AAIR Practice Test 4 — 10 Questions

Question 1

Why is 'AI Literacy' for the board of directors a key component of AI Governance?

Accepted Answer

To enable effective decision-making regarding AI adoption and risk management.. Directors must understand AI risks and benefits to provide informed oversight and define the organization's risk appetite.

Answer

To allow directors to code their own AI models.

Answer

To replace the need for the Chief Risk Officer.

Answer

To reduce the cost of IT infrastructure.

Question 2

The AI Risk Governance Committee is defining the risk appetite for a new generative AI chatbot. Which THREE factors must be considered to align with organizational risk tolerance?

Accepted Answer

Data privacy and residency requirements for training sets. Option B is correct because data privacy and residency requirements directly shape risk appetite: regulations like GDPR, HIPAA, or data-localization laws determine what training data may be used and where it can be stored, which bounds the acceptable risk for the chatbot. Option C is correct because model drift is a core AI risk factor — as data distributions shift, output accuracy degrades, so the committee must weigh the likelihood of drift against the organization's tolerance for degraded performance. Option D is correct because hallucination is a generative-AI-specific risk whose potential impact on brand reputation and customer trust must be assessed against the organization's risk tolerance. Option A is not a risk-appetite factor; sprint cadence is a delivery-process metric, not a measure of AI risk exposure. Option E is also not a risk-tolerance factor; GPU infrastructure cost is a budgeting concern, not a determinant of acceptable risk.

Answer

The speed of the development team's sprint cycles

Answer

The total cost of GPU infrastructure

Question 3

When defining KPIs for an AI Governance program, which metric is most predictive of long-term model robustness?

Accepted Answer

The frequency of model retraining triggered by performance drift alerts.. The frequency of model retraining triggered by performance drift alerts is the most predictive metric of long-term robustness because it reflects the organization's ability to detect degradation and respond with corrective action. A governance program that tracks this metric demonstrates closed-loop monitoring and remediation, which sustains model performance over time as data distributions shift. This aligns with MLOps best practices for drift detection and continuous improvement.

Answer

Number of users accessing the AI interface.

Answer

Total number of AI models currently in production.

Answer

The budget spent on GPU cloud computing resources.

Question 4

A company is integrating an AI model that uses 'Online Inference'. What is the most significant risk regarding model security?

Accepted Answer

The risk of model inversion attacks on the inference endpoint.. Online inference endpoints are exposed to the public/network, creating surface area for adversarial attacks.

Answer

The risk of the training data being corrupted by the user.

Answer

The risk of high database storage costs.

Answer

The risk of the Python interpreter crashing.

Question 5

A practitioner is managing AI risk in a CI/CD pipeline. What should be the final gate before model promotion to production?

Accepted Answer

Automated performance validation against a hold-out test set with defined threshold gates.. Automated validation of performance metrics against a 'golden dataset' ensures the model meets the required threshold.

Answer

Increasing the memory of the production server.

Answer

Updating the project's documentation.

Answer

A peer review of the training code.

Question 6

In the context of the AI RMF, what is the significance of the 'Measure' function for risk management?

Accepted Answer

To evaluate the model's performance and risk outcomes against established benchmarks.. The Measure function of the AI RMF is responsible for evaluating AI systems' performance, trustworthiness characteristics, and risk outcomes against defined benchmarks and metrics. It provides the quantitative and qualitative evidence needed to determine whether risks are within tolerance and whether the system meets its intended purpose. This function operationalizes the risk assessment by turning identified risks into measurable indicators.

Answer

To identify which employees have access to the AI system.

Answer

To set the budget for future AI projects.

Answer

To provide a score for the developers' performance.

Question 7

Which of the following is a classic example of 'AI Hallucination' that needs monitoring?

Accepted Answer

The system generates confident but factually incorrect information. AI hallucination refers to a model generating confident but factually incorrect or nonsensical information, which is a key risk that requires monitoring. This can lead to misinformation, user harm, and reputational damage. The other options describe operational or infrastructure issues, not hallucination.

Answer

The system is running slowly

Answer

The system requires too much electricity

Answer

The system password has expired

Question 8

Which TWO metrics are most appropriate for measuring the effectiveness of an AI Risk Program?

Accepted Answer

Total number of AI-related incidents reported and remediated.. Option D is correct because tracking the total number of AI-related incidents reported and remediated directly measures how well the AI Risk Program detects, responds to, and resolves real risk events, which is a core effectiveness indicator. Option E is correct because the percentage of AI models that have undergone a formal risk assessment measures the program's coverage and consistency in applying risk controls across the AI model inventory, reflecting proactive risk management maturity. Options A, B, and C are not appropriate because average data scientist salary, coffee machine count, and social media followers are unrelated to AI risk identification, assessment, mitigation, or governance outcomes and do not indicate program effectiveness.

Answer

The average salary of data scientists.

Answer

Number of coffee machines in the building.

Answer

Number of social media followers of the company.

Question 9

Which THREE strategies are effective for mitigating 'Adversarial Risk' in an AI lifecycle?

Accepted Answer

Rate limiting on API calls to prevent brute-force querying.. Option B is correct because rate limiting on API calls throttles the query volume an attacker can send, which directly counters brute-force and model-extraction attacks that rely on high-volume probing of the inference endpoint. Option D is correct because adversarial training explicitly augments the training set with perturbed examples, hardening the model's decision boundaries against evasion and adversarial-input attacks. Option E is correct because input sanitization and validation on all model endpoints rejects malformed, out-of-distribution, or injection-style payloads before they reach the model, reducing the attack surface for adversarial manipulation. Option A does not belong because adding documentation staff addresses process and knowledge management, not adversarial manipulation of the model. Option C does not belong because a more expensive cloud provider changes cost, not the security posture against adversarial inputs.

Answer

Hiring more documentation staff.

Answer

Using a more expensive cloud provider.

Question 10

When addressing 'Explainability' as an AI risk, which approach is most effective for a non-technical stakeholder?

Accepted Answer

Providing counterfactual explanations like 'If your income had been $5k higher, the loan would have been approved'.. Counterfactual explanations are the most effective for non-technical stakeholders because they describe what would need to change in the input for a different outcome, using plain language and concrete scenarios. For example, 'If your income had been $5k higher, the loan would have been approved' is immediately understandable without any mathematical background. This approach aligns with GDPR Article 22 and the right to meaningful information about automated decisions.

Answer

Presenting the feature weights of a neural network.

Answer

Explaining the gradient descent optimization process.

Answer

Showing the mathematical formula used for loss reduction.