AAIR Practice Test 5 — 10 Questions

Question 1

What is the first step in performing an AI Risk Assessment?

Accepted Answer

Defining the scope, context, and purpose of the AI system.. Per ISO 31000 and NIST AI RMF, every risk assessment begins with establishing scope, context, and purpose — defining which AI system is being assessed, its boundaries, stakeholders, operating environment, and the objectives of the assessment. Without this foundational step, subsequent activities like bias testing or control selection lack a reference frame and may address the wrong risks or miss critical ones. This mirrors ISO 31000 Clause 6.3.1, which explicitly places 'defining scope and context' as the first activity in the risk assessment process.

Answer

Hiring a security consultant.

Answer

Updating the company website.

Answer

Running a bias test.

Question 2

Which role is primarily responsible for ensuring that AI-generated content adheres to intellectual property risk policies?

Accepted Answer

Chief Legal Officer. The Chief Legal Officer is primarily responsible for ensuring that AI-generated content adheres to intellectual property risk policies, as they oversee legal compliance and IP strategy. This role ensures that AI outputs do not infringe on copyrights, trademarks, or other IP rights. Other roles lack the legal expertise and authority.

Answer

System Administrator

Answer

Product Manager

Answer

Data Engineer

Question 3

A board of directors requests a dashboard to monitor AI risk exposure. Which metric provides the most effective board-level oversight regarding AI regulatory compliance?

Accepted Answer

Percentage of critical AI systems that have undergone a formal regulatory compliance impact assessment.. The board's primary concern is regulatory compliance and risk exposure, not operational performance. The percentage of critical AI systems that have undergone a formal regulatory compliance impact assessment directly measures the organization's adherence to frameworks like the EU AI Act, NIST AI RMF, or ISO/IEC 42001. This metric provides assurance that high-risk AI systems are being evaluated against legal and ethical requirements, which is a core board-level oversight responsibility.

Answer

Mean Time to Detect (MTTD) for model adversarial attacks.

Answer

Current GPU utilization rates for production inference clusters.

Answer

Average latency of API requests for generative AI models.

Question 4

You are mapping existing ISO 31000 risk management processes to an AI-specific application. Which step is most crucial to ensure 'Risk Treatment' is appropriately scaled for AI?

Accepted Answer

Implementing a tiered control framework where mitigations scale based on the system's impact assessment.. A tiered control framework is the correct answer because ISO 31000's Risk Treatment step requires selecting controls proportionate to the assessed risk level. For AI, this means mitigations (e.g., human-in-the-loop review, explainability requirements, monitoring intensity) must scale with the system's impact classification — a low-risk internal chatbot needs lighter controls than a high-risk hiring or medical diagnostic model. This impact-based tiering directly operationalizes ISO 31000's principle that treatment options be evaluated against risk criteria and organizational context.

Answer

Automating all risk logging in the SIEM.

Answer

Discontinuing the use of third-party AI APIs to avoid vendor risk.

Answer

Standardizing all AI models under one security policy regardless of function.

Question 5

When an AI model is updated (e.g., retrained on new data), what action is required from an AI Risk Governance perspective?

Accepted Answer

The model should be re-validated to ensure it still meets risk thresholds.. Retraining a model on new data changes its behavior, so from a risk governance perspective it must be re-validated against the same risk thresholds (accuracy, fairness, robustness, compliance) before being trusted in production. Renaming or assuming no action is needed ignores the fact that the model's outputs and risk profile may have changed. Automatic deployment without review bypasses required oversight.

Answer

The model should be renamed to show it is a new version.

Answer

No action is needed as the underlying architecture is unchanged.

Answer

The model should be automatically deployed without review.

Question 6

Which of the following is an example of 'Data Quality Risk' in the AI lifecycle?

Accepted Answer

High rates of mislabeled training data.. High rates of mislabeled training data are a classic Data Quality Risk because labels directly determine what the model learns; systematic mislabeling introduces bias and degrades accuracy. Data quality risks encompass issues with accuracy, completeness, consistency, and provenance of training data. Mislabeling is a data integrity problem that propagates into model behavior and is hard to detect post-training.

Answer

Setting a high learning rate.

Answer

Using Python instead of R.

Answer

Using a GPU that is two generations old.

Question 7

When setting up an AI risk monitoring dashboard, what is the most important consideration for ensuring executive buy-in?

Accepted Answer

Map AI performance metrics to business impact indicators like customer churn or operational downtime.. Executive buy-in depends on demonstrating business value, not technical detail. Mapping AI performance metrics to business impact indicators such as customer churn, revenue, or operational downtime translates model behavior into outcomes executives already care about and are measured on. This makes the dashboard a decision-support tool rather than an engineering report.

Answer

Include the number of GPU hours utilized.

Answer

Display the raw training error rates.

Answer

Show a comparison of the organization's AI progress against competitors.

Question 8

When an AI model fails in production, what is the 'Post-Mortem' goal?

Accepted Answer

To identify root causes and update risk management practices. A post-mortem's goal is to identify root causes of the failure and feed those lessons back into risk management practices, controls, and monitoring. It is a blameless, learning-oriented exercise that improves future resilience rather than assigning fault. This aligns with AAIR's emphasis on continuous improvement of the AI risk management lifecycle.

Answer

To hide the failure from management

Answer

To fire the developer responsible

Answer

To delete all logs associated with the model

Question 9

Why is it critical to have 'Human-in-the-Loop' (HITL) for high-risk AI decisions?

Accepted Answer

To provide accountability and a safeguard against errors. Human-in-the-Loop (HITL) ensures that a qualified human reviews and can override high-risk AI decisions, providing both accountability (a responsible person is answerable for the outcome) and a safeguard against model errors, bias, or edge cases the model was not trained for. This is essential for high-stakes domains like healthcare, finance, and criminal justice.

Answer

To make the computer faster

Answer

To replace the need for model testing

Answer

To save money on hardware

Question 10

When establishing KPIs for an AI program, what is the risk of focusing solely on 'Model Accuracy'?

Accepted Answer

Other critical risks such as bias, security, and fairness may be overlooked.. Focusing solely on model accuracy creates a narrow optimization target that ignores other critical AI risks such as bias, fairness, security, privacy, and robustness. Accuracy alone does not guarantee that a model is ethical, compliant, or safe in production, so other risk dimensions can be neglected.

Answer

The model will be too computationally expensive.

Answer

The data scientists will take too long to develop the model.

Answer

The model will not be deployable in production.