AAIR Practice Test 2 — 30 Questions

Question 1

Which document should a practitioner review to determine the organization's threshold for acceptable AI model bias?

Accepted Answer

The Enterprise Risk Appetite Statement.. The Risk Appetite Statement is the formal document approved by the board or senior management that defines the level of risk the organization is willing to accept in pursuit of objectives, including AI-specific tolerances.

Answer

The vendor's Service Level Agreement (SLA).

Answer

The software's End User License Agreement (EULA).

Answer

The AI development team's sprint backlog.

Question 2

Which THREE risks are associated with 'Automated Deployment' of AI models without a human-in-the-loop?

Accepted Answer

Rapid propagation of faulty or biased models to production.. Without human checks, bad models can propagate quickly, causing cascading failures and security gaps.

Answer

The deployment takes too long to run.

Answer

Increased use of disk space.

Question 3

A company is deploying an AI system that interacts with human users. According to the AI RMF, what should be the focus of the 'Map' function in the risk governance process?

Accepted Answer

Identifying stakeholders, intended use, and potential human impacts.. Mapping involves understanding the context, intended use, and the human-AI interaction points to identify potential harms.

Answer

Choosing the most efficient algorithm.

Answer

Selecting the cloud service provider.

Answer

Calculating the total budget for the project.

Question 4

A board of directors requests a dashboard view of AI model drift. Which metric is most appropriate for a board-level risk report?

Accepted Answer

Feature drift threshold violations. The board requires high-level risk indicators rather than granular performance metrics like F1 scores.

Answer

Mean Squared Error (MSE)

Answer

GPU utilization percentage

Answer

Latency per inference request

Question 5

Which document is the primary reference for defining an organization's AI Risk Governance structure?

Accepted Answer

The AI Governance Charter/Policy.. The AI Governance Policy or Charter establishes the roles, responsibilities, and decision-making authorities for AI risk.

Answer

The IT hardware inventory report.

Answer

The employee handbook.

Answer

The AI project development backlog.

Question 6

Which TWO of the following are considered 'High-Risk' AI use cases that require enhanced oversight by the Governance Committee?

Accepted Answer

AI-powered biometric identification for facility access.. AI systems impacting physical safety or fundamental rights require the highest level of governance oversight.

Answer

Basic spell-checking software.

Answer

Email auto-complete features.

Answer

AI systems used for internal cafeteria menu suggestions.

Question 7

Which of the following is an example of 'Data Quality Risk' in the AI lifecycle?

Accepted Answer

High rates of mislabeled training data.. Data quality risk includes issues like missing values, noisy data, or incorrect labeling that degrade model performance.

Answer

Setting a high learning rate.

Answer

Using Python instead of R.

Answer

Using a GPU that is two generations old.

Question 8

In the context of the 'AI Lifecycle', what is the risk of 'Model Decay'?

Accepted Answer

The model's predictions become less accurate because the underlying environment or user behavior changes.. Model decay (or obsolescence) occurs when the environment changes such that the model's learned patterns are no longer valid.

Answer

The model physically degrades over time.

Answer

The model's code becomes deprecated due to language updates.

Answer

The training hardware becomes too slow to run.

Question 9

You are auditing a model's lifecycle and discover that the training data distribution changes every time the model retrains. What is the biggest risk here?

Accepted Answer

The model's behavior will be inconsistent and difficult to reproduce, making debugging impossible.. Non-deterministic training data results in unstable models where performance can fluctuate unpredictably.

Answer

The model will require more compute power.

Answer

The model will be too secure.

Answer

The model will be too small.

Question 10

Which THREE artifacts should be reviewed during a post-incident AI risk analysis?

Accepted Answer

The original Model Card and documentation.. Model lineage, inference logs, and the original model card are critical for understanding *what* happened.

Answer

The employee training certificates.

Answer

The building access logs for the data center.

Question 11

A team notices that an AI model's performance decreases when the input data contains abbreviations that were not present in the training set. This is a risk associated with which lifecycle stage?

Accepted Answer

Data preprocessing and training design.. This is a Data Quality/Data Representation risk, where the model's understanding of data is limited by the training corpus.

Answer

Infrastructure provisioning.

Answer

Monitoring phase.

Answer

Deployment phase.

Question 12

To mitigate 'Training-Serving Skew' in the AI lifecycle, what is the best practice for data processing pipelines?

Accepted Answer

Use a feature store to ensure consistent feature engineering logic for both stages.. Using a unified feature store ensures that the exact same transformation logic is used for both training and inference.

Answer

Write separate code for training and inference to optimize for speed.

Answer

Use only raw data for both training and inference.

Answer

Train the model on the production server directly.

Question 13

Which TWO of the following techniques help mitigate bias in the AI lifecycle?

Accepted Answer

Conducting fairness audits using specialized metrics (e.g., Disparate Impact).. Diverse data sourcing and fairness evaluation are standard methods for bias mitigation.

Answer

Switching the programming language to Java.

Answer

Reducing the frequency of model monitoring.

Answer

Increasing the number of features in the model.

Question 14

When integrating AI risk into existing ERM, which THREE aspects of an AI model lifecycle must be audited to ensure compliance?

Accepted Answer

Model validation results. Data lineage, model validation results, and incident response logs are critical audit points for enterprise risk accountability.

Answer

Personnel physical security badges

Answer

Office climate control settings

Question 15

In the context of AI model risk management, what is the role of an 'AI Model Inventory' within the governance framework?

Accepted Answer

To track model metadata, risk ratings, and owners for oversight and audit purposes.. An inventory is the foundational requirement for knowing what models exist, their criticality, and their risk profile.

Answer

To store the actual training data sets for backup.

Answer

To limit the number of AI developers in the company.

Answer

To serve as a marketing catalog for external clients.

Question 16

Which THREE components must be included in an AI Risk Register to satisfy ISO/IEC 42001 requirements?

Accepted Answer

Identification of relevant stakeholders. ISO 42001 requires systematic risk identification, analysis, and treatment planning.

Answer

Hardware procurement schedules

Answer

Technical documentation of model architecture

Question 17

During a board-level review, a bank needs to demonstrate the effectiveness of its AI Risk Governance. Which metric should be presented to the board to align with the 'Accountability' principle of the AI RMF?

Accepted Answer

The percentage of AI models with documented, independent model risk management (MRM) validation.. Board oversight requires metrics on accountability, such as the auditability of model decision-making trails.

Answer

The total computational cost of running the models.

Answer

The number of lines of code written for the AI model.

Answer

The frequency of model retraining cycles.

Question 18

In the context of the AI RMF, what is the significance of the 'Measure' function for risk management?

Accepted Answer

To evaluate the model's performance and risk outcomes against established benchmarks.. The 'Measure' function uses quantitative and qualitative assessments to test whether the model is meeting its goals and risk requirements.

Answer

To identify which employees have access to the AI system.

Answer

To set the budget for future AI projects.

Answer

To provide a score for the developers' performance.

Question 19

Which TWO teams should define the 'Risk Appetite' for a new AI project?

Accepted Answer

Senior Leadership/Business Owners. Risk appetite is a strategic decision involving both business leaders (who own the risk) and risk managers (who define the framework).

Answer

The local weather station

Answer

The office landscaping team

Answer

The company's mascot

Question 20

Which TWO factors are essential when documenting a model for risk management?

Accepted Answer

The model's intended use cases and operational boundaries.. Intended use and performance boundaries are essential for governance.

Answer

The specific brand of coffee used by the developers.

Answer

The specific team member's personal hobbies.

Answer

The names of all users who access the model.