AAIR Practice Test 5 — 25 Questions

Question 1

In an AI risk program, how should 'Residual Risk' be treated?

Accepted Answer

It must be formally documented and periodically reviewed against risk appetite. Residual risk is the risk that remains after controls are applied; it must be periodically reviewed against the established appetite.

Answer

It should be ignored if below a specific performance threshold

Answer

It should always be zero for production systems

Answer

It should be formally accepted by the risk owner if it exceeds appetite

Question 2

A project lead argues that AI model performance metrics alone are sufficient for risk management. Why is this incorrect?

Accepted Answer

They do not capture social and compliance risk dimensions. Performance metrics do not account for external risks such as legal exposure, compliance violations, or social impact.

Answer

They change too quickly to report

Answer

They are too difficult to calculate for small models

Answer

They are too subjective

Question 3

Which THREE metrics should be tracked to assess the 'Risk' of an AI model in production?

Accepted Answer

Model accuracy/error rate. Risk is measured by performance stability (drift), accuracy, and operational health.

Answer

The brand of the coffee machine

Answer

The number of employees in the break room

Question 4

Which TWO actions are required to manage 'Third-Party' AI risks?

Accepted Answer

Performing due diligence on the vendor's AI risk practices. Management requires due diligence and contractual oversight.

Answer

Ignoring the vendor's feedback

Answer

Allowing the vendor to set their own rules

Answer

Asking the vendor for their cafeteria menu

Question 5

What is the primary purpose of an 'AI Risk Dashboard' for executive leadership?

Accepted Answer

To provide high-level visibility into AI risk posture and trends. Dashboards allow leadership to see aggregated risk trends across the enterprise, not just individual project metrics.

Answer

To replace the need for an AI ethics committee

Answer

To provide raw model logs to the public

Answer

To monitor individual developer productivity

Question 6

In a cross-functional AI governance meeting, the Data Science team wants to deploy a new model, but the Legal team is concerned about data privacy. How should the AI Risk Manager resolve this?

Accepted Answer

Conduct a joint risk assessment to identify potential mitigations. The manager should facilitate a risk assessment to quantify the concern and identify potential technical controls to mitigate the privacy risk.

Answer

Order the Data Science team to stop work immediately

Answer

Ask the CEO to decide

Answer

Ignore the Legal team's concerns

Question 7

You are establishing an AI risk appetite framework using the NIST AI RMF. Which action best ensures alignment between AI innovation velocity and organizational risk tolerance?

Accepted Answer

Define risk tolerance levels based on potential impact to human rights and safety, differentiated by model deployment context.. Aligning risk appetite requires mapping technical AI performance metrics to business-level risk registers, ensuring that performance trade-offs are explicitly approved by stakeholders.

Answer

Set a static threshold for model accuracy at 95% across all AI projects.

Answer

Require all AI teams to use exclusively open-source models to mitigate vendor-related risks.

Answer

Delegate all AI risk acceptance decisions to the lead data scientist.

Question 8

Which of the following is a key component of 'AI Risk Governance'?

Accepted Answer

The definition of roles and responsibilities. Clear roles and responsibilities are essential for accountability, which is a core component of governance.

Answer

The choice of programming language

Answer

The vendor of the cloud hosting platform

Answer

The speed of model deployment

Question 9

When integrating AI risk into the broader ERM (Enterprise Risk Management) framework, which approach is most effective?

Accepted Answer

Map AI risks to existing risk categories (e.g., operational, compliance). AI risks should not be siloed; they should be categorized alongside existing operational and reputational risks to ensure they are visible to the Board.

Answer

Only report AI risks if they result in a financial loss

Answer

Keep AI risks in a separate, isolated tracking system

Answer

Automate the removal of AI risks from the main risk register

Question 10

What is the primary reason for maintaining an 'AI Model Inventory'?

Accepted Answer

To identify and mitigate shadow AI risks. An inventory ensures that no 'shadow AI' exists, allowing for comprehensive risk assessment and oversight.

Answer

To share model code with competitors

Answer

To make the database easier to back up

Answer

To increase the size of the IT department

Question 11

Which action should be taken if a model's performance consistently falls outside the 'Risk Appetite' threshold?

Accepted Answer

Take the model offline for remediation. Once a threshold is breached, the model should be taken offline or placed under remediation until it is back within acceptable risk parameters.

Answer

Only inform the IT team

Answer

Ignore the result as it is just a statistical outlier

Answer

Increase the threshold to match current performance

Question 12

Which of the following is a classic example of 'AI Hallucination' that needs monitoring?

Accepted Answer

The system generates confident but factually incorrect information. Hallucinations are incorrect or nonsensical outputs that can pose reputational risks to an organization.

Answer

The system is running slowly

Answer

The system requires too much electricity

Answer

The system password has expired

Question 13

Which stage of the AI lifecycle should risk management activities begin?

Accepted Answer

During the design and requirements phase. Risk management must be integrated at the beginning (Design/Requirement) to avoid costly redesigns later.

Answer

When the budget is exhausted

Answer

After the model is fully deployed

Answer

Only when a bug is reported

Question 14

When drafting a vendor management policy for AI, what is the most important clause to include?

Accepted Answer

Right-to-audit the vendor's AI training practices. Right-to-audit clauses ensure that the organization can verify the vendor's AI risk controls, which is essential for third-party risk management.

Answer

Requirement for vendor to provide coffee

Answer

Requirement to use a specific font

Answer

Vendor must provide free hardware

Question 15

Which TWO factors should be included in an AI risk appetite statement?

Accepted Answer

Financial thresholds for model-related incidents. Risk appetite must be specific to the impact and the tolerance levels for failure.

Answer

The intended impact on company revenue

Answer

The specific programming language allowed

Answer

The preferred office software

Question 16

Which TWO tasks are part of the 'AI Risk Assessment' process?

Accepted Answer

Evaluating the likelihood and impact of identified risks. Risk assessment involves identifying risks and then evaluating them based on impact/likelihood.

Answer

Choosing the font color for the dashboard

Answer

Writing marketing copy for the AI product

Answer

Hiring new office staff

Question 17

Which TWO items are considered 'AI Infrastructure' risks?

Accepted Answer

Unauthorized access to the model environment. Infrastructure risks focus on availability and security of the compute environment.

Answer

The color of the server room walls

Answer

The type of desk chair in the office

Answer

The number of windows in the office

Question 18

Which THREE types of 'Bias' need to be managed in an AI project?

Accepted Answer

Measurement bias (data collection). Common forms of AI bias include sampling, measurement, and algorithmic bias.

Answer

The bias towards free coffee

Answer

The bias of the local weather

Question 19

Which team is usually responsible for the 'Technical Implementation' of risk controls in an AI model?

Accepted Answer

Data Science/Machine Learning Team. Data Science and Machine Learning Engineers are responsible for embedding the risk controls (e.g., constraints, filters) into the models themselves.

Answer

Internal Audit

Answer

Human Resources

Answer

Legal Department

Question 20

If an AI model relies on an open-source library that is found to have a security vulnerability, who is responsible for managing this risk?

Accepted Answer

The AI Risk Manager and Security team. The AI Risk Manager, working with the security team, must assess the risk and ensure the library is updated or the dependency is mitigated.

Answer

The government regulators

Answer

The library's author

Answer

The public at large