AAIR Practice Test 8 — 10 Questions

Question 1

When reporting to the Board, what is the best way to present 'AI Risk'?

Accepted Answer

Link AI risks to overall business impact, strategic goals, and current risk appetite.. Board-level reporting requires translating technical AI risk into business language. Option C does this by connecting AI risks to overall business impact, strategic goals, and the organization's risk appetite—the three dimensions boards care about most. This approach enables informed governance decisions, resource allocation, and risk tolerance setting, which are the board's actual responsibilities. It aligns with AAIR's emphasis on AI governance being integrated into enterprise risk management rather than treated as a purely technical concern.

Answer

State that AI is completely safe and requires no oversight.

Answer

Provide a list of all model parameters.

Answer

Give a 4-hour technical lecture on deep learning.

Question 2

In an AI risk program, how should 'Residual Risk' be treated?

Accepted Answer

It must be formally documented and periodically reviewed against risk appetite. Residual risk is the risk remaining after controls are applied, and it must be formally documented and periodically reviewed against the organization's risk appetite to confirm it stays within tolerance. This creates an auditable trail and ensures changes in the threat landscape or model behavior trigger reassessment. Treating residual risk as a one-time calculation rather than a living value is a common program failure.

Answer

It should be ignored if below a specific performance threshold

Answer

It should always be zero for production systems

Answer

It should be formally accepted by the risk owner if it exceeds appetite

Question 3

When assessing the risk of AI-generated content, which factor is the most important for calculating 'Impact'?

Accepted Answer

The potential for reputational and legal consequences. Impact in risk assessment is defined as the magnitude of consequences if a risk materializes; for AI-generated content, the most significant consequences are reputational damage and legal liability (defamation, copyright infringement, regulatory penalties, discrimination claims). These are the factors that determine severity in a risk matrix, whereas generation speed, font color, and GPU count are technical or cosmetic attributes with no bearing on harm magnitude.

Answer

The speed at which the content is generated

Answer

The color of the font used for the output

Answer

The number of GPUs used to create the content

Question 4

A team is designing an AI lifecycle monitoring system. Which metric is most effective for detecting 'Out-of-Distribution' (OOD) risks?

Accepted Answer

Anomaly scores derived from the model's embedding space or activation layers.. Out-of-distribution inputs produce anomalous patterns in the model's internal representations — embedding vectors or activation layers — so anomaly scores derived from these spaces (e.g., Mahalanobis distance, reconstruction error, or energy scores) are the most direct signal of OOD risk. These scores detect inputs that differ semantically from training distribution even when surface features look normal. This is the standard OOD detection approach in production ML monitoring.

Answer

Total number of users accessing the model.

Answer

Average request latency.

Answer

The number of lines of code in the model file.

Question 5

You are performing a 'Model Drift' analysis. Which metric is most indicative of performance degradation without access to real-time ground truth?

Accepted Answer

Kullback-Leibler (KL) Divergence between training and inference feature distributions.. Statistical distribution shifts (like KL Divergence) in input data serve as a proxy for performance degradation.

Answer

The number of concurrent API requests.

Answer

The memory consumption of the container.

Answer

Model accuracy on historical data.

Question 6

You are integrating AI governance into the existing Corporate Governance framework. Which THREE of the following activities are essential to ensure the Board of Directors maintains adequate oversight?

Accepted Answer

Reviewing and approving the organization's AI Risk Appetite Statement.. Option A is correct because the Board's core governance role includes setting and approving the organization's risk appetite, and an AI Risk Appetite Statement translates that mandate into explicit tolerance thresholds for AI-specific risks (e.g., bias, model drift, data privacy), giving the Board a formal basis for oversight. Option C is correct because designating executive-level accountability (e.g., a Chief AI Officer or an AI risk owner at the C-suite) establishes clear ownership and escalation paths, which is a fundamental governance control ensuring the Board can hold management responsible for AI risk outcomes. Option E is correct because a defined reporting cadence for significant AI-related risk incidents and model performance trends provides the Board with timely, recurring visibility into AI risk posture, enabling informed oversight and intervention consistent with corporate governance principles. Options B and D are not Board-level governance activities: patching GPU servers is an operational IT maintenance task, and daily code reviews of training algorithms are tactical engineering controls, both of which belong to management and technical teams rather than the Board's oversight responsibilities.

Answer

Installing software patches on all GPU servers.

Answer

Conducting daily code reviews of all AI training algorithms.

Question 7

Which THREE factors contribute to 'Data Quality Risk' during the training phase?

Accepted Answer

Incomplete datasets with many missing values.. Data Quality Risk during training arises from defects in the data itself, and option A is correct because incomplete datasets with many missing values degrade the statistical representativeness of the training sample, causing the model to learn from biased or insufficient signal. Option B is correct because systematic errors in target label annotations inject consistent noise into the ground truth, so the model optimizes toward incorrect labels and produces unreliable predictions. Option D is correct because selection bias in the training set creation process means the sampled data does not reflect the real-world distribution the model will encounter, skewing learned patterns. Option C is not a data quality issue but a hardware/resource constraint (GPU memory capacity), and option E is an infrastructure/vendor choice unrelated to the intrinsic quality of the training data.

Answer

The model is too large for the GPU memory.

Answer

Using the wrong cloud vendor.

Question 8

When documenting an AI Risk Program, what should be included in the 'AI Asset Register'?

Accepted Answer

The model purpose, data lineage, stakeholders, and risk classification.. An AI Asset Register is an inventory of AI systems and models that captures governance-relevant metadata: the model's purpose, the data sources and lineage used to train it, the stakeholders accountable for it, and its risk classification. This information enables risk management, regulatory reporting, and lifecycle oversight across the AI portfolio.

Answer

The raw hardware serial numbers of the servers.

Answer

The exact lines of code in the model.

Answer

The home addresses of all developers.

Question 9

Which THREE factors should be monitored to detect 'Model Drift' in the deployment phase?

Accepted Answer

The distribution of prediction outputs.. Model drift detection in the deployment phase focuses on changes in data and model behavior over time. Option A, the distribution of prediction outputs, is correct because a shift in the distribution of predictions (e.g., a classifier suddenly predicting one class far more often) is a direct symptom of model drift, often caused by changing input data or degraded decision boundaries. Option D, the confidence score of the model predictions, is correct because declining or abnormally shifting confidence scores indicate the model is becoming less certain and less aligned with the data it was trained on, a common signal of drift. Option E, the distribution of incoming input features, is correct because monitoring feature distributions (e.g., via statistical tests like PSI or KL divergence) detects data drift, which is the primary driver of model drift in production. Option B, the temperature of the server room, is incorrect because it is a physical infrastructure concern unrelated to statistical model behavior. Option C, the current market price of GPU hardware, is incorrect because it is a procurement/cost factor with no bearing on whether a deployed model's performance is degrading.

Answer

The temperature of the server room.

Answer

The current market price of GPU hardware.

Question 10

Which THREE items should be included in an AI 'Risk Assessment' report for a new project?

Accepted Answer

Identification of potential failure modes and their impact.. A complete report covers the risk identification, the impact analysis, and the control strategy.

Answer

The favorite color of the lead developer.

Answer

A list of all competitors currently using the same software.