AAIR Practice Exam 3 — 20 Questions

Question 1

What is the first step in performing an AI Risk Assessment?

Accepted Answer

Defining the scope, context, and purpose of the AI system.. Per ISO 31000 and NIST AI RMF, every risk assessment begins with establishing scope, context, and purpose — defining which AI system is being assessed, its boundaries, stakeholders, operating environment, and the objectives of the assessment. Without this foundational step, subsequent activities like bias testing or control selection lack a reference frame and may address the wrong risks or miss critical ones. This mirrors ISO 31000 Clause 6.3.1, which explicitly places 'defining scope and context' as the first activity in the risk assessment process.

Answer

Hiring a security consultant.

Answer

Updating the company website.

Answer

Running a bias test.

Question 2

Which role is primarily responsible for ensuring that AI-generated content adheres to intellectual property risk policies?

Accepted Answer

Chief Legal Officer. The Chief Legal Officer is primarily responsible for ensuring that AI-generated content adheres to intellectual property risk policies, as they oversee legal compliance and IP strategy. This role ensures that AI outputs do not infringe on copyrights, trademarks, or other IP rights. Other roles lack the legal expertise and authority.

Answer

System Administrator

Answer

Product Manager

Answer

Data Engineer

Question 3

A board of directors requests a dashboard to monitor AI risk exposure. Which metric provides the most effective board-level oversight regarding AI regulatory compliance?

Accepted Answer

Percentage of critical AI systems that have undergone a formal regulatory compliance impact assessment.. The board's primary concern is regulatory compliance and risk exposure, not operational performance. The percentage of critical AI systems that have undergone a formal regulatory compliance impact assessment directly measures the organization's adherence to frameworks like the EU AI Act, NIST AI RMF, or ISO/IEC 42001. This metric provides assurance that high-risk AI systems are being evaluated against legal and ethical requirements, which is a core board-level oversight responsibility.

Answer

Mean Time to Detect (MTTD) for model adversarial attacks.

Answer

Current GPU utilization rates for production inference clusters.

Answer

Average latency of API requests for generative AI models.

Question 4

You are mapping existing ISO 31000 risk management processes to an AI-specific application. Which step is most crucial to ensure 'Risk Treatment' is appropriately scaled for AI?

Accepted Answer

Implementing a tiered control framework where mitigations scale based on the system's impact assessment.. A tiered control framework is the correct answer because ISO 31000's Risk Treatment step requires selecting controls proportionate to the assessed risk level. For AI, this means mitigations (e.g., human-in-the-loop review, explainability requirements, monitoring intensity) must scale with the system's impact classification — a low-risk internal chatbot needs lighter controls than a high-risk hiring or medical diagnostic model. This impact-based tiering directly operationalizes ISO 31000's principle that treatment options be evaluated against risk criteria and organizational context.

Answer

Automating all risk logging in the SIEM.

Answer

Discontinuing the use of third-party AI APIs to avoid vendor risk.

Answer

Standardizing all AI models under one security policy regardless of function.

Question 5

When an AI model is updated (e.g., retrained on new data), what action is required from an AI Risk Governance perspective?

Accepted Answer

The model should be re-validated to ensure it still meets risk thresholds.. Retraining a model on new data changes its behavior, so from a risk governance perspective it must be re-validated against the same risk thresholds (accuracy, fairness, robustness, compliance) before being trusted in production. Renaming or assuming no action is needed ignores the fact that the model's outputs and risk profile may have changed. Automatic deployment without review bypasses required oversight.

Answer

The model should be renamed to show it is a new version.

Answer

No action is needed as the underlying architecture is unchanged.

Answer

The model should be automatically deployed without review.

Question 6

Which of the following is an example of 'Data Quality Risk' in the AI lifecycle?

Accepted Answer

High rates of mislabeled training data.. High rates of mislabeled training data are a classic Data Quality Risk because labels directly determine what the model learns; systematic mislabeling introduces bias and degrades accuracy. Data quality risks encompass issues with accuracy, completeness, consistency, and provenance of training data. Mislabeling is a data integrity problem that propagates into model behavior and is hard to detect post-training.

Answer

Setting a high learning rate.

Answer

Using Python instead of R.

Answer

Using a GPU that is two generations old.

Question 7

When setting up an AI risk monitoring dashboard, what is the most important consideration for ensuring executive buy-in?

Accepted Answer

Map AI performance metrics to business impact indicators like customer churn or operational downtime.. Executive buy-in depends on demonstrating business value, not technical detail. Mapping AI performance metrics to business impact indicators such as customer churn, revenue, or operational downtime translates model behavior into outcomes executives already care about and are measured on. This makes the dashboard a decision-support tool rather than an engineering report.

