AAIR Practice Test 3 — 25 Questions

Question 1

In the context of the 'AI Lifecycle', what is the risk of 'Model Decay'?

Accepted Answer

The model's predictions become less accurate because the underlying environment or user behavior changes.. Model decay (also called model drift or concept drift) is the degradation of a model's predictive accuracy over time because the real-world environment, data distributions, or user behavior change after training. The model itself is unchanged, but its assumptions no longer match reality. This is why ongoing monitoring and retraining are essential in the AI lifecycle.

Answer

The model physically degrades over time.

Answer

The model's code becomes deprecated due to language updates.

Answer

The training hardware becomes too slow to run.

Question 2

Which team is usually responsible for the 'Technical Implementation' of risk controls in an AI model?

Accepted Answer

Data Science/Machine Learning Team. The Data Science/Machine Learning Team is responsible for the technical implementation of risk controls in an AI model because they build, train, and deploy the model. They implement controls such as bias mitigation, model monitoring, access controls, and performance safeguards directly in the code and pipeline. Other teams provide oversight, policy, or compliance guidance but do not typically implement technical controls.

Answer

Internal Audit

Answer

Human Resources

Answer

Legal Department

Question 3

An organization discovers that their AI model exhibits bias toward a specific demographic. What is the most important step in the Incident Response process?

Accepted Answer

Suspend the model's production use until the issue is investigated and remediated.. When an AI model is found to exhibit harmful bias, the immediate priority in incident response is containment — suspending production use prevents ongoing discriminatory decisions, legal exposure, and harm to affected individuals while the root cause is investigated. This mirrors the 'containment before eradication' principle in standard IR frameworks (NIST SP 800-61). Retraining or deleting data without first stopping the model leaves the biased system live and compounding harm.

Answer

Retrain the model immediately.

Answer

Delete all training data related to the demographic.

Answer

Issue a public press release.

Question 4

Which THREE factors should be evaluated when reviewing an AI model for 'Fairness'?

Accepted Answer

Performance disparity across different demographic cohorts.. Option A is correct because fairness review requires measuring performance disparity across different demographic cohorts — comparing metrics such as accuracy, precision, recall, or false positive/negative rates between protected groups reveals disparate impact. Option C is correct because fairness cannot be assessed without defined metrics for success that explicitly account for equity, such as equalized odds, demographic parity, or equal opportunity, which operationalize what 'fair' means for the use case. Option D is correct because training data representation across protected groups directly affects model behavior; underrepresentation or historical bias in the data propagates into biased predictions, so representation must be audited. Option B is not relevant because server uptime is an infrastructure/availability metric unrelated to model fairness. Option E is not relevant because model file size in kilobytes is a storage or deployment concern, not a fairness indicator.

Answer

The number of hours the server was powered on.

Answer

The model's file size in kilobytes.

Question 5

A financial firm is integrating AI risk into its ERM. The Chief Risk Officer asks for a mapping between the NIST AI Risk Management Framework (RMF) and the existing COSO ERM framework. Which action most effectively facilitates this alignment?

Accepted Answer

Map NIST AI RMF 'Govern' and 'Map' functions to COSO 'Governance and Culture' components.. Mapping the NIST AI RMF 'Govern' and 'Map' functions to COSO's 'Governance and Culture' component is the most effective alignment action because both address oversight, accountability, and risk context. COSO ERM's Governance and Culture component parallels the AI RMF's emphasis on governance structures and risk mapping, enabling the firm to integrate AI risk into existing ERM processes without replacing them. This mapping preserves the firm's investment in COSO while satisfying NIST AI RMF expectations.

Answer

Replace the COSO risk taxonomy with the NIST AI RMF taxonomy entirely.

Answer

Automate all AI model monitoring using only the NIST RMF 'Measure' function.

Answer

Assign AI model owners to report directly to the NIST oversight board.

Question 6

You are managing a model that utilizes 'Online Learning'. What is the most critical risk requiring constant lifecycle vigilance?

Accepted Answer

Adversarial data poisoning and instability.. Online learning continuously updates model parameters from streaming data, which means the model's training distribution is directly influenced by whatever data arrives in production. This creates a critical, ongoing risk of adversarial data poisoning — attackers can inject malicious samples into the live stream to corrupt the model — as well as instability from feedback loops and non-stationary data. Constant lifecycle vigilance is required because the model can degrade or be subverted between reviews.

Answer

Hardware failure in the training cluster.

Answer

Data drift from batch updates.

Answer

Memory exhaustion due to high throughput.

Question 7

What is the primary risk of 'Model Complexity' in the context of the AI lifecycle?

Accepted Answer

It becomes increasingly difficult to interpret decisions and perform root cause analysis during incidents.. As model complexity increases (deep neural networks, ensembles, large transformers), the internal decision logic becomes opaque, making it hard to explain why a specific output occurred. This directly impairs root cause analysis during incidents, because teams cannot trace which features or interactions drove a bad prediction. It also complicates bias detection and regulatory compliance.

