AAIR Practice Exam 4 — 20 Questions

Question 1

You are mapping existing ISO 31000 risk management processes to an AI-specific application. Which step is most crucial to ensure 'Risk Treatment' is appropriately scaled for AI?

Accepted Answer

Implementing a tiered control framework where mitigations scale based on the system's impact assessment.. Risk treatment in AI requires context-aware decisions based on the risk profile of the specific model (e.g., impact of failure). Tiering controls based on the model's risk impact ensures that high-risk models receive more robust mitigations.

Answer

Automating all risk logging in the SIEM.

Answer

Discontinuing the use of third-party AI APIs to avoid vendor risk.

Answer

Standardizing all AI models under one security policy regardless of function.

Question 2

You are integrating AI governance into the existing Corporate Governance framework. Which THREE of the following activities are essential to ensure the Board of Directors maintains adequate oversight?

Accepted Answer

Reviewing and approving the organization's AI Risk Appetite Statement.. Board oversight of AI requires clear policies, defined accountability, and reporting mechanisms that link AI performance to the enterprise's risk and compliance goals.

Answer

Installing software patches on all GPU servers.

Answer

Conducting daily code reviews of all AI training algorithms.

Question 3

The AI Risk Governance Committee is defining the risk appetite for a new generative AI chatbot. Which THREE factors must be considered to align with organizational risk tolerance?

Accepted Answer

Data privacy and residency requirements for training sets. Risk appetite for AI depends on the domain, data sensitivity, and potential for harm.

Answer

The speed of the development team's sprint cycles

Answer

The total cost of GPU infrastructure

Question 4

What is the first step in performing an AI Risk Assessment?

Accepted Answer

Defining the scope, context, and purpose of the AI system.. The first step is identifying the AI system and defining its intended purpose (Context).

Answer

Hiring a security consultant.

Answer

Updating the company website.

Answer

Running a bias test.

Question 5

You are auditing the integration of AI risk into the Enterprise Risk Management (ERM) system. Which finding indicates a failure in the governance structure?

Accepted Answer

AI models deployed in production are missing from the centralized enterprise risk register.. A core tenet of AI governance is that risk assessments must occur before deployment. If models are deployed without being included in the ERM system, the governance process is bypassed, representing a failure in control.

Answer

The risk assessment template is 20 pages long.

Answer

The AI risk register is updated annually instead of monthly.

Answer

The AI risk committee meets quarterly rather than monthly.

Question 6

Why is 'Data Lineage' important in an AI risk management program?

Accepted Answer

It helps ensure data quality and integrity. Data lineage allows you to trace data back to its source, which is critical for identifying and mitigating bias or training data contamination.

Answer

It makes user interfaces more attractive

Answer

It improves server load times

Answer

It reduces the amount of storage needed

Question 7

When assessing the risk of AI-generated content, which factor is the most important for calculating 'Impact'?

Accepted Answer

The potential for reputational and legal consequences. The potential for reputational or legal harm (consequence) is the most critical component when assessing the impact of AI-generated content.

Answer

The speed at which the content is generated

Answer

The color of the font used for the output

Answer

The number of GPUs used to create the content

Question 8

Which THREE areas should be covered in an AI risk management program?

Accepted Answer

Model performance and accuracy. Comprehensive AI programs address technical, legal, and operational risks.

Answer

The office floor plan

Answer

The color of the company logo

Question 9

A cross-functional committee is evaluating the deployment of a high-impact AI model. Which TWO factors are critical to include in the initial AI risk assessment to ensure comprehensive coverage?

Accepted Answer

The socio-technical implications and potential impact on protected groups.. Data lineage and socio-technical impact are critical for high-impact AI assessments.

Answer

The frequency of software patching for the underlying cloud infrastructure.

Answer

The name of the vendor providing the cloud compute resources.

Answer

The specific programming language used for the model development.

Question 10

You are defining KPIs for an AI project in a regulated industry. Which metric best captures model reliability over time?

Accepted Answer

Model drift (data drift/concept drift). Drift metrics indicate whether the model's accuracy is degrading, which is a proxy for reliability.