Answer

Include the number of GPU hours utilized.

Answer

Display the raw training error rates.

Answer

Show a comparison of the organization's AI progress against competitors.

Question 8

When an AI model fails in production, what is the 'Post-Mortem' goal?

Accepted Answer

To identify root causes and update risk management practices. A post-mortem's goal is to identify root causes of the failure and feed those lessons back into risk management practices, controls, and monitoring. It is a blameless, learning-oriented exercise that improves future resilience rather than assigning fault. This aligns with AAIR's emphasis on continuous improvement of the AI risk management lifecycle.

Answer

To hide the failure from management

Answer

To fire the developer responsible

Answer

To delete all logs associated with the model

Question 9

Why is it critical to have 'Human-in-the-Loop' (HITL) for high-risk AI decisions?

Accepted Answer

To provide accountability and a safeguard against errors. Human-in-the-Loop (HITL) ensures that a qualified human reviews and can override high-risk AI decisions, providing both accountability (a responsible person is answerable for the outcome) and a safeguard against model errors, bias, or edge cases the model was not trained for. This is essential for high-stakes domains like healthcare, finance, and criminal justice.

Answer

To make the computer faster

Answer

To replace the need for model testing

Answer

To save money on hardware

Question 10

When establishing KPIs for an AI program, what is the risk of focusing solely on 'Model Accuracy'?

Accepted Answer

Other critical risks such as bias, security, and fairness may be overlooked.. Focusing solely on model accuracy creates a narrow optimization target that ignores other critical AI risks such as bias, fairness, security, privacy, and robustness. Accuracy alone does not guarantee that a model is ethical, compliant, or safe in production, so other risk dimensions can be neglected.

Answer

The model will be too computationally expensive.

Answer

The data scientists will take too long to develop the model.

Answer

The model will not be deployable in production.

Question 11

In the context of the 'AI Lifecycle', what is the risk of 'Model Decay'?

Accepted Answer

The model's predictions become less accurate because the underlying environment or user behavior changes.. Model decay (also called model drift or concept drift) is the degradation of a model's predictive accuracy over time because the real-world environment, data distributions, or user behavior change after training. The model itself is unchanged, but its assumptions no longer match reality. This is why ongoing monitoring and retraining are essential in the AI lifecycle.

Answer

The model physically degrades over time.

Answer

The model's code becomes deprecated due to language updates.

Answer

The training hardware becomes too slow to run.

Question 12

Which team is usually responsible for the 'Technical Implementation' of risk controls in an AI model?

Accepted Answer

Data Science/Machine Learning Team. The Data Science/Machine Learning Team is responsible for the technical implementation of risk controls in an AI model because they build, train, and deploy the model. They implement controls such as bias mitigation, model monitoring, access controls, and performance safeguards directly in the code and pipeline. Other teams provide oversight, policy, or compliance guidance but do not typically implement technical controls.

Answer

Internal Audit

Answer

Human Resources

Answer

Legal Department

Question 13

An organization discovers that their AI model exhibits bias toward a specific demographic. What is the most important step in the Incident Response process?

Accepted Answer

Suspend the model's production use until the issue is investigated and remediated.. When an AI model is found to exhibit harmful bias, the immediate priority in incident response is containment — suspending production use prevents ongoing discriminatory decisions, legal exposure, and harm to affected individuals while the root cause is investigated. This mirrors the 'containment before eradication' principle in standard IR frameworks (NIST SP 800-61). Retraining or deleting data without first stopping the model leaves the biased system live and compounding harm.

Answer

Retrain the model immediately.

Answer

Delete all training data related to the demographic.

Answer

Issue a public press release.

Question 14

Which THREE factors should be evaluated when reviewing an AI model for 'Fairness'?

Accepted Answer

Performance disparity across different demographic cohorts.. Option A is correct because fairness review requires measuring performance disparity across different demographic cohorts — comparing metrics such as accuracy, precision, recall, or false positive/negative rates between protected groups reveals disparate impact. Option C is correct because fairness cannot be assessed without defined metrics for success that explicitly account for equity, such as equalized odds, demographic parity, or equal opportunity, which operationalize what 'fair' means for the use case. Option D is correct because training data representation across protected groups directly affects model behavior; underrepresentation or historical bias in the data propagates into biased predictions, so representation must be audited. Option B is not relevant because server uptime is an infrastructure/availability metric unrelated to model fairness. Option E is not relevant because model file size in kilobytes is a storage or deployment concern, not a fairness indicator.

