is sustainable?

Accepted Answer

The availability of cross-functional expertise (e.g., legal, compliance, ethics) within the AI governance body.. Sustainable governance requires both the human element (culture/skills) and the procedural element (integration into existing systems).

Answer

The speed of the network bandwidth between training sites.

Answer

The capability of the internal audit team to audit AI models.

Answer

The total number of GPUs available in the data center.

Question 12

Which THREE factors should be monitored to detect 'Model Drift' in the deployment phase?

Accepted Answer

The distribution of prediction outputs.. Feature distribution, target distribution, and model confidence scores all provide signals of drift.

Answer

The temperature of the server room.

Answer

The current market price of GPU hardware.

Question 13

When reporting AI risks to the Board of Directors, which THREE elements should be included to ensure informed decision-making?

Accepted Answer

Qualitative overview of ethical AI alignment with company values.. Board-level reports must focus on strategic impact, compliance posture, and high-level risk exposure.

Answer

List of all developers who worked on the model.

Answer

Granular technical logs of model inference errors.

Question 14

Which document defines the 'AI Risk Appetite' for an organization?

Accepted Answer

The AI Risk Appetite Statement.. The AI Risk Appetite Statement is the document approved by the Board that defines the risk tolerance for AI activities.

Answer

The Employee Training Manual.

Answer

The IT Service Catalog.

Answer

The AI Project Status Report.

Question 15

What is the primary risk associated with 'Shadow AI' in an organization?

Accepted Answer

It bypasses established AI risk governance and compliance controls.. Shadow AI refers to AI tools deployed without the knowledge or oversight of the governance team, creating invisible, unmanaged risks.

Answer

It makes the network run slower.

Answer

It costs too much.

Answer

It makes the developers work too hard.

Question 16

A firm is integrating AI into its ERM (Enterprise Risk Management). What is the primary benefit of a 'Common Risk Taxonomy' for AI?

Accepted Answer

It ensures consistent risk identification, communication, and reporting across the organization.. A common taxonomy ensures that AI risk is understood and communicated consistently across the enterprise.

Answer

It forces all AI models to be identical.

Answer

It makes AI code easier to write.

Answer

It eliminates the need for risk assessments.

Question 17

You are assessing risk for an AI model that uses 'Transfer Learning'. What is the most critical risk to manage regarding the pre-trained base model?

Accepted Answer

The base model may have been trained on data that contains inherent, unidentifiable biases.. Transfer learning risks include the inheritance of latent biases from the pre-trained weights.

Answer

The base model cannot be used with custom datasets.

Answer

The base model will always run out of memory.

Answer

The base model requires a proprietary operating system.

Question 18

Which THREE factors contribute to 'Data Quality Risk' during the training phase?

Accepted Answer

Incomplete datasets with many missing values.. Incomplete data, selection bias, and incorrect labeling all directly degrade the model's foundation.

Answer

The model is too large for the GPU memory.

Answer

Using the wrong cloud vendor.

Question 19

A firm is establishing an AI Governance Committee. Which TWO groups should be represented to ensure comprehensive oversight?

Accepted Answer

Data Privacy Office. Legal/Compliance and Data Privacy are essential for addressing the regulatory and ethical risks inherent in AI deployments.

Answer

Public relations

Answer

Hardware vendors

Answer

External marketing agencies

Question 20

An organization is integrating AI risk into its existing ISO 31000 framework. How should the 'Risk Assessment' process be modified to account for AI-specific 'black box' issues?

Accepted Answer

Add a model explainability and interpretability assessment step to the process.. Inclusion of model explainability assessments is necessary to address the opacity inherent in deep learning models.

Answer

Remove the risk identification step, as AI risks are too unpredictable.

Answer

Replace the qualitative assessment with a purely quantitative financial impact model.

Answer

Delegate all risk assessments to the external software vendor.