AAIR Practice Test 4 — 25 Questions

Question 1

You are integrating AI governance into the existing Corporate Governance framework. Which THREE of the following activities are essential to ensure the Board of Directors maintains adequate oversight?

Accepted Answer

Reviewing and approving the organization's AI Risk Appetite Statement.. Option A is correct because the Board's core governance role includes setting and approving the organization's risk appetite, and an AI Risk Appetite Statement translates that mandate into explicit tolerance thresholds for AI-specific risks (e.g., bias, model drift, data privacy), giving the Board a formal basis for oversight. Option C is correct because designating executive-level accountability (e.g., a Chief AI Officer or an AI risk owner at the C-suite) establishes clear ownership and escalation paths, which is a fundamental governance control ensuring the Board can hold management responsible for AI risk outcomes. Option E is correct because a defined reporting cadence for significant AI-related risk incidents and model performance trends provides the Board with timely, recurring visibility into AI risk posture, enabling informed oversight and intervention consistent with corporate governance principles. Options B and D are not Board-level governance activities: patching GPU servers is an operational IT maintenance task, and daily code reviews of training algorithms are tactical engineering controls, both of which belong to management and technical teams rather than the Board's oversight responsibilities.

Answer

Installing software patches on all GPU servers.

Answer

Conducting daily code reviews of all AI training algorithms.

Question 2

Which THREE factors contribute to 'Data Quality Risk' during the training phase?

Accepted Answer

Incomplete datasets with many missing values.. Data Quality Risk during training arises from defects in the data itself, and option A is correct because incomplete datasets with many missing values degrade the statistical representativeness of the training sample, causing the model to learn from biased or insufficient signal. Option B is correct because systematic errors in target label annotations inject consistent noise into the ground truth, so the model optimizes toward incorrect labels and produces unreliable predictions. Option D is correct because selection bias in the training set creation process means the sampled data does not reflect the real-world distribution the model will encounter, skewing learned patterns. Option C is not a data quality issue but a hardware/resource constraint (GPU memory capacity), and option E is an infrastructure/vendor choice unrelated to the intrinsic quality of the training data.

Answer

The model is too large for the GPU memory.

Answer

Using the wrong cloud vendor.

Question 3

When documenting an AI Risk Program, what should be included in the 'AI Asset Register'?

Accepted Answer

The model purpose, data lineage, stakeholders, and risk classification.. An AI Asset Register is an inventory of AI systems and models that captures governance-relevant metadata: the model's purpose, the data sources and lineage used to train it, the stakeholders accountable for it, and its risk classification. This information enables risk management, regulatory reporting, and lifecycle oversight across the AI portfolio.

Answer

The raw hardware serial numbers of the servers.

Answer

The exact lines of code in the model.

Answer

The home addresses of all developers.

Question 4

Which THREE factors should be monitored to detect 'Model Drift' in the deployment phase?

Accepted Answer

The distribution of prediction outputs.. Model drift detection in the deployment phase focuses on changes in data and model behavior over time. Option A, the distribution of prediction outputs, is correct because a shift in the distribution of predictions (e.g., a classifier suddenly predicting one class far more often) is a direct symptom of model drift, often caused by changing input data or degraded decision boundaries. Option D, the confidence score of the model predictions, is correct because declining or abnormally shifting confidence scores indicate the model is becoming less certain and less aligned with the data it was trained on, a common signal of drift. Option E, the distribution of incoming input features, is correct because monitoring feature distributions (e.g., via statistical tests like PSI or KL divergence) detects data drift, which is the primary driver of model drift in production. Option B, the temperature of the server room, is incorrect because it is a physical infrastructure concern unrelated to statistical model behavior. Option C, the current market price of GPU hardware, is incorrect because it is a procurement/cost factor with no bearing on whether a deployed model's performance is degrading.

Answer

The temperature of the server room.

Answer

The current market price of GPU hardware.

Question 5

Which THREE items should be included in an AI 'Risk Assessment' report for a new project?

Accepted Answer

Identification of potential failure modes and their impact.. A complete report covers the risk identification, the impact analysis, and the control strategy.

Answer

The favorite color of the lead developer.

Answer

A list of all competitors currently using the same software.

Question 6

What is the primary risk associated with 'Shadow AI' in an organization?

Accepted Answer

It bypasses established AI risk governance and compliance controls.. Shadow AI refers to AI tools deployed without the knowledge or oversight of the governance team, creating invisible, unmanaged risks.

Answer

It makes the network run slower.

Answer

It costs too much.

Answer

It makes the developers work too hard.

Question 7

You are auditing a model's lifecycle and discover that the training data distribution changes every time the model retrains. What is the biggest risk here?