Answer

The number of hours the server was powered on.

Answer

The model's file size in kilobytes.

Question 15

A financial firm is integrating AI risk into its ERM. The Chief Risk Officer asks for a mapping between the NIST AI Risk Management Framework (RMF) and the existing COSO ERM framework. Which action most effectively facilitates this alignment?

Accepted Answer

Map NIST AI RMF 'Govern' and 'Map' functions to COSO 'Governance and Culture' components.. Mapping the NIST AI RMF 'Govern' and 'Map' functions to COSO's 'Governance and Culture' component is the most effective alignment action because both address oversight, accountability, and risk context. COSO ERM's Governance and Culture component parallels the AI RMF's emphasis on governance structures and risk mapping, enabling the firm to integrate AI risk into existing ERM processes without replacing them. This mapping preserves the firm's investment in COSO while satisfying NIST AI RMF expectations.

Answer

Replace the COSO risk taxonomy with the NIST AI RMF taxonomy entirely.

Answer

Automate all AI model monitoring using only the NIST RMF 'Measure' function.

Answer

Assign AI model owners to report directly to the NIST oversight board.

Question 16

You are managing a model that utilizes 'Online Learning'. What is the most critical risk requiring constant lifecycle vigilance?

Accepted Answer

Adversarial data poisoning and instability.. Online learning continuously updates model parameters from streaming data, which means the model's training distribution is directly influenced by whatever data arrives in production. This creates a critical, ongoing risk of adversarial data poisoning — attackers can inject malicious samples into the live stream to corrupt the model — as well as instability from feedback loops and non-stationary data. Constant lifecycle vigilance is required because the model can degrade or be subverted between reviews.

Answer

Hardware failure in the training cluster.

Answer

Data drift from batch updates.

Answer

Memory exhaustion due to high throughput.

Question 17

What is the primary risk of 'Model Complexity' in the context of the AI lifecycle?

Accepted Answer

It becomes increasingly difficult to interpret decisions and perform root cause analysis during incidents.. As model complexity increases (deep neural networks, ensembles, large transformers), the internal decision logic becomes opaque, making it hard to explain why a specific output occurred. This directly impairs root cause analysis during incidents, because teams cannot trace which features or interactions drove a bad prediction. It also complicates bias detection and regulatory compliance.

Answer

The model is too fast for the hardware.

Answer

The model will always produce the same result.

Answer

It forces the team to use more expensive software licenses.

Question 18

What is the primary role of the AI 'Data Steward' within the AI Governance framework?

Accepted Answer

To oversee the lifecycle of the data, ensuring its quality and compliance.. The AI Data Steward owns the data lifecycle within the AI governance framework — ensuring datasets are accurate, complete, appropriately sourced, and compliant with privacy and licensing requirements throughout collection, use, retention, and disposal. This role is the data-side counterpart to model governance, ensuring that what feeds the model is trustworthy and lawful. Budget, architecture, and marketing responsibilities belong to entirely different roles.

Answer

To manage the budget for AI hardware.

Answer

To build the model architecture.

Answer

To handle marketing and customer relations.

Question 19

Which of the following is an example of an 'AI Risk' in a customer-facing service?

Accepted Answer

A chatbot providing inaccurate information to a customer.. An AI risk in a customer-facing service is a harm or failure arising from the AI system's behavior — a chatbot providing inaccurate information is a classic example of hallucination/misinformation risk, which can mislead customers, cause financial or reputational harm, and create liability. It is directly attributable to the AI model's output quality and is a recognized risk category in AI governance frameworks.

Answer

The CEO deciding to change the corporate strategy.

Answer

The office printer running out of ink.

Answer

A scheduled maintenance window for the website.

Question 20

Which THREE types of 'Bias' need to be managed in an AI project?

Accepted Answer

Measurement bias (data collection). Measurement bias (A) must be managed because it arises during data collection when the instruments, sensors, or labeling procedures systematically distort the values recorded, so the training data does not faithfully represent the real-world phenomenon. Sampling bias (D) must be managed because it occurs during data selection when the dataset is drawn from a non-representative subset of the population, causing the model to learn patterns that do not generalize to the intended deployment context. Algorithmic bias (E) must be managed because it emerges from the model's logic, objective function, or optimization process, which can amplify or encode unfair correlations even when the input data is otherwise sound. The remaining options do not belong: the bias towards free coffee (B) is a humorous personal preference with no bearing on AI data or model behavior, and the bias of the local weather (C) is an environmental condition rather than a systematic distortion in an AI pipeline.

Answer

The bias towards free coffee

Answer

The bias of the local weather