AAIR Timed Practice Test 3 — 10 Questions

Question 1

You are establishing an AI risk appetite framework using the NIST AI RMF. Which action best ensures alignment between AI innovation velocity and organizational risk tolerance?

Accepted Answer

Define risk tolerance levels based on potential impact to human rights and safety, differentiated by model deployment context.. Defining risk tolerance levels based on potential impact to human rights and safety, differentiated by deployment context, aligns with the NIST AI RMF's risk-based approach. It allows the organization to calibrate innovation velocity according to the severity of consequences in each use case, rather than applying a one-size-fits-all threshold. This ensures that high-risk applications receive stricter scrutiny while lower-risk projects can proceed more rapidly.

Answer

Set a static threshold for model accuracy at 95% across all AI projects.

Answer

Require all AI teams to use exclusively open-source models to mitigate vendor-related risks.

Answer

Delegate all AI risk acceptance decisions to the lead data scientist.

Question 2

Which THREE areas should be covered in an AI risk management program?

Accepted Answer

Model performance and accuracy. Option B (Model performance and accuracy) is correct because an AI risk management program must address model-specific risks such as drift, bias, overfitting, and degraded accuracy that directly affect decision quality and safety. Option C (Third-party/Vendor risk management) is correct because organizations often rely on external model providers, APIs, and training data suppliers, so vendor due diligence, contractual controls, and supply-chain monitoring are essential parts of AI risk governance. Option E (Legal and regulatory compliance) is correct because AI systems must comply with applicable laws and frameworks such as the EU AI Act, GDPR, and sector-specific regulations, making compliance a core risk domain. Option A (The office floor plan) is incorrect because physical office layout is a facilities concern, not an AI risk management area. Option D (The color of the company logo) is incorrect because branding aesthetics have no bearing on AI risk management.

Answer

The office floor plan

Answer

The color of the company logo

Question 3

To ensure cross-functional coordination, you are designing a workflow for AI incident reporting. Which group should be the first point of contact upon detecting an AI model bias issue?

Accepted Answer

AI Governance/Ethics Committee. An AI Governance/Ethics Committee is the designated cross-functional body responsible for overseeing AI risk, including bias, fairness, and ethical concerns. When a bias issue is detected, this committee is the appropriate first point of contact because it has the authority, expertise, and mandate to assess the issue, coordinate response across legal, data science, and business teams, and determine remediation or escalation. Routing bias incidents here ensures consistent, accountable handling aligned with the organization's AI risk framework.

Answer

IT Help Desk

Answer

Customer Support

Answer

External Regulators

Question 4

To mitigate 'Training-Serving Skew' in the AI lifecycle, what is the best practice for data processing pipelines?

Accepted Answer

Use a feature store to ensure consistent feature engineering logic for both stages.. Training-serving skew occurs when the feature computation logic differs between the training pipeline and the inference pipeline, producing inconsistent feature values. A feature store (A) centralizes feature definitions and serves the same computed values to both training and online inference, eliminating the divergence. This is the industry-standard mitigation because it enforces a single source of truth for feature engineering.

Answer

Write separate code for training and inference to optimize for speed.

Answer

Use only raw data for both training and inference.

Answer

Train the model on the production server directly.

Question 5

Your organization is integrating AI risks into the existing COSO Enterprise Risk Management (ERM) framework. Which action best ensures that AI-specific model drift risk is formally addressed within the 'Review and Revision' component?

Accepted Answer

Integrating model performance metrics into the quarterly enterprise risk assessment and management review processes.. COSO ERM's 'Review and Revision' component requires that risk responses be reassessed and adjusted as conditions change. Integrating model performance metrics (including drift indicators) into the quarterly enterprise risk assessment and management review processes ensures drift risk is formally reviewed, escalated, and acted upon at the governance level. This embeds AI risk into existing ERM cadence rather than treating it as a purely technical pipeline concern.