Accepted Answer

The model's behavior will be inconsistent and difficult to reproduce, making debugging impossible.. When the training data distribution changes on every retrain, the model's learned parameters and behavior shift unpredictably, making it impossible to reproduce results, compare versions, or debug regressions. This undermines model governance, auditability, and trust. Reproducibility requires stable, versioned training data and documented preprocessing.

Answer

The model will require more compute power.

Answer

The model will be too secure.

Answer

The model will be too small.

Question 8

When integrating AI risk into existing ERM, which THREE aspects of an AI model lifecycle must be audited to ensure compliance?

Accepted Answer

Model validation results. Model validation results (C) must be audited because they document whether the AI model meets its stated performance, fairness, and robustness criteria before and after deployment, which is a core control for AI risk within ERM. Incident response logs (D) are essential because they provide evidence that AI-related failures, bias events, or security incidents were detected, escalated, and remediated according to the organization's risk response procedures. Data lineage and provenance (E) must be audited to verify that training, validation, and production data sources are authorized, traceable, and compliant with privacy and quality requirements, which directly affects model reliability and regulatory compliance. Personnel physical security badges (A) and office climate control settings (B) are facility and environmental controls unrelated to the AI model lifecycle, so they do not belong in an audit of AI risk integration into ERM.

Answer

Personnel physical security badges

Answer

Office climate control settings

Question 9

When deploying a generative AI model, what 'Governance Control' is most critical for preventing the generation of harmful/inappropriate content?

Accepted Answer

Implement output guardrails and moderation layers.. Guardrails are technical controls placed on top of models to intercept and filter output, which is a vital part of risk governance.

Answer

Increase the number of GPUs to make it faster.

Answer

Only use the model in an internal environment without internet access.

Answer

Allow users to provide feedback directly to the model.

Question 10

When designing an AI Risk Reporting dashboard for senior management, which TWO of the following should be visualized?

Accepted Answer

Status of compliance certifications for high-risk models.. Option C is correct because senior management needs visibility into the governance posture of high-risk AI models, and tracking the status of compliance certifications (e.g., ISO/IEC 42001, SOC 2, or EU AI Act conformity assessments) directly supports regulatory oversight and accountability. Option D is correct because an aggregate risk score per business unit condenses model-level risk metrics into a decision-ready KPI that lets executives compare exposure, prioritize mitigation funding, and track risk appetite across the organization. Option A is not appropriate because server uptime is an infrastructure/availability metric that belongs in IT operations dashboards, not an AI risk reporting view for executives. Option B is not appropriate because raw per-transaction prediction scores are far too granular and technical for senior management, and would create noise rather than actionable risk insight. Option E is not appropriate because employee training attendance is a tactical HR/compliance activity metric, not a strategic AI risk indicator for the board or executive committee.

Answer

Server uptime percentages.

Answer

Raw model prediction scores for every transaction.

Answer

Employee training attendance logs.

Question 11

What is the key purpose of the 'Govern' function in the NIST AI RMF?

Accepted Answer

To establish the organizational culture, policy, and procedures for AI risk management.. The Govern function in the NIST AI RMF (AI Risk Management Framework 1.0) is one of the four core functions (Govern, Map, Measure, Manage) and is explicitly cross-cutting. Its purpose is to cultivate and implement a culture of risk management via policies, processes, procedures, roles, responsibilities, and accountability structures across the AI lifecycle. It is not a technical execution function — it establishes the organizational scaffolding that enables the other three functions to operate.

Answer

To troubleshoot hardware issues.

Answer

To define the marketing strategy for the AI products.

Answer

To code the AI algorithms.

Question 12

Which of the following is an example of an 'AI Risk Metric'?

Accepted Answer

Rate of false negatives in model output. A risk metric quantifies the potential for harm or error in an AI system. The rate of false negatives directly measures how often the model misses positive cases, which is a core performance and risk indicator—especially in safety-critical applications like medical diagnosis or fraud detection. This metric helps assess the model's reliability and the risk of costly or dangerous omissions.

Answer

Budget spent on office supplies

Answer

Employee headcount in AI department

Answer

Number of coffee machines in the breakroom

Question 13

A company is scaling its AI initiatives across five business units. What is the most effective way to ensure consistent risk measurement?

Accepted Answer

Implementing a centralized AI risk taxonomy. A centralized AI risk taxonomy provides a common language, scoring scale, and category structure that all five business units can apply consistently, enabling comparable risk measurement across the enterprise. Without a shared taxonomy, each unit's risk ratings become incommensurable, defeating the purpose of enterprise-wide AI risk oversight. This aligns with AAIR guidance that risk measurement must be standardized before it can be aggregated or governed.

Answer

Using different platforms for each business unit

Answer

Allowing each business unit to define its own risk metrics

Answer

Focusing only on the highest-risk model

Question 14

Which document is essential for defining the roles and responsibilities within an AI Risk Program?