Answer

The model is too fast for the hardware.

Answer

The model will always produce the same result.

Answer

It forces the team to use more expensive software licenses.

Question 8

What is the primary role of the AI 'Data Steward' within the AI Governance framework?

Accepted Answer

To oversee the lifecycle of the data, ensuring its quality and compliance.. The AI Data Steward owns the data lifecycle within the AI governance framework — ensuring datasets are accurate, complete, appropriately sourced, and compliant with privacy and licensing requirements throughout collection, use, retention, and disposal. This role is the data-side counterpart to model governance, ensuring that what feeds the model is trustworthy and lawful. Budget, architecture, and marketing responsibilities belong to entirely different roles.

Answer

To manage the budget for AI hardware.

Answer

To build the model architecture.

Answer

To handle marketing and customer relations.

Question 9

Which of the following is an example of an 'AI Risk' in a customer-facing service?

Accepted Answer

A chatbot providing inaccurate information to a customer.. An AI risk in a customer-facing service is a harm or failure arising from the AI system's behavior — a chatbot providing inaccurate information is a classic example of hallucination/misinformation risk, which can mislead customers, cause financial or reputational harm, and create liability. It is directly attributable to the AI model's output quality and is a recognized risk category in AI governance frameworks.

Answer

The CEO deciding to change the corporate strategy.

Answer

The office printer running out of ink.

Answer

A scheduled maintenance window for the website.

Question 10

Which THREE types of 'Bias' need to be managed in an AI project?

Accepted Answer

Measurement bias (data collection). Measurement bias (A) must be managed because it arises during data collection when the instruments, sensors, or labeling procedures systematically distort the values recorded, so the training data does not faithfully represent the real-world phenomenon. Sampling bias (D) must be managed because it occurs during data selection when the dataset is drawn from a non-representative subset of the population, causing the model to learn patterns that do not generalize to the intended deployment context. Algorithmic bias (E) must be managed because it emerges from the model's logic, objective function, or optimization process, which can amplify or encode unfair correlations even when the input data is otherwise sound. The remaining options do not belong: the bias towards free coffee (B) is a humorous personal preference with no bearing on AI data or model behavior, and the bias of the local weather (C) is an environmental condition rather than a systematic distortion in an AI pipeline.

Answer

The bias towards free coffee

Answer

The bias of the local weather

Question 11

In a retail company, which AI risk is most likely to cause direct financial loss?

Accepted Answer

The pricing model provides incorrect, discounted rates. The AI risk most likely to cause direct financial loss in a retail company is a pricing model that provides incorrect, discounted rates. This directly impacts revenue and profitability, as customers may be undercharged or the company may lose sales due to pricing errors. Incorrect pricing can also lead to competitive disadvantages and customer distrust.

Answer

The model documentation is outdated

Answer

The font size in the UI is too small

Answer

The model's name is not catchy

Question 12

You are managing AI supply chain risk. Which control is most critical for third-party AI models?

Accepted Answer

Requiring a documented 'AI Bill of Materials' to understand data lineage and model provenance.. The most critical control for third-party AI models is requiring a documented 'AI Bill of Materials' (AI BOM) to understand data lineage and model provenance. This provides transparency into the components, data sources, and training methods used in the model, enabling effective risk assessment and mitigation. Without this visibility, organizations cannot verify compliance, detect biases, or manage supply chain risks.

Answer

Conducting a manual audit of the vendor's source code.

Answer

Requiring the vendor to submit a monthly performance report.

Answer

Setting a limit on the number of third-party vendors allowed.

Question 13

Which AI lifecycle stage is most susceptible to the risk of 'data leakage' where training data inadvertently contains information from the future/target?

Accepted Answer

Data preparation and training phase.. Data leakage occurs when information that should not be available at inference time (e.g., the target label, future data, or holdout data) is inadvertently included in the training set. This happens during data preparation and training, where feature engineering, joins, and train/test splits are performed. If a feature is computed using the target or future timestamps, the model learns a shortcut that inflates training metrics but fails in production.

Answer

Model monitoring phase.

Answer

Model decommission phase.

Answer

Deployment phase.

Question 14

An organization is integrating AI risk into its existing ISO 31000 framework. How should the 'Risk Assessment' process be modified to account for AI-specific 'black box' issues?

Accepted Answer

Add a model explainability and interpretability assessment step to the process.. Inclusion of model explainability assessments is necessary to address the opacity inherent in deep learning models.

Answer

Remove the risk identification step, as AI risks are too unpredictable.

Answer

Replace the qualitative assessment with a purely quantitative financial impact model.

Answer

Delegate all risk assessments to the external software vendor.

Question 15

An organization is revising its AI Governance to include 'Human-in-the-loop' (HITL) requirements. Why is this a critical risk mitigation strategy?

