AAIR Practice Test 9 — 10 Questions

Question 1

What is the primary risk associated with 'Shadow AI' in an organization?

Accepted Answer

It bypasses established AI risk governance and compliance controls.. Shadow AI refers to AI tools deployed without the knowledge or oversight of the governance team, creating invisible, unmanaged risks.

Answer

It makes the network run slower.

Answer

It costs too much.

Answer

It makes the developers work too hard.

Question 2

You are auditing a model's lifecycle and discover that the training data distribution changes every time the model retrains. What is the biggest risk here?

Accepted Answer

The model's behavior will be inconsistent and difficult to reproduce, making debugging impossible.. When the training data distribution changes on every retrain, the model's learned parameters and behavior shift unpredictably, making it impossible to reproduce results, compare versions, or debug regressions. This undermines model governance, auditability, and trust. Reproducibility requires stable, versioned training data and documented preprocessing.

Answer

The model will require more compute power.

Answer

The model will be too secure.

Answer

The model will be too small.

Question 3

When integrating AI risk into existing ERM, which THREE aspects of an AI model lifecycle must be audited to ensure compliance?

Accepted Answer

Model validation results. Model validation results (C) must be audited because they document whether the AI model meets its stated performance, fairness, and robustness criteria before and after deployment, which is a core control for AI risk within ERM. Incident response logs (D) are essential because they provide evidence that AI-related failures, bias events, or security incidents were detected, escalated, and remediated according to the organization's risk response procedures. Data lineage and provenance (E) must be audited to verify that training, validation, and production data sources are authorized, traceable, and compliant with privacy and quality requirements, which directly affects model reliability and regulatory compliance. Personnel physical security badges (A) and office climate control settings (B) are facility and environmental controls unrelated to the AI model lifecycle, so they do not belong in an audit of AI risk integration into ERM.

Answer

Personnel physical security badges

Answer

Office climate control settings

Question 4

When deploying a generative AI model, what 'Governance Control' is most critical for preventing the generation of harmful/inappropriate content?

Accepted Answer

Implement output guardrails and moderation layers.. Guardrails are technical controls placed on top of models to intercept and filter output, which is a vital part of risk governance.

Answer

Increase the number of GPUs to make it faster.

Answer

Only use the model in an internal environment without internet access.

Answer

Allow users to provide feedback directly to the model.

Question 5

When designing an AI Risk Reporting dashboard for senior management, which TWO of the following should be visualized?

Accepted Answer

Status of compliance certifications for high-risk models.. Option C is correct because senior management needs visibility into the governance posture of high-risk AI models, and tracking the status of compliance certifications (e.g., ISO/IEC 42001, SOC 2, or EU AI Act conformity assessments) directly supports regulatory oversight and accountability. Option D is correct because an aggregate risk score per business unit condenses model-level risk metrics into a decision-ready KPI that lets executives compare exposure, prioritize mitigation funding, and track risk appetite across the organization. Option A is not appropriate because server uptime is an infrastructure/availability metric that belongs in IT operations dashboards, not an AI risk reporting view for executives. Option B is not appropriate because raw per-transaction prediction scores are far too granular and technical for senior management, and would create noise rather than actionable risk insight. Option E is not appropriate because employee training attendance is a tactical HR/compliance activity metric, not a strategic AI risk indicator for the board or executive committee.

Answer

Server uptime percentages.

Answer

Raw model prediction scores for every transaction.

Answer

Employee training attendance logs.

Question 6

What is the key purpose of the 'Govern' function in the NIST AI RMF?

Accepted Answer

To establish the organizational culture, policy, and procedures for AI risk management.. The Govern function in the NIST AI RMF (AI Risk Management Framework 1.0) is one of the four core functions (Govern, Map, Measure, Manage) and is explicitly cross-cutting. Its purpose is to cultivate and implement a culture of risk management via policies, processes, procedures, roles, responsibilities, and accountability structures across the AI lifecycle. It is not a technical execution function — it establishes the organizational scaffolding that enables the other three functions to operate.

Answer

To troubleshoot hardware issues.

Answer

To define the marketing strategy for the AI products.

Answer

To code the AI algorithms.

Question 7

Which of the following is an example of an 'AI Risk Metric'?

Accepted Answer

Rate of false negatives in model output. A risk metric quantifies the potential for harm or error in an AI system. The rate of false negatives directly measures how often the model misses positive cases, which is a core performance and risk indicator—especially in safety-critical applications like medical diagnosis or fraud detection. This metric helps assess the model's reliability and the risk of costly or dangerous omissions.

Answer

Budget spent on office supplies

Answer

Employee headcount in AI department

Answer

Number of coffee machines in the breakroom

Question 8

A company is scaling its AI initiatives across five business units. What is the most effective way to ensure consistent risk measurement?

Accepted Answer

Implementing a centralized AI risk taxonomy. A centralized AI risk taxonomy provides a common language, scoring scale, and category structure that all five business units can apply consistently, enabling comparable risk measurement across the enterprise. Without a shared taxonomy, each unit's risk ratings become incommensurable, defeating the purpose of enterprise-wide AI risk oversight. This aligns with AAIR guidance that risk measurement must be standardized before it can be aggregated or governed.

Answer

Using different platforms for each business unit

Answer

Allowing each business unit to define its own risk metrics

Answer

Focusing only on the highest-risk model

Question 9

Which document is essential for defining the roles and responsibilities within an AI Risk Program?

Accepted Answer

AI Governance RACI Matrix.. The AI Governance RACI Matrix is the document that explicitly defines who is Responsible, Accountable, Consulted, and Informed for AI risk activities across the organization. It is the standard governance artifact for assigning roles and responsibilities, ensuring clear ownership and avoiding gaps or overlaps in the AI Risk Program.

Answer

Data Privacy Impact Assessment (DPIA).

Answer

Model Training Log.

Answer

AI Incident Response Plan.

Question 10

Why is 'Data Lineage' important in an AI risk management program?

Accepted Answer

It helps ensure data quality and integrity. Data lineage documents the origin, movement, transformation, and usage of data throughout its lifecycle, which is foundational to AI risk management because it enables traceability of data quality issues, bias sources, and compliance violations back to their root. Without lineage, an organization cannot verify that training data was lawfully obtained, representative, or free of contamination — making it impossible to assess or remediate data-related AI risks.

Answer

It makes user interfaces more attractive

Answer

It improves server load times

Answer

It reduces the amount of storage needed