AAISM Practice Test 13 — 15 Questions

Question 1

When assessing a third-party AI provider, which document is most essential for due diligence?

Accepted Answer

A SOC 2 Type II audit report.. The System and Organization Controls (SOC) 2 Type II report provides independent assurance of the vendor's security and privacy controls.

Answer

A public press release.

Answer

A standard company invoice.

Answer

The employee directory.

Question 2

Which control is most effective against 'Prompt Injection' attacks?

Accepted Answer

Using a secure AI Gateway with input filtering.. Implementing input sanitization and output filtering via an AI Gateway is a standard defensive control.

Answer

Adding more training data.

Answer

Requiring a longer password.

Answer

Disabling the internet.

Question 3

When onboarding an AI startup vendor, what is the best strategy to manage 'Model Drift'?

Accepted Answer

Including performance and monitoring requirements in the SLA.. Contractual requirements for monitoring reports and incident notifications force the vendor to maintain model performance standards.

Answer

Performing local code reviews.

Answer

Buying more computing power.

Answer

Trusting the vendor's promise of stability.

Question 4

An enterprise is defining its 'AI System Inventory'. Which metadata attribute is most critical for assessing legal and regulatory risk?

Accepted Answer

Training data source and provenance.. Data origin and provenance are critical for determining compliance with GDPR, AI Act, and intellectual property requirements.

Answer

Hardware acceleration type.

Answer

Inference latency in milliseconds.

Answer

Model training compute cost.

Question 5

Which metric is most appropriate for reporting the 'AI Security Posture' to the board?

Accepted Answer

Percentage of AI systems with completed risk assessments.. Percentage of models with completed risk assessments provides a clear indicator of governance coverage across the enterprise.

Answer

Number of GPU hours consumed.

Answer

Average model inference accuracy.

Answer

Total number of model versions created.

Question 6

Who is ultimately responsible for the outcomes of an AI system deployed by a business unit?

Accepted Answer

The Business Unit Leader.. The Business Owner or designated executive holds accountability for the system's performance, risk, and compliance.

Answer

The Cloud Service Provider.

Answer

The external auditor.

Answer

The junior data scientist.

Question 7

Which TWO strategies are recommended for 'Human-in-the-Loop' governance?

Accepted Answer

Standardizing workflows for human intervention.. Standardizing the process and defining the specific decision points are key governance strategies.

Answer

Using only AI for all HR decisions.

Answer

Allowing humans to override without logging.

Answer

Removing humans to save money.

Question 8

A company is adopting the ISO/IEC 42001 AI management system standard. What is the primary purpose of the 'Context of the Organization' clause?

Accepted Answer

To define the boundaries and strategic intent of the AI management system.. This clause requires the organization to identify internal and external issues, stakeholder requirements, and the scope of the AIMS.

Answer

To specify hardware requirements for training.

Answer

To mandate the use of cloud-based AI services.

Answer

To identify all bugs in the production code.

Question 9

A company is developing an internal LLM-based tool. Which activity is required for 'Accountability'?

Accepted Answer

Maintaining a log of model development and decision-making.. Documenting the training data, model parameters, and design decisions is necessary to hold the developers and owners accountable.

Answer

Deleting all documentation.

Answer

Limiting access to the CEO.

Answer

Outsourcing to a third party.

Question 10

What is the benefit of 'AI Model Watermarking' for governance?

Accepted Answer

Facilitating identification and provenance of AI-generated content.. Watermarking assists in identifying synthetic content, which is crucial for provenance and combating misinformation.

Answer

Improving model prediction speed.

Answer

Preventing unauthorized hardware usage.

Answer

Reducing model memory footprint.

Question 11

Which department should own the 'AI Ethics Policy'?

Accepted Answer

Compliance/Legal or Ethics Office.. Compliance or Legal usually own ethics policy, in coordination with executive leadership, to ensure corporate alignment.

Answer

The IT helpdesk.

Answer

The cafeteria management.

Answer

The building security team.

Question 12

An AI security lead is configuring a 'Model Risk Management' (MRM) framework. What is the main objective of a 'Model Validation' report?

Accepted Answer

To provide independent verification of model performance and risk mitigation effectiveness.. Validation provides independent verification that the model performs as expected within its defined scope and limitations.

Answer

To market the model to external customers.

Answer

To reduce the model development time.

Answer

To guarantee 100% accuracy in all scenarios.

Question 13

An organization is implementing 'Red Teaming' for AI. What is the main governance objective?

Accepted Answer

To proactively identify vulnerabilities and failure modes.. Red teaming identifies vulnerabilities and threat vectors to proactively improve the resilience of the AI system.

Answer

To reduce operational costs.

Answer

To speed up deployment.

Answer

To increase the model size.

Question 14

How should an organization classify AI systems for governance?

Accepted Answer

By the potential impact on safety, privacy, and business operations.. Risk-based classification (e.g., low, medium, high) allows the organization to allocate resources proportional to potential impact.

Answer

By the programming language used.

Answer

By the number of developers assigned.

Answer

By the date of deployment.

Question 15

Which scenario best illustrates an 'AI Security Incident'?

Accepted Answer

Unauthorized access to the model training weights.. An unauthorized model modification or data extraction is a clear security event requiring response.

Answer

The AI system running slower than usual.

Answer

A scheduled server maintenance window.

Answer

A user simply disliking the AI output.