AAIR Practice Exam 3 — 20 Questions

Question 1

A team notices that an AI model's performance decreases when the input data contains abbreviations that were not present in the training set. This is a risk associated with which lifecycle stage?

Accepted Answer

Data preprocessing and training design.. This is a Data Quality/Data Representation risk, where the model's understanding of data is limited by the training corpus.

Answer

Infrastructure provisioning.

Answer

Monitoring phase.

Answer

Deployment phase.

Question 2

To mitigate 'Training-Serving Skew' in the AI lifecycle, what is the best practice for data processing pipelines?

Accepted Answer

Use a feature store to ensure consistent feature engineering logic for both stages.. Using a unified feature store ensures that the exact same transformation logic is used for both training and inference.

Answer

Write separate code for training and inference to optimize for speed.

Answer

Use only raw data for both training and inference.

Answer

Train the model on the production server directly.

Question 3

Which TWO of the following techniques help mitigate bias in the AI lifecycle?

Accepted Answer

Conducting fairness audits using specialized metrics (e.g., Disparate Impact).. Diverse data sourcing and fairness evaluation are standard methods for bias mitigation.

Answer

Switching the programming language to Java.

Answer

Reducing the frequency of model monitoring.

Answer

Increasing the number of features in the model.

Question 4

When integrating AI risk into existing ERM, which THREE aspects of an AI model lifecycle must be audited to ensure compliance?

Accepted Answer

Model validation results. Data lineage, model validation results, and incident response logs are critical audit points for enterprise risk accountability.

Answer

Personnel physical security badges

Answer

Office climate control settings

Question 5

In the context of AI model risk management, what is the role of an 'AI Model Inventory' within the governance framework?

Accepted Answer

To track model metadata, risk ratings, and owners for oversight and audit purposes.. An inventory is the foundational requirement for knowing what models exist, their criticality, and their risk profile.

Answer

To store the actual training data sets for backup.

Answer

To limit the number of AI developers in the company.

Answer

To serve as a marketing catalog for external clients.

Question 6

Which THREE components must be included in an AI Risk Register to satisfy ISO/IEC 42001 requirements?

Accepted Answer

Identification of relevant stakeholders. ISO 42001 requires systematic risk identification, analysis, and treatment planning.

Answer

Hardware procurement schedules

Answer

Technical documentation of model architecture

Question 7

During a board-level review, a bank needs to demonstrate the effectiveness of its AI Risk Governance. Which metric should be presented to the board to align with the 'Accountability' principle of the AI RMF?

Accepted Answer

The percentage of AI models with documented, independent model risk management (MRM) validation.. Board oversight requires metrics on accountability, such as the auditability of model decision-making trails.

Answer

The total computational cost of running the models.

Answer

The number of lines of code written for the AI model.

Answer

The frequency of model retraining cycles.

Question 8

In the context of the AI RMF, what is the significance of the 'Measure' function for risk management?

Accepted Answer

To evaluate the model's performance and risk outcomes against established benchmarks.. The 'Measure' function uses quantitative and qualitative assessments to test whether the model is meeting its goals and risk requirements.

Answer

To identify which employees have access to the AI system.

Answer

To set the budget for future AI projects.

Answer

To provide a score for the developers' performance.

Question 9

Which TWO teams should define the 'Risk Appetite' for a new AI project?

Accepted Answer

Senior Leadership/Business Owners. Risk appetite is a strategic decision involving both business leaders (who own the risk) and risk managers (who define the framework).

Answer

The local weather station

Answer

The office landscaping team

Answer

The company's mascot

Question 10

Which TWO factors are essential when documenting a model for risk management?

Accepted Answer

The model's intended use cases and operational boundaries.. Intended use and performance boundaries are essential for governance.

Answer

The specific brand of coffee used by the developers.

Answer

The specific team member's personal hobbies.

Answer

The names of all users who access the model.

Question 11

Which department is primarily responsible for ensuring AI models comply with data protection regulations like GDPR?

Accepted Answer

The Compliance/Legal Department and the Data Protection Officer.. The Data Protection Officer (DPO) and Legal/Compliance teams are responsible for regulatory compliance.

