AAIR AI Risk Program Management Practice Test 4 — 15 Questions

Question 1

Which TWO tasks are part of the 'AI Risk Assessment' process?

Accepted Answer

Evaluating the likelihood and impact of identified risks. Option A is correct because a core step of AI Risk Assessment is risk analysis, where each identified risk is evaluated for its likelihood (probability of occurrence) and impact (severity of consequences) so risks can be prioritized and mitigated. Option D is correct because AI Risk Assessment begins with risk identification, systematically uncovering potential AI-related threats such as bias, data poisoning, model drift, privacy leakage, and adversarial attacks. Together, identifying threats (D) and evaluating their likelihood and impact (A) form the analytical backbone of the risk assessment process. The remaining options do not belong: B (choosing dashboard font color) is a UI/design decision, C (writing marketing copy) is a marketing activity, and E (hiring office staff) is an HR/administrative task, none of which involve identifying or analyzing AI risks.

Answer

Choosing the font color for the dashboard

Answer

Writing marketing copy for the AI product

Answer

Hiring new office staff

Question 2

Why is it critical to have 'Human-in-the-Loop' (HITL) for high-risk AI decisions?

Accepted Answer

To provide accountability and a safeguard against errors. Human-in-the-Loop (HITL) ensures that a qualified human reviews and can override high-risk AI decisions, providing both accountability (a responsible person is answerable for the outcome) and a safeguard against model errors, bias, or edge cases the model was not trained for. This is essential for high-stakes domains like healthcare, finance, and criminal justice.

Answer

To make the computer faster

Answer

To replace the need for model testing

Answer

To save money on hardware

Question 3

Which TWO items are considered 'AI Model Artifacts' that should be kept for audit purposes?

Accepted Answer

The training dataset version. Option A, the training dataset version, is a correct AI model artifact for audit purposes because it documents the exact data lineage and inputs used to train the model, which is essential for reproducibility, bias investigation, and compliance reviews. Option C, model hyperparameters and architecture configuration, is also correct because these settings define how the model was built and trained, and auditors need them to reproduce, validate, or explain model behavior. The unmarked options do not belong: the lunch menu (B), company mascot name (D), and local weather report (E) are unrelated to model development, training, or governance and have no audit value for AI artifacts.

Answer

The lunch menu for the developers

Answer

The name of the company's favorite mascot

Answer

The local weather report from last week

Question 4

Which THREE areas should be covered in an AI risk management program?

Accepted Answer

Model performance and accuracy. Option B (Model performance and accuracy) is correct because an AI risk management program must address model-specific risks such as drift, bias, overfitting, and degraded accuracy that directly affect decision quality and safety. Option C (Third-party/Vendor risk management) is correct because organizations often rely on external model providers, APIs, and training data suppliers, so vendor due diligence, contractual controls, and supply-chain monitoring are essential parts of AI risk governance. Option E (Legal and regulatory compliance) is correct because AI systems must comply with applicable laws and frameworks such as the EU AI Act, GDPR, and sector-specific regulations, making compliance a core risk domain. Option A (The office floor plan) is incorrect because physical office layout is a facilities concern, not an AI risk management area. Option D (The color of the company logo) is incorrect because branding aesthetics have no bearing on AI risk management.

Answer

The office floor plan

Answer

The color of the company logo

Question 5

Which TWO strategies are recommended for 'Mitigating' AI model bias?

Accepted Answer

Applying fairness constraints during model training. Option C is correct because applying fairness constraints during model training directly mitigates bias by incorporating fairness metrics (such as demographic parity or equalized odds) into the objective function or as regularization terms, forcing the model to reduce disparate impact across protected groups. Option E is correct because training on more diverse and representative datasets addresses bias at its source—the data—by ensuring the model learns patterns from a broader population, reducing sampling bias and underrepresentation that lead to skewed predictions. Options A, B, and D are not recommended mitigation strategies: deleting all data destroys the training set and makes learning impossible, asking users to manually fix bias shifts responsibility away from systematic model design and is not scalable or reliable, and ignoring bias allows it to persist and potentially worsen in production.

Answer

Removing all data from the database

Answer

Asking the user to manually fix the bias

Answer

Ignoring the bias and hoping it goes away

Question 6

Which TWO factors should be documented in an AI Model Card?