Accepted Answer

It ensures human oversight for critical decisions, reducing the risk of 'black box' failures.. Human-in-the-loop (HITL) is a critical risk mitigation because it places a human reviewer in the decision path for consequential AI outputs, providing a check against opaque 'black box' failures, edge cases, and harmful errors that automated controls may miss. It preserves meaningful human judgment and accountability where the cost of an AI mistake is high. It does not replace other controls or eliminate testing obligations.

Answer

It removes the requirement for model bias testing.

Answer

It is required for every AI model regardless of impact.

Answer

It eliminates the need for any other automated risk controls.

Question 16

When coordinating AI risk across a global organization, why is it critical to include local legal counsel in the AI steering committee?

Accepted Answer

To interpret the varied regulatory landscapes in different operational regions.. Local legal counsel is essential on a global AI steering committee because AI regulations vary significantly by jurisdiction — the EU AI Act, US state laws, China's algorithm rules, Brazil's LGPD, etc. — and local counsel interprets how these apply to the organization's operations in each region. This ensures the committee's risk decisions are legally grounded and regionally compliant rather than assuming a single global standard.

Answer

To audit the training datasets for copyright infringement.

Answer

To handle administrative tasks for the committee.

Answer

To approve the technical architecture of the AI models.

Question 17

Which TWO strategies are recommended for 'Mitigating' AI model bias?

Accepted Answer

Applying fairness constraints during model training. Option C is correct because applying fairness constraints during model training directly mitigates bias by incorporating fairness metrics (such as demographic parity or equalized odds) into the objective function or as regularization terms, forcing the model to reduce disparate impact across protected groups. Option E is correct because training on more diverse and representative datasets addresses bias at its source—the data—by ensuring the model learns patterns from a broader population, reducing sampling bias and underrepresentation that lead to skewed predictions. Options A, B, and D are not recommended mitigation strategies: deleting all data destroys the training set and makes learning impossible, asking users to manually fix bias shifts responsibility away from systematic model design and is not scalable or reliable, and ignoring bias allows it to persist and potentially worsen in production.

Answer

Removing all data from the database

Answer

Asking the user to manually fix the bias

Answer

Ignoring the bias and hoping it goes away

Question 18

Which THREE factors are essential to consider when determining the 'AI Risk Appetite' for an enterprise?

Accepted Answer

The organization's tolerance for legal and reputational damage.. Option B is correct because AI risk appetite must be calibrated to how much legal exposure and reputational harm the organization is willing to absorb, since these are the primary consequence categories of AI failures and directly bound the acceptable risk threshold. Option C is correct because the complexity and degree of autonomy of the deployed AI models determine the severity and likelihood of adverse outcomes, so higher autonomy or opacity requires a more conservative appetite. Option D is correct because the applicable regulatory landscape and sector-specific compliance obligations (for example, EU AI Act risk tiers, HIPAA, or financial-services rules) set non-negotiable limits that the risk appetite cannot exceed. Option A is not essential because market share is a business-performance metric that does not define risk tolerance boundaries. Option E is not essential because historical data volume is an input to model development and data-governance decisions, not a determinant of how much AI risk the enterprise is willing to accept.

Answer

The current market share of the company.

Answer

Historical data volume.

Question 19

Which TWO of the following techniques help mitigate bias in the AI lifecycle?

Accepted Answer

Conducting fairness audits using specialized metrics (e.g., Disparate Impact).. Option C is correct because conducting fairness audits with specialized metrics such as Disparate Impact (the ratio of favorable outcomes for a protected group to those of a reference group, ideally near 1.0 under the 80% rule) quantitatively detects and helps correct disparate treatment or outcomes across groups in the AI lifecycle. Option D is correct because sourcing training data from diverse, representative populations reduces sampling and representation bias, ensuring the model learns patterns that generalize fairly rather than overfitting to a dominant or historically skewed subgroup. Option A is incorrect because the programming language (e.g., Java) is irrelevant to bias; bias arises from data, objectives, and evaluation, not from the implementation language. Option B is incorrect because reducing model monitoring would hide drift and emerging bias, worsening rather than mitigating it. Option E is incorrect because simply adding more features can amplify bias through proxy variables and increase overfitting without addressing underlying data or fairness issues.

Answer

Switching the programming language to Java.

Answer

Reducing the frequency of model monitoring.

Answer

Increasing the number of features in the model.

Question 20

A company is deploying an AI system that interacts with human users. According to the AI RMF, what should be the focus of the 'Map' function in the risk governance process?

Accepted Answer

Identifying stakeholders, intended use, and potential human impacts.. In the NIST AI RMF, the Map function focuses on understanding the context of the AI system: identifying stakeholders, intended use, affected populations, and potential human impacts. It establishes the foundation for risk assessment by framing what the system does, who it affects, and what could go wrong. This contextual mapping is essential before measuring or managing risks.

Answer

Choosing the most efficient algorithm.

Answer

Selecting the cloud service provider.

Answer

Calculating the total budget for the project.