Answer

Establishing automated triggers within the CI/CD pipeline to halt deployment if drift exceeds threshold.

Answer

Mapping AI model inventory to the IT asset register in the CMDB.

Answer

Assigning a Data Scientist to the Board Risk Committee.

Question 6

A financial institution is integrating AI risk into its ERM framework. Which action most effectively aligns AI risk appetite with enterprise risk appetite?

Accepted Answer

Defining quantitative risk thresholds in the AI governance policy. Defining quantitative risk thresholds in the AI governance policy is correct because it translates the enterprise's stated risk appetite into measurable, enforceable limits that AI initiatives must respect. Risk appetite only becomes operational when expressed as concrete metrics (e.g., maximum acceptable bias score, error rate, or financial exposure), allowing AI risk to be aggregated and compared alongside other enterprise risks in the ERM framework. This creates direct traceability between board-level tolerance and day-to-day AI decisions.

Answer

Purchasing cybersecurity insurance for AI systems

Answer

Assigning AI risk ownership to the IT department

Answer

Implementing a standalone AI audit program

Question 7

During the 'Training' phase, why is 'Data Splitting' (train/validation/test) crucial for risk management?

Accepted Answer

To evaluate the model's generalization capabilities and mitigate the risk of overfitting.. Data splitting partitions the dataset into training, validation, and test sets so the model is evaluated on data it has never seen. This measures generalization and detects overfitting, where the model memorizes training data but fails on new inputs. It is a foundational risk control because it prevents deploying a model whose performance is illusory.

Answer

To save disk space on the server.

Answer

To increase the training speed.

Answer

To make the model easier to read.

Question 8

An organization discovers that an AI model has learned a bias from training data. Per the AI Risk framework, what should be the immediate priority of the Governance function?

Accepted Answer

Suspend the model's usage and conduct a formal root cause analysis.. When bias is discovered in a model, the Governance function's immediate priority is to suspend the model's usage to prevent ongoing harm and then conduct a formal root cause analysis to determine how the bias entered and how to remediate it. This aligns with the AI risk framework's emphasis on containment before correction, protecting affected stakeholders and preserving evidence. Waiting or retraining on the same data would perpetuate the harm.

Answer

Wait for the quarterly board report to inform the board.

Answer

Fire the AI development team.

Answer

Retrain the model on the same data set to see if it fixes itself.

Question 9

When a 'Data Drift' alert is triggered in a production environment, what is the first step in the risk management lifecycle?

Accepted Answer

Perform a root cause analysis to verify if the shift is statistical noise or a genuine change in input patterns.. The first step in the risk management lifecycle when a data drift alert triggers is to perform a root cause analysis to determine whether the drift is due to statistical noise or a genuine change in input patterns. This verification step is crucial before taking any corrective action like retraining or rolling back, as it prevents unnecessary interventions. It aligns with the risk management process of identifying and assessing the risk before mitigating it.

Answer

Immediately retrain the model.

Answer

Delete all current production logs.

Answer

Roll back to the previous model version.

Question 10

Which TWO types of documentation are critical for AI Transparency requirements?

Accepted Answer

Data Sheets for Datasets explaining the provenance and makeup of training data.. Data Sheets for Datasets (A) are critical because AI transparency requires documenting the provenance, composition, collection methods, and preprocessing of training data so stakeholders can assess bias, consent, and suitability. Model Cards (B) are equally essential since they disclose a model's intended use, limitations, performance metrics across relevant subgroups, and ethical considerations, directly supporting transparency obligations. Together these artifacts give the technical and contextual information regulators and users need to understand how an AI system was built and how it should be used. The remaining options do not belong: a weekly meeting calendar (C) and an employee handbook (D) are general administrative documents unrelated to AI system transparency, and an office access list (E) concerns physical security, not AI documentation.

Answer

A weekly calendar of team meetings.

Answer

The employee handbook.

Answer

A list of all employees who have access to the office.