AAISM Practice Test 12 — 15 Questions

Question 1

When drafting an AI policy, how should the organization address 'Human-in-the-Loop' (HITL) requirements?

Accepted Answer

Mandate HITL for high-impact or sensitive decision-making processes.. Policy must clearly define decision-making thresholds where automated systems require human intervention to mitigate high-impact risks.

Answer

Require HITL for every single AI inference.

Answer

Delegate HITL requirements to the software development team.

Answer

Exclude HITL to maximize system throughput.

Question 2

In the context of the EU AI Act, what is the 'Provider's' obligation regarding conformity assessments for high-risk AI systems?

Accepted Answer

Ensuring conformity assessment and compliance with technical standards.. Providers must ensure their systems undergo a conformity assessment and bear the CE marking before market entry.

Answer

Self-assessment is prohibited for all high-risk systems.

Answer

Providing a written promise of security.

Answer

Delegating all compliance to the system deployer.

Question 3

What is the primary risk associated with 'Data Poisoning' in an AI governance program?

Accepted Answer

Compromised model integrity and reliability.. Poisoned data compromises the model's integrity and reliability, leading to biased or malicious outputs.

Answer

System uptime improvement.

Answer

Increased cloud storage bills.

Answer

Reduced model file size.

Question 4

During an internal audit of the AI program, it is found that the organization lacks a 'Model Inventory'. What is the most immediate risk to the AI security program?

Accepted Answer

Inability to perform security risk assessments or lifecycle management for shadow AI models.. Without a model inventory, security teams cannot identify which models exist, making it impossible to manage risk or apply security patches.

Answer

High costs associated with cloud compute resources.

Answer

Incompatibility between the model and the underlying operating system.

Answer

Increased latency in AI model responses.

Question 5

An AI security manager is implementing an AI governance framework using the NIST AI RMF. Which action best demonstrates the 'Govern' function for a new generative AI deployment?

Accepted Answer

Defining roles, responsibilities, and accountability for AI system outcomes.. The 'Govern' function focuses on establishing a culture of risk management, accountability, and organizational processes to manage AI risks.

Answer

Configuring API rate limits in the AI gateway.

Answer

Conducting a red-teaming exercise for prompt injection.

Answer

Performing automated unit testing on model outputs.

Question 6

A multinational bank is deploying a proprietary LLM. Which approach provides the most robust assurance for model supply chain security?

Accepted Answer

Implementing an AI Software Bill of Materials (SBOM).. Software Bill of Materials (SBOM) for AI components is the industry standard for tracking dependencies and vulnerabilities in the AI lifecycle.

Answer

Scanning all model weights using antivirus.

Answer

Reviewing the vendor's marketing brochure.

Answer

Limiting model access via VPN.

Question 7

When managing shadow AI, which strategy is most effective at the enterprise level?

Accepted Answer

Implementing AI-aware API discovery and CASB solutions.. A 'detect and onboard' approach using API discovery tools helps identify and bring unauthorized AI into the managed governance lifecycle.

Answer

Disabling all network access to the internet.

Answer

Ignoring the usage until a breach occurs.

Answer

Sending disciplinary emails to all employees.

Question 8

An AI project is failing to meet its security requirements. Which governance process should be triggered to address this?

Accepted Answer

Risk acceptance or remediation plan initiation.. The AI Risk Acceptance or Remediation process ensures that management formally decides whether to fix the issue or accept the risk, documenting the decision.

Answer

Re-training the model without a review.

Answer

Immediate deletion of all data.

Answer

Ignoring the policy until the end of the year.

Question 9

Which THREE activities help manage 'AI Lifecycle' risk?

Accepted Answer

Pre-deployment design and threat modeling.. Design review, monitoring, and regular decommissioning/sunset reviews cover the start, middle, and end of the lifecycle.

Answer

Ignoring all software updates.

Answer

Bypassing security reviews for speed.

Question 10

When establishing an AI steering committee, which reporting cadence is most effective for ensuring board-level oversight of residual AI risk?

Accepted Answer

Quarterly strategic risk and compliance assessments.. Quarterly reporting aligns with standard enterprise risk management cadences for high-impact emerging technologies.

Answer

Weekly technical incident logs.

Answer

Annual compliance attestation only.

Answer

Real-time dashboard access for all directors.

Question 11

An organization is updating its AI governance policy for high-risk systems. Which TWO requirements should be mandated to ensure accountability and forensic capability?

Accepted Answer

Enabling detailed audit logging of all user prompts and model responses.. Accountability and forensics require audit trails for both model inputs/outputs and human interactions with the system.

Answer

Restricting AI development to specific physical locations.

Answer

Requiring all AI developers to use dual-factor authentication for IDE access.

Answer

Limiting the number of users who can interact with the AI model.

Question 12

Which THREE metrics should be monitored for 'Model Performance' and security?

Accepted Answer

Inference latency.. Drift, latency, and error rates are foundational metrics for system health and security monitoring.

Answer

Number of coffee breaks taken by developers.

Answer

Total cost of electricity.

Question 13

A company is performing an 'AI Impact Assessment' (AIA). Which domain is the most critical for identifying 'Privacy' risks?

Accepted Answer

Data lineage, sensitivity, and processing purpose.. Data processing and consent management are the pillars of AI privacy impact assessments.

Answer

Model training costs.

Answer

UI design features.

Answer

Server CPU utilization.

Question 14

An organization is deploying an AI application that processes PII. The governance policy requires a formal AI impact assessment. Which activity is the most critical first step before model training begins?

Accepted Answer

Executing an automated data lineage audit using Microsoft Purview to verify data provenance.. Data classification and privacy impact assessment must occur before model training to ensure compliance with data governance policies.

Answer

Configuring model weight encryption in the secure vault.

Answer

Setting up a model drift detection dashboard in Azure Machine Learning.

Answer

Performing a sensitivity analysis on model output latency.

Question 15

When conducting an AI audit, what should be the primary focus of the 'Data Governance' review?

Accepted Answer

Data quality, lineage, and access controls.. Data governance ensures that only authorized, high-quality, and compliant data is used for training and inference.

Answer

The model's marketing reach.

Answer

The color of the UI.

Answer

The model creator's salary.