AI Risk Management

An organization is using an LLM-based agent. What is the primary risk associated with 'indirect prompt injection' in this environment?

Which TWO of the following are primary risks associated with 'membership inference attacks' against an AI model?

When utilizing a third-party AI vendor, which contractual requirement is most critical for addressing 'shadow AI' risks within an enterprise?

When establishing a risk management framework for GenAI, which THREE factors should be prioritized to satisfy the NIST AI Risk Management Framework requirements?

A machine learning model is showing signs of 'data drift'. What is the most effective initial step in the risk assessment process?

An organization is performing threat modeling for a RAG (Retrieval-Augmented Generation) pipeline. Which specific vulnerability is unique to the retrieval component?

During an adversarial threat modeling exercise for a facial recognition system, you identify a risk of pixel perturbation attacks. Which countermeasure is the most appropriate technical control to implement?

You are assessing a supply chain risk where an AI model uses a pre-trained base model from a third-party hub. Which action most effectively mitigates the risk of model poisoning during the integration phase?

A developer is implementing 'Differential Privacy' on a training dataset. What is the primary trade-off they are managing?

What is the primary objective of a 'Bias Audit' in an AI risk management program?

Which of the following best describes 'Model Inversion' as a security risk?

Which THREE technical controls are recommended to secure an AI model's API endpoint?

When conducting a risk assessment for an AI system, which TWO of the following are considered 'AI System' components that require individual threat assessment?

You are implementing 'AI Red Teaming'. What is the most effective way to test against prompt injection?

You are managing risks for a federated learning deployment. What is the primary security concern regarding the 'model updates' sent from the edge clients to the aggregator?

Which THREE criteria are essential for evaluating the risk of an AI vendor's 'Model Card'?

Which TWO of the following are considered 'AI Supply Chain' risks?

A model is vulnerable to 'Evasion Attacks' using FGSM (Fast Gradient Sign Method). Which architectural change most effectively increases robustness?

What is the most effective control to prevent 'Model Scraping' from an exposed AI prediction API?

When assessing AI third-party vendor risk, which document is most useful for understanding the vendor's data handling practices?

You are managing an AI project and notice the model is performing poorly on a subset of data representing a protected class. What is the correct next step in the risk assessment process?

Which THREE practices are necessary for managing 'AI Model Version Control' as part of an overall risk management strategy?

An attacker is performing a 'Model Extraction' attack. What is the most likely goal of the attacker?

Which TWO measures are most effective in reducing the risk of 'Hallucinations' in LLM systems?

Which THREE factors must be included in a 'Model Risk Management' (MRM) policy?

Which TWO techniques help mitigate 'Model Poisoning'?

What is 'AI Shadowing' or 'Shadow AI' in an enterprise setting?

When evaluating an AI model for production, what does the 'F1 Score' tell you from a risk management perspective?

What is the primary risk associated with 'Overfitting' in an AI model?

You are assessing the risk of 'Data Poisoning'. Which stage of the machine learning lifecycle is most vulnerable to this attack?

What is the purpose of 'AI Model Transparency' in a risk management framework?

A researcher is using 'Adversarial Training' to defend against evasion. How exactly does this work?

Which THREE components are critical for an 'AI Incident Response' plan?

Which TWO factors contribute to 'Model Obsolescence' risk?

When assessing the risk of 'Prompt Leaking', what is the most important control to implement?

What is the key risk difference between 'Data Privacy' and 'Model Security' in AI?

An organization is evaluating 'Third-Party AI Models'. Which risk is most effectively addressed by a 'Model Evaluation Report'?

Which THREE technical configurations help mitigate the risk of 'Model Exfiltration'?

You are auditing an AI system for 'Model Explainability' (XAI). Why is XAI critical from a risk management perspective?

What is the primary role of a 'Human-in-the-loop' (HITL) in AI risk management?

Which TWO security controls are recommended for protecting 'Training Data'?

What is the purpose of 'AI Model Inventory'?

Which THREE items should be included in an 'AI Vendor Assessment'?

Which of the following describes 'Model Integrity' risk?

When dealing with 'Adversarial Evasion', why is the 'black-box' nature of an API a risk?

Which TWO factors help maintain 'AI Accountability'?

In an AI supply chain, what is 'Dependency Confusion' risk?

What is the primary goal of 'Model Monitoring' in the context of risk management?

What is the best way to manage 'Bias' in an AI system?

What is 'Model Stealing' as a risk?

Which THREE steps are needed for 'AI Risk Assessment'?

Which of these is a 'Proactive' risk management strategy?

Which THREE elements are essential for 'AI Governance'?

What is the primary risk of using 'Pre-trained models' from public hubs without verification?

What is 'Model Drift'?

Which THREE technical controls effectively manage 'Third-Party AI Vendor' risks?

What is 'AI Red Teaming'?

Which TWO items must be documented in an 'AI Model Card'?

What is the primary risk of 'Over-reliance' on AI outputs?

Which risk management activity happens during the 'Design' phase of an AI project?

What is a 'Side-Channel Attack' against an AI model?

Which control is most effective against 'Data Poisoning' in a collaborative learning environment?