AAIR AI Risk Governance And Framework Integration — Timed 10 Questions

Question 1

You are integrating AI risk into the NIST Risk Management Framework (RMF). Which step requires an explicit evaluation of AI model lineage and data provenance to satisfy the 'Govern' function?

Accepted Answer

Governance mapping during 'Govern' function analysis. The NIST AI RMF 'Govern' function is a cross-cutting function that establishes policies, roles, and accountability for AI risk, and it explicitly calls for documenting model lineage and data provenance as part of governance. Governance mapping during the 'Govern' function analysis is where lineage and provenance are evaluated to satisfy governance requirements. The RMF steps (Categorize, Select, Implement, Assess, Authorize, Monitor) are from the NIST RMF SP 800-37, not the AI RMF, and they do not specifically require AI lineage evaluation.

Answer

Step 2: Select controls

Answer

Step 1: Categorize system

Answer

Continuous Monitoring phase

Question 2

When configuring the Microsoft Purview AI hub for risk management, which setting must be enabled to ensure AI prompt logs are captured for enterprise risk reporting?

Accepted Answer

Configure Microsoft Purview AI activity logging. Microsoft Purview AI hub relies on AI activity logging to capture prompt and response data from AI applications like Copilot and third-party LLMs. This setting, when enabled, ingests interaction logs into Purview for risk reporting, auditing, and compliance. Without it, no prompt logs are available for enterprise risk analysis, regardless of other Purview configurations. Thus, configuring Microsoft Purview AI activity logging is the required step.

Answer

Enable Audit (Premium)

Answer

Set up Data Loss Prevention (DLP) policies

Answer

Enable sensitivity labels

Question 3

A retail company uses an AI model for dynamic pricing. The model's risk score recently exceeded the 'Moderate' threshold. As per the AI Governance framework, what is the mandatory next step?

Accepted Answer

Perform an mandatory AI model risk assessment and escalate to the Governance Committee.. When a model's risk score crosses from 'Low' into 'Moderate' (or higher), the AI Governance framework requires a formal risk assessment and escalation to the Governance Committee so that appropriate controls, oversight, and remediation can be authorized. This is a governance-mandated response, not an automated technical action. Disabling the model, continuing without action, or unilaterally retraining all bypass the required governance process.

Answer

Automatically disable the model.

Answer

Continue operation while monitoring for additional errors.

Answer

Update the training data set to improve the score.

Question 4

What is the primary objective of a 'post-implementation review' in the AI Risk Governance lifecycle?

Accepted Answer

To verify that the model continues to operate within established risk thresholds.. A post-implementation review (PIR) in the AI Risk Governance lifecycle is a structured checkpoint that occurs after a model is deployed into production. Its core purpose is to confirm that the model's actual runtime behavior — including its risk metrics, drift indicators, and control effectiveness — remains within the risk thresholds and tolerances defined during the pre-deployment risk assessment. This validates that the governance controls designed earlier are functioning as intended in the live environment.

Answer

To decommission the model permanently.

Answer

To ensure the developers received their bonuses.

Answer

To increase the model's complexity for better performance.

Answer

To ensure the developers received their bonuses.

Answer

To decommission the model permanently.

Question 5

A firm is using a 'Red Teaming' exercise for its AI model. How does this fit into the AI Risk Governance framework?

Accepted Answer

It serves as a validation technique to identify vulnerabilities and edge-case risks.. Red teaming is a structured adversarial testing technique used to uncover vulnerabilities, biases, and edge-case failures in AI models before deployment. Within an AI Risk Governance framework, it functions as a validation control that provides empirical evidence of model robustness and safety, complementing other governance activities like risk assessment, documentation, and monitoring. It is not a standalone requirement but a critical component of the broader risk management process.

Answer

It is the only requirement for model governance.

Answer

It is a marketing exercise to show off model robustness.

Answer

It should be performed by the same team that developed the model.

Answer

It is the only requirement for model governance.

Question 6

You are configuring the NIST AI Risk Management Framework (AI RMF) 'Govern' function for a high-risk autonomous system. Which activity specifically fulfills the 'Govern' function's requirement for establishing accountability?

Accepted Answer

Formalizing the AI System Model Owner role with defined risk acceptance and oversight accountabilities.. The NIST AI RMF 'Govern' function (GV) establishes the policies, roles, and accountability structures for AI risk management. Formalizing the AI System Model Owner role with defined risk acceptance and oversight accountabilities directly fulfills GV 1.2 (accountability structures) and GV 1.4 (documented roles). The other options are Map, Measure, or Manage function activities, not Govern.

Answer

Performing a red-teaming exercise on the model inputs.

Answer

Configuring automated PII scrubbing in the data pipeline.

Answer

Reviewing the training dataset for bias using statistical sampling.

Question 7

Which governance mechanism is most effective for ensuring that AI ethical risks are addressed during the 'Design' phase of the AI Lifecycle?

Accepted Answer

Conducting a formal 'Ethics by Design' review as part of the AI project's stage-gate approval process.. 'Ethics by Design' is a proactive governance approach that integrates ethical considerations into the earliest stages of AI development, specifically the Design phase. Embedding this review within the stage-gate approval process ensures that ethical risks are formally assessed and mitigated before the project progresses, aligning with governance frameworks that emphasize early intervention. This mechanism directly addresses the requirement to ensure ethical risks are addressed during design, rather than relying on after-the-fact detection or legal review.

Answer

Scanning the source code for hardcoded credentials.

Answer

multi_select

Answer

Requiring a legal sign-off on the final model deployment.

Answer

multi_select

Answer

Reviewing the production logs for anomalies.

Question 8

The organization is updating its 'AI Risk Management Policy'. Which THREE components are essential to ensure it aligns with the 'Manage' function of the NIST AI RMF?

Accepted Answer

A defined mechanism for reporting and remediating non-compliant AI systems.. The NIST AI RMF 'Manage' function focuses on allocating resources to identified risks, treating them, and monitoring residual risk, so option B is correct because a defined mechanism for reporting and remediating non-compliant AI systems operationalizes risk treatment and response. Option D is correct because risk-based prioritization using impact and likelihood is central to the Manage function's requirement to prioritize and allocate resources to the most significant AI risks. Option E is correct because documenting model performance monitoring and recalibration cycles supports ongoing risk management, tracking, and the continuous improvement expected under Manage. Option A is incorrect because marketing budget planning is a business/commercial activity unrelated to AI risk treatment under the RMF. Option C is incorrect because a list of source-code repository users is an access-control artifact, not a Manage-function component for treating and monitoring AI risks.

Answer

The marketing budget for upcoming AI product launches.

Answer

A list of all employees who have access to the source code repository.

Question 9

When assessing the organizational readiness for AI risk governance, which TWO areas must be evaluated to ensure the framework is sustainable?

Accepted Answer

The availability of cross-functional expertise (e.g., legal, compliance, ethics) within the AI governance body.. Sustainable governance requires both the human element (culture/skills) and the procedural element (integration into existing systems).

Answer

The speed of the network bandwidth between training sites.

Answer

The capability of the internal audit team to audit AI models.

Answer

The total number of GPUs available in the data center.

Question 10

You are mapping AI risks to the NIST AI RMF. Which step is essential when documenting the 'Map' function for a high-risk autonomous system?

Accepted Answer

Identifying and documenting the context and intended use. Identifying and documenting the context and intended use is the foundation of mapping AI risks to an enterprise framework.

Answer

Updating the SOC2 Type II report

Answer

Automating the model deployment pipeline

Answer

Conducting a quarterly penetration test