AAIR Practice Questions 2 — 50 Questions

Question 1

Which department is primarily responsible for ensuring AI models comply with data protection regulations like GDPR?

Accepted Answer

The Compliance/Legal Department and the Data Protection Officer.. The Data Protection Officer (DPO) and Legal/Compliance teams are responsible for regulatory compliance.

Answer

The Sales force.

Answer

The Accounting Department.

Answer

The Janitorial staff.

Question 2

You are integrating AI risk into the NIST Risk Management Framework (RMF). Which step requires an explicit evaluation of AI model lineage and data provenance to satisfy the 'Govern' function?

Accepted Answer

Governance mapping during 'Govern' function analysis. The NIST AI RMF 'Govern' function prioritizes understanding the provenance and lineage to establish accountability and transparency.

Answer

Step 2: Select controls

Answer

Step 1: Categorize system

Answer

Continuous Monitoring phase

Question 3

A financial firm is integrating AI risk into its ERM. The Chief Risk Officer asks for a mapping between the NIST AI Risk Management Framework (RMF) and the existing COSO ERM framework. Which action most effectively facilitates this alignment?

Accepted Answer

Map NIST AI RMF 'Govern' and 'Map' functions to COSO 'Governance and Culture' components.. Mapping functions like 'Govern' and 'Map' in NIST AI RMF directly correlate to COSO's 'Governance and Culture' and 'Strategy and Objective-Setting' components.

Answer

Replace the COSO risk taxonomy with the NIST AI RMF taxonomy entirely.

Answer

Automate all AI model monitoring using only the NIST RMF 'Measure' function.

Answer

Assign AI model owners to report directly to the NIST oversight board.

Question 4

Which THREE components must be included in an AI Model 'Control Framework' to ensure effective risk mitigation?

Accepted Answer

Access management controls restricting model usage.. Controls must cover the lifecycle, from development integrity to ongoing monitoring and access management.

Answer

Hardware power usage tracking.

Answer

Public disclosure of all model architecture details.

Question 5

Which THREE activities are part of the 'AI Risk Management' lifecycle?

Accepted Answer

Risk Treatment/Mitigation.. The cycle consists of identification, assessment/treatment, and ongoing monitoring.

Answer

Manual approval of all company emails.

Answer

Writing press releases about AI success.

Question 6

A firm adopts the 'Three Lines of Defense' model for AI. What is the specific responsibility of the 'Third Line' (Internal Audit)?

Accepted Answer

Providing independent assurance on the design and effectiveness of the AI governance framework.. The Third Line provides independent, objective assurance on the effectiveness of the risk management and governance processes.

Answer

Approving AI model deployment.

Answer

Developing the AI models.

Answer

Defining the AI risk appetite.

Question 7

Which THREE factors are essential to consider when determining the 'AI Risk Appetite' for an enterprise?

Accepted Answer

The organization's tolerance for legal and reputational damage.. Risk appetite must consider the organization's business strategy, regulatory environment, and technical capability.

Answer

The current market share of the company.

Answer

Historical data volume.

Question 8

An organization is revising its AI Governance to include 'Human-in-the-loop' (HITL) requirements. Why is this a critical risk mitigation strategy?

Accepted Answer

It ensures human oversight for critical decisions, reducing the risk of 'black box' failures.. HITL provides a necessary safety net for models that may exhibit unpredictable behavior or lack explainability.

Answer

It removes the requirement for model bias testing.

Answer

It is required for every AI model regardless of impact.

Answer

It eliminates the need for any other automated risk controls.

Question 9

What is the goal of an AI 'Model Inventory'?

Accepted Answer

To maintain visibility over all AI models and their associated risk profiles.. The inventory provides a central repository for tracking all AI assets, which is the baseline for risk management.

Answer

To automatically delete old models.

Answer

To provide marketing data to competitors.

Answer

To increase the speed of model deployment.

Question 10

What is the 'Accountability' principle in the NIST AI RMF intended to address?

Accepted Answer

Ensuring that there is clear ownership and responsibility for AI system performance and safety.. Accountability ensures that individuals or teams are responsible for the outcomes of AI systems, preventing a 'blame-free' environment for AI failures.

Answer

Ensuring the AI can explain itself.