Answer

Frequency of model retraining

Answer

Number of training iterations

Answer

Total cost of compute resources

Question 11

When coordinating between Legal and Data Science teams, what is the best way to handle 'Explainability' requirements?

Accepted Answer

Require Data Science to translate technical model output into plain language documentation. Bridging technical model features (shapley values, etc.) with legal disclosure requirements requires a common documentation template.

Answer

Restrict Legal from reviewing AI model outputs

Answer

Let Legal define the technical parameters of the models

Answer

Only document model logic when a lawsuit occurs

Question 12

When designing an AI Risk Reporting dashboard for senior management, which TWO of the following should be visualized?

Accepted Answer

Status of compliance certifications for high-risk models.. Management needs to see the current risk levels and compliance status in a summarized format.

Answer

Server uptime percentages.

Answer

Raw model prediction scores for every transaction.

Answer

Employee training attendance logs.

Question 13

Which THREE items are necessary for a comprehensive 'AI Governance Policy'?

Accepted Answer

Standard Operating Procedures (SOPs) for model lifecycle management.. A policy needs to define roles, risk classification, and the lifecycle process.

Answer

A list of every single line of code in the production models.

Answer

The personal home addresses of all developers.

Question 14

An organization is evaluating 'Model Risk Management' (MRM) tools for its AI governance. What is the most critical feature to look for to ensure compliance with external regulatory requirements?

Accepted Answer

Comprehensive audit trails of model lineage, versions, and validation results.. Audit trails and model lineage are critical for meeting regulatory transparency and accountability standards.

Answer

Automatic social media integration.

Answer

The ability to run models on mobile devices.

Answer

The ability to add custom skins to the UI.

Question 15

An organization is using 'AI Model Monitoring' to track 'Concept Drift'. Why is this a risk governance issue?

Accepted Answer

It signals that the model's predictive accuracy is degrading due to changes in the data context.. Concept drift indicates that the model is no longer operating in the environment it was trained for, leading to inaccurate predictions and potential risk.

Answer

It indicates the model is running out of memory.

Answer

It is not a risk issue; it is a maintenance issue.

Answer

It shows that the model is 'thinking' too slowly.

Question 16

Which governance mechanism is most effective for ensuring that AI ethical risks are addressed during the 'Design' phase of the AI Lifecycle?

Accepted Answer

Conducting a formal 'Ethics by Design' review as part of the AI project's stage-gate approval process.. Ethical AI reviews (sometimes called 'Ethics by Design' reviews) are proactive assessments conducted during the design phase to identify potential negative societal impacts before code is written, integrating ethics into the development lifecycle.

Answer

Scanning the source code for hardcoded credentials.

Answer

multi_select

Answer

Requiring a legal sign-off on the final model deployment.

Answer

multi_select

Answer

Reviewing the production logs for anomalies.

Question 17

When setting KPIs for an AI risk program, which metric is a leading indicator of potential model bias?

Accepted Answer

Demographic parity ratio in training data samples. Monitoring training data distribution is a leading indicator, whereas output monitoring is a lagging indicator.

Answer

Average model inference latency

Answer

Percentage of customer complaints regarding AI decisions

Answer

Number of model updates per quarter

Question 18

Which of the following is an example of an 'AI Risk Metric'?

Accepted Answer

Rate of false negatives in model output. The rate of false negatives in a credit approval model is a direct measure of AI-specific operational risk.

Answer

Budget spent on office supplies

Answer

Employee headcount in AI department

Answer

Number of coffee machines in the breakroom

Question 19

What is the key purpose of the 'Govern' function in the NIST AI RMF?

Accepted Answer

To establish the organizational culture, policy, and procedures for AI risk management.. The 'Govern' function focuses on the culture, policies, and structures that foster a risk-aware AI lifecycle.

Answer

To troubleshoot hardware issues.

Answer

To define the marketing strategy for the AI products.

Answer

To code the AI algorithms.

Question 20

Which documentation is necessary to provide to auditors for an AI system?

Accepted Answer

The model card or model documentation. A model card provides the necessary metadata, performance limitations, and intended use cases required for auditability.

Answer

A list of all employees who attended a conference

Answer

The login credentials for the production environment

Answer

The complete source code without comments