Accepted Answer

AI Governance RACI Matrix.. The AI Governance RACI Matrix is the document that explicitly defines who is Responsible, Accountable, Consulted, and Informed for AI risk activities across the organization. It is the standard governance artifact for assigning roles and responsibilities, ensuring clear ownership and avoiding gaps or overlaps in the AI Risk Program.

Answer

Data Privacy Impact Assessment (DPIA).

Answer

Model Training Log.

Answer

AI Incident Response Plan.

Question 15

Why is 'Data Lineage' important in an AI risk management program?

Accepted Answer

It helps ensure data quality and integrity. Data lineage documents the origin, movement, transformation, and usage of data throughout its lifecycle, which is foundational to AI risk management because it enables traceability of data quality issues, bias sources, and compliance violations back to their root. Without lineage, an organization cannot verify that training data was lawfully obtained, representative, or free of contamination — making it impossible to assess or remediate data-related AI risks.

Answer

It makes user interfaces more attractive

Answer

It improves server load times

Answer

It reduces the amount of storage needed

Question 16

A company is utilizing a third-party LLM service. Which risk is specifically heightened by this arrangement?

Accepted Answer

Data leakage and privacy violations. Using a third-party LLM service means prompts, context, and potentially sensitive data are transmitted to and processed by an external provider, heightening data leakage and privacy violation risk. The organization loses direct control over data handling, retention, and secondary use, and may face regulatory exposure under GDPR, HIPAA, or similar regimes. This is the risk specifically amplified by the third-party arrangement.

Answer

Server downtime

Answer

Model training cost inflation

Answer

Lack of software updates

Question 17

You are analyzing the risk of a generative AI implementation. Which metric most effectively measures 'model transparency' for a risk dashboard?

Accepted Answer

Percentage of models deployed with a completed Model Card covering data provenance, limitations, and intended use.. Model transparency is best measured by the percentage of deployed models that have a completed Model Card documenting data provenance, limitations, and intended use. Model Cards (Mitchell et al., 2019) are the industry-standard artifact for transparency, and a coverage metric directly quantifies how transparent the model portfolio is. This gives risk dashboards an actionable, auditable indicator tied to governance requirements.

Answer

The number of unique contributors to the codebase.

Answer

The average latency of model inference.

Answer

The number of parameters in the neural network.

Question 18

Which THREE components are necessary for effective cross-functional AI risk coordination?

Accepted Answer

Clearly defined RACI matrix for AI initiatives. A clearly defined RACI matrix for AI initiatives (A) is necessary because it assigns explicit Responsible, Accountable, Consulted, and Informed roles across functions, eliminating ambiguity about who owns each AI risk decision and escalation path. A standardized AI risk taxonomy (C) is required so that legal, security, data science, and business teams classify and compare risks using the same categories, severity scales, and terminology, enabling consistent cross-functional assessment. A centralized AI risk register (D) is essential as the single source of truth that aggregates identified risks, owners, mitigations, and status, giving all functions shared visibility and traceability. Weekly team lunches (B) are a social nicety that may improve rapport but are not a structural mechanism for risk coordination, and unrestricted access to all production servers for all staff (E) violates least-privilege and actually increases risk rather than enabling effective coordination.

Answer

Weekly team lunches

Answer

Unrestricted access to all production servers for all staff

Question 19

Which THREE considerations must be addressed when designing a 'Training' pipeline to minimize data quality risk?

Accepted Answer

Recording full data lineage for every training run.. Option B is correct because recording full data lineage for every training run provides traceability of the exact datasets, transformations, and versions used, which is essential for detecting and remediating data quality issues and reproducing results. Option D is correct because automated outlier detection identifies noisy, anomalous, or corrupted records before they degrade model training, directly reducing data quality risk. Option E is correct because strict schema validation catches data type errors, missing fields, and format mismatches at ingestion time, preventing malformed data from entering the training pipeline. Options A and C are not correct because a high-end monitor and a specific server hardware brand are irrelevant to data quality; they concern display and procurement preferences rather than the integrity, validity, or traceability of training data.

Answer

Ensuring the training server has a high-end monitor.

Answer

Using a specific brand of server hardware.

Question 20

Which TWO items are considered 'AI Model Artifacts' that should be kept for audit purposes?

Accepted Answer

The training dataset version. Option A, the training dataset version, is a correct AI model artifact for audit purposes because it documents the exact data lineage and inputs used to train the model, which is essential for reproducibility, bias investigation, and compliance reviews. Option C, model hyperparameters and architecture configuration, is also correct because these settings define how the model was built and trained, and auditors need them to reproduce, validate, or explain model behavior. The unmarked options do not belong: the lunch menu (B), company mascot name (D), and local weather report (E) are unrelated to model development, training, or governance and have no audit value for AI artifacts.

Answer

The lunch menu for the developers

Answer

The name of the company's favorite mascot

Answer

The local weather report from last week