Answer

Making sure the model is free of bugs.

Answer

Ensuring that the AI system is fast.

Question 11

You are mapping existing ISO 31000 risk management processes to an AI-specific application. Which step is most crucial to ensure 'Risk Treatment' is appropriately scaled for AI?

Accepted Answer

Implementing a tiered control framework where mitigations scale based on the system's impact assessment.. Risk treatment in AI requires context-aware decisions based on the risk profile of the specific model (e.g., impact of failure). Tiering controls based on the model's risk impact ensures that high-risk models receive more robust mitigations.

Answer

Automating all risk logging in the SIEM.

Answer

Discontinuing the use of third-party AI APIs to avoid vendor risk.

Answer

Standardizing all AI models under one security policy regardless of function.

Question 12

You are integrating AI governance into the existing Corporate Governance framework. Which THREE of the following activities are essential to ensure the Board of Directors maintains adequate oversight?

Accepted Answer

Reviewing and approving the organization's AI Risk Appetite Statement.. Board oversight of AI requires clear policies, defined accountability, and reporting mechanisms that link AI performance to the enterprise's risk and compliance goals.

Answer

Installing software patches on all GPU servers.

Answer

Conducting daily code reviews of all AI training algorithms.

Question 13

The AI Risk Governance Committee is defining the risk appetite for a new generative AI chatbot. Which THREE factors must be considered to align with organizational risk tolerance?

Accepted Answer

Data privacy and residency requirements for training sets. Risk appetite for AI depends on the domain, data sensitivity, and potential for harm.

Answer

The speed of the development team's sprint cycles

Answer

The total cost of GPU infrastructure

Question 14

What is the first step in performing an AI Risk Assessment?

Accepted Answer

Defining the scope, context, and purpose of the AI system.. The first step is identifying the AI system and defining its intended purpose (Context).

Answer

Hiring a security consultant.

Answer

Updating the company website.

Answer

Running a bias test.

Question 15

You are auditing the integration of AI risk into the Enterprise Risk Management (ERM) system. Which finding indicates a failure in the governance structure?

Accepted Answer

AI models deployed in production are missing from the centralized enterprise risk register.. A core tenet of AI governance is that risk assessments must occur before deployment. If models are deployed without being included in the ERM system, the governance process is bypassed, representing a failure in control.

Answer

The risk assessment template is 20 pages long.

Answer

The AI risk register is updated annually instead of monthly.

Answer

The AI risk committee meets quarterly rather than monthly.

Question 16

Why is 'Data Lineage' important in an AI risk management program?

Accepted Answer

It helps ensure data quality and integrity. Data lineage allows you to trace data back to its source, which is critical for identifying and mitigating bias or training data contamination.

Answer

It makes user interfaces more attractive

Answer

It improves server load times

Answer

It reduces the amount of storage needed

Question 17

When assessing the risk of AI-generated content, which factor is the most important for calculating 'Impact'?

Accepted Answer

The potential for reputational and legal consequences. The potential for reputational or legal harm (consequence) is the most critical component when assessing the impact of AI-generated content.

Answer

The speed at which the content is generated

Answer

The color of the font used for the output

Answer

The number of GPUs used to create the content

Question 18

Which THREE areas should be covered in an AI risk management program?

Accepted Answer

Model performance and accuracy. Comprehensive AI programs address technical, legal, and operational risks.

Answer

The office floor plan

Answer

The color of the company logo

Question 19

A cross-functional committee is evaluating the deployment of a high-impact AI model. Which TWO factors are critical to include in the initial AI risk assessment to ensure comprehensive coverage?

Accepted Answer

The socio-technical implications and potential impact on protected groups.. Data lineage and socio-technical impact are critical for high-impact AI assessments.

Answer

The frequency of software patching for the underlying cloud infrastructure.

Answer

The name of the vendor providing the cloud compute resources.

Answer

The specific programming language used for the model development.

Question 20

You are defining KPIs for an AI project in a regulated industry. Which metric best captures model reliability over time?

Accepted Answer

Model drift (data drift/concept drift). Drift metrics indicate whether the model's accuracy is degrading, which is a proxy for reliability.

Answer

Frequency of model retraining

Answer

Number of training iterations

Answer

Total cost of compute resources