Accepted Answer

Intended use cases. Option D (Intended use cases) is correct because an AI Model Card is designed to document the purpose and appropriate applications of a model, so consumers know what tasks it was built for and where it should be deployed. Option E (Model limitations and known risks) is correct because Model Cards must disclose known biases, failure modes, out-of-scope scenarios, and other risks so users can make informed decisions about deployment. Options A, B, and C are incorrect because favorite snacks, stock prices, and new-hire handbooks are unrelated to model transparency, performance, or governance, and are not part of standard Model Card documentation such as that proposed by Mitchell et al. or required under emerging AI regulations.

Answer

The developer's favorite snacks

Answer

The current stock price of the company

Answer

The employee handbook for new hires

Question 7

Which THREE roles should have oversight authority in the AI Risk Program?

Accepted Answer

Chief Technology Officer. The Chief Technology Officer (B) is correct because the CTO owns the technology strategy and AI systems architecture, so they must ensure AI risk controls are technically feasible, implemented, and aligned with the organization's engineering standards. The Chief Risk Officer (C) is correct because the CRO leads enterprise risk management, owns the risk framework and reporting to the board, and must ensure AI risks are identified, assessed, and mitigated consistently with other enterprise risks. The Head of Business Unit where AI is used (E) is correct because that leader is accountable for the business outcomes, operational use, and day-to-day risk decisions of the AI system, and must own residual risk within their unit. The company's social media influencer (A) and the office receptionist (D) do not belong because neither role has the governance mandate, decision rights, or accountability for AI risk oversight in the organization.

Answer

The company's social media influencer

Answer

The office receptionist

Question 8

Which TWO teams should be involved in the initial risk review for an AI chatbot?

Accepted Answer

Data Science/ML Engineering. Option A (Data Science/ML Engineering) is correct because this team owns the chatbot's model design, training data, and evaluation metrics, so they are best positioned to identify technical risks such as bias, hallucination, prompt injection, and data leakage during an initial risk review. Option B (Legal Department) is correct because legal must assess regulatory compliance (e.g., GDPR, CCPA), intellectual property, liability, and contractual exposure arising from the chatbot's outputs and data handling. The remaining options do not belong: the mailroom staff (C), local fitness coach (D), and custodial cleaning staff (E) have no role in AI system risk assessment, data governance, or regulatory compliance for a chatbot.

Answer

The company mailroom staff

Answer

The local fitness coach

Answer

The custodial cleaning staff

Question 9

Which TWO items are considered 'AI Infrastructure' risks?

Accepted Answer

Unauthorized access to the model environment. Option D (Unauthorized access to the model environment) is a correct AI Infrastructure risk because the model environment—training pipelines, inference endpoints, model registries, and the underlying compute/storage—must be protected by identity and access controls; a breach there can lead to model theft, data exfiltration, tampering with weights, or poisoned outputs, making it a core infrastructure security concern. Option E (System uptime/availability) is also a correct AI Infrastructure risk because AI workloads depend on continuous availability of GPUs/TPUs, orchestration (e.g., Kubernetes), and serving infrastructure; downtime directly degrades or halts training and inference, so availability is a fundamental infrastructure risk. The remaining options—A (wall color), B (desk chair type), and C (number of windows)—are workplace ergonomics or facilities aesthetics and have no bearing on AI infrastructure security, performance, or reliability, so they are not AI Infrastructure risks.

Answer

The color of the server room walls

Answer

The type of desk chair in the office

Answer

The number of windows in the office

Question 10

Which THREE types of 'Bias' need to be managed in an AI project?

Accepted Answer

Measurement bias (data collection). Measurement bias (A) must be managed because it arises during data collection when the instruments, sensors, or labeling procedures systematically distort the values recorded, so the training data does not faithfully represent the real-world phenomenon. Sampling bias (D) must be managed because it occurs during data selection when the dataset is drawn from a non-representative subset of the population, causing the model to learn patterns that do not generalize to the intended deployment context. Algorithmic bias (E) must be managed because it emerges from the model's logic, objective function, or optimization process, which can amplify or encode unfair correlations even when the input data is otherwise sound. The remaining options do not belong: the bias towards free coffee (B) is a humorous personal preference with no bearing on AI data or model behavior, and the bias of the local weather (C) is an environmental condition rather than a systematic distortion in an AI pipeline.