Answer

The Sales force.

Answer

The Accounting Department.

Answer

The Janitorial staff.

Question 12

You are integrating AI risk into the NIST Risk Management Framework (RMF). Which step requires an explicit evaluation of AI model lineage and data provenance to satisfy the 'Govern' function?

Accepted Answer

Governance mapping during 'Govern' function analysis. The NIST AI RMF 'Govern' function prioritizes understanding the provenance and lineage to establish accountability and transparency.

Answer

Step 2: Select controls

Answer

Step 1: Categorize system

Answer

Continuous Monitoring phase

Question 13

A financial firm is integrating AI risk into its ERM. The Chief Risk Officer asks for a mapping between the NIST AI Risk Management Framework (RMF) and the existing COSO ERM framework. Which action most effectively facilitates this alignment?

Accepted Answer

Map NIST AI RMF 'Govern' and 'Map' functions to COSO 'Governance and Culture' components.. Mapping functions like 'Govern' and 'Map' in NIST AI RMF directly correlate to COSO's 'Governance and Culture' and 'Strategy and Objective-Setting' components.

Answer

Replace the COSO risk taxonomy with the NIST AI RMF taxonomy entirely.

Answer

Automate all AI model monitoring using only the NIST RMF 'Measure' function.

Answer

Assign AI model owners to report directly to the NIST oversight board.

Question 14

Which THREE components must be included in an AI Model 'Control Framework' to ensure effective risk mitigation?

Accepted Answer

Access management controls restricting model usage.. Controls must cover the lifecycle, from development integrity to ongoing monitoring and access management.

Answer

Hardware power usage tracking.

Answer

Public disclosure of all model architecture details.

Question 15

Which THREE activities are part of the 'AI Risk Management' lifecycle?

Accepted Answer

Risk Treatment/Mitigation.. The cycle consists of identification, assessment/treatment, and ongoing monitoring.

Answer

Manual approval of all company emails.

Answer

Writing press releases about AI success.

Question 16

A firm adopts the 'Three Lines of Defense' model for AI. What is the specific responsibility of the 'Third Line' (Internal Audit)?

Accepted Answer

Providing independent assurance on the design and effectiveness of the AI governance framework.. The Third Line provides independent, objective assurance on the effectiveness of the risk management and governance processes.

Answer

Approving AI model deployment.

Answer

Developing the AI models.

Answer

Defining the AI risk appetite.

Question 17

Which THREE factors are essential to consider when determining the 'AI Risk Appetite' for an enterprise?

Accepted Answer

The organization's tolerance for legal and reputational damage.. Risk appetite must consider the organization's business strategy, regulatory environment, and technical capability.

Answer

The current market share of the company.

Answer

Historical data volume.

Question 18

An organization is revising its AI Governance to include 'Human-in-the-loop' (HITL) requirements. Why is this a critical risk mitigation strategy?

Accepted Answer

It ensures human oversight for critical decisions, reducing the risk of 'black box' failures.. HITL provides a necessary safety net for models that may exhibit unpredictable behavior or lack explainability.

Answer

It removes the requirement for model bias testing.

Answer

It is required for every AI model regardless of impact.

Answer

It eliminates the need for any other automated risk controls.

Question 19

What is the goal of an AI 'Model Inventory'?

Accepted Answer

To maintain visibility over all AI models and their associated risk profiles.. The inventory provides a central repository for tracking all AI assets, which is the baseline for risk management.

Answer

To automatically delete old models.

Answer

To provide marketing data to competitors.

Answer

To increase the speed of model deployment.

Question 20

What is the 'Accountability' principle in the NIST AI RMF intended to address?

Accepted Answer

Ensuring that there is clear ownership and responsibility for AI system performance and safety.. Accountability ensures that individuals or teams are responsible for the outcomes of AI systems, preventing a 'blame-free' environment for AI failures.

Answer

Ensuring the AI can explain itself.

Answer

Making sure the model is free of bugs.

Answer

Ensuring that the AI system is fast.