Answer

The bias towards free coffee

Answer

The bias of the local weather

Question 11

Which TWO aspects of 'Data Governance' are critical for AI risk management?

Accepted Answer

Data access control and security. Data governance for AI risk management hinges on controlling who can access data and ensuring that data is trustworthy. Option A, data access control and security, is correct because AI systems depend on sensitive datasets, and governance must enforce authentication, authorization, encryption, and audit logging to prevent unauthorized access, data leakage, and tampering that could corrupt model behavior or violate privacy regulations. Option E, data quality and consistency, is correct because AI models learn directly from data; inaccurate, incomplete, duplicated, or inconsistent data leads to biased predictions, poor generalization, and unreliable outputs, so governance must define data standards, validation rules, and stewardship processes. The remaining options are irrelevant to AI risk management: the number of pens in the supply closet (B), the speed of the local internet (C), and the interior design of the office (D) are office logistics or aesthetics and have no bearing on data governance or AI risk controls.

Answer

The number of pens in the supply closet

Answer

The speed of the local internet

Answer

The interior design of the office

Question 12

You are establishing an AI risk appetite framework using the NIST AI RMF. Which action best ensures alignment between AI innovation velocity and organizational risk tolerance?

Accepted Answer

Define risk tolerance levels based on potential impact to human rights and safety, differentiated by model deployment context.. Defining risk tolerance levels based on potential impact to human rights and safety, differentiated by deployment context, aligns with the NIST AI RMF's risk-based approach. It allows the organization to calibrate innovation velocity according to the severity of consequences in each use case, rather than applying a one-size-fits-all threshold. This ensures that high-risk applications receive stricter scrutiny while lower-risk projects can proceed more rapidly.

Answer

Set a static threshold for model accuracy at 95% across all AI projects.

Answer

Require all AI teams to use exclusively open-source models to mitigate vendor-related risks.

Answer

Delegate all AI risk acceptance decisions to the lead data scientist.

Question 13

Your organization is implementing an AI Risk Register. Which approach provides the most effective cross-functional coordination for identifying bias in a new HR recruitment AI?

Accepted Answer

Conduct a mandatory tabletop exercise involving HR, legal, and data science teams to simulate potential discriminatory outcomes.. A tabletop exercise brings together HR, legal, and data science teams to simulate discriminatory outcomes, which is the most effective cross-functional coordination method because it surfaces bias risks that no single discipline can identify alone. HR understands job role requirements and historical hiring patterns, legal understands anti-discrimination law and liability, and data science understands model mechanics and data distributions. This collaborative simulation aligns with NIST AI RMF and ISO/IEC 42001 expectations for stakeholder engagement in AI risk identification.

Answer

Perform a technical audit on the training dataset distribution.

Answer

Automate all bias detection using internal library scripts without human review.

Answer

Update the AI policy to forbid the use of demographic attributes in training data.

Question 14

When defining KPIs for an AI Governance program, which metric is most predictive of long-term model robustness?

Accepted Answer

The frequency of model retraining triggered by performance drift alerts.. The frequency of model retraining triggered by performance drift alerts is the most predictive metric of long-term robustness because it reflects the organization's ability to detect degradation and respond with corrective action. A governance program that tracks this metric demonstrates closed-loop monitoring and remediation, which sustains model performance over time as data distributions shift. This aligns with MLOps best practices for drift detection and continuous improvement.

Answer

Number of users accessing the AI interface.

Answer

Total number of AI models currently in production.

Answer

The budget spent on GPU cloud computing resources.

Question 15

An organization is integrating AI risk into its enterprise risk management (ERM) framework. What is the first step in this integration process?

Accepted Answer

Identify and classify all AI applications by criticality and risk level.. Integrating AI risk into ERM begins with discovery and classification — you cannot govern, monitor, or write policy for AI applications you haven't identified. Identifying and classifying all AI applications by criticality and risk level establishes the risk register baseline that every subsequent control (monitoring, policy, ownership) depends on. This mirrors the standard ERM sequence: identify, assess, treat, monitor.

Answer

Assign a Chief AI Officer.

Answer

Install automated model monitoring tools.

Answer

Create an AI acceptable use policy.