AAISM Practice Test 15 — 15 Questions

Question 1

When onboarding an AI startup vendor, what is the best strategy to manage 'Model Drift'?

Accepted Answer

Including performance and monitoring requirements in the SLA.. Model drift is an ongoing operational risk that manifests after deployment, so the most effective control is a contractual one that obligates the vendor to detect and remediate it. Embedding performance thresholds, drift-detection metrics, retraining cadence, and monitoring/reporting duties into the SLA creates enforceable accountability. This shifts drift management from a hope-based posture to a measurable, auditable service commitment.

Answer

Performing local code reviews.

Answer

Buying more computing power.

Answer

Trusting the vendor's promise of stability.

Question 2

An organization's AI governance office is defining the responsibilities of the first-line, second-line, and third-line functions for AI risk. A newly hired AI risk manager asks which function should independently assess whether the AI governance framework is designed and operating effectively. Which function is responsible?

Accepted Answer

The third line, because internal audit provides independent assurance on the design and operating effectiveness of the governance framework.. In the three-lines model, the first line owns and manages AI risk, the second line defines the framework and monitors compliance, and the third line provides independent assurance on the design and operating effectiveness of the framework. Because the third line is independent of both operating AI systems and defining the framework, it is the function responsible for objective assessment and reporting to the board.

Answer

A joint task force of the first and second lines, because combining operational and risk expertise produces the most accurate assessment.

Answer

The second line, because it defines the AI risk framework and monitors first-line compliance with it.

Answer

The first line, because it owns and operates the AI systems and therefore understands their controls best.

Question 3

An organization is updating its AI governance policy for high-risk systems. Which TWO requirements should be mandated to ensure accountability and forensic capability?

Accepted Answer

Enabling detailed audit logging of all user prompts and model responses.. Option C is correct because enabling detailed audit logging of all user prompts and model responses creates the forensic trail needed to reconstruct what the AI system received and produced, which is essential for incident investigation, root-cause analysis, and demonstrating compliance in high-risk AI governance. Option E is correct because a 'record of authority' that documents the individual responsible for each model's risk decisions establishes explicit accountability, ensuring that risk acceptance and mitigation choices can be traced to a named owner rather than an anonymous team. Options A, B, and D do not belong: restricting development to physical locations (A) is a weak physical-security control that does not provide accountability or forensic evidence, dual-factor authentication for IDE access (B) is a sound access control but authenticates developers rather than recording AI behavior or decision ownership, and limiting the number of users interacting with the model (D) reduces exposure but neither assigns responsibility for risk decisions nor preserves an auditable record of prompts and responses.

Answer

Restricting AI development to specific physical locations.

Answer

Requiring all AI developers to use dual-factor authentication for IDE access.

Answer

Limiting the number of users who can interact with the AI model.

Question 4

What is the goal of an 'AI Security Awareness Program'?

Accepted Answer

To educate employees on AI security risks and safe usage.. An AI Security Awareness Program exists to educate employees about AI-specific security risks — such as prompt injection, data leakage, model misuse, and shadow AI — and to promote safe, policy-compliant usage. Its goal is behavioral and cultural change, not technical implementation or mandating AI adoption.

Answer

To write Python code for everyone.

Answer

To mandate AI usage in all tasks.

Answer

To replace human workers.

Question 5

When a model exhibits 'Hallucinations', what is the best strategy to improve its groundedness and security?

Accepted Answer

Implement Retrieval-Augmented Generation (RAG). Retrieval-Augmented Generation (RAG) grounds model outputs by retrieving relevant, authoritative documents at inference time and injecting them into the prompt context, so the model cites real data instead of fabricating. This directly reduces hallucinations and improves security by constraining responses to vetted knowledge sources, reducing the risk of leaking or inventing sensitive information.

Answer

Restrict access to the model to root users only

Answer

Disable logging to hide hallucinations

Answer

Increase the model's training data volume

Question 6

Which of the following describes 'Model Integrity' risk?

Accepted Answer

The risk of the model weights being maliciously modified.. Model integrity risk is the risk that the model's weights, architecture, or artifacts are tampered with — whether through supply-chain compromise, insider threat, or malicious fine-tuning — so the model behaves differently than intended. This is distinct from data leakage, performance, or adoption risks.

Answer

The risk that the model will be too slow.

Answer

The risk of data being leaked during training.

Answer

The risk that users will stop using the app.

Question 7

Which risk management activity happens during the 'Design' phase of an AI project?

Accepted Answer

Threat modeling and initial risk assessment.. During the Design phase, the team defines architecture, data flows, and trust boundaries, making it the natural point for threat modeling and initial risk assessment. Identifying threats and risks before build avoids costly rework and ensures controls are baked in rather than bolted on. This aligns with secure-by-design and AI risk management frameworks that place risk identification early in the lifecycle.

Answer

User manual writing.

Answer

Hardware installation.

Answer

Full-scale production deployment.

Question 8

What is 'Model Stealing' as a risk?

Accepted Answer

When an attacker extracts the model's parameters/weights.. Model stealing (also called model extraction) is an attack where an adversary queries a deployed model and uses the input-output pairs to train a surrogate model that approximates the target, effectively stealing its parameters or decision behavior. This threatens intellectual property and can enable further attacks like evasion or membership inference.

Answer

When the model is used for a purpose other than intended.

Answer

When the training data is corrupted.

Answer

When a developer quits and takes the code.

Question 9

Which of the following best describes 'Model Inversion' as a security risk?

Accepted Answer

An attacker probes the model to reconstruct training samples.. Model Inversion is a privacy attack in which an adversary repeatedly queries a deployed model and analyzes the input-output relationship to reverse-engineer sensitive details of the training data, potentially reconstructing representative samples or inferring attributes of individuals in the training set. It exploits the fact that ML models memorize statistical patterns (and sometimes specific records) from their training data, leaking that information through predictions and confidence scores.

Answer

The model is overwritten with malicious logic.

Answer

The model becomes unavailable to users.

Answer

The model predicts the wrong output due to noisy inputs.

Question 10

What is the primary function of an 'AI Firewall' or 'LLM Gateway' in an enterprise AI architecture?

Accepted Answer

To intercept and filter prompts and responses. An AI Firewall or LLM Gateway sits between users/applications and the underlying model, acting as an inline policy enforcement point that inspects, filters, and sometimes transforms prompts and responses. Its core purpose is to intercept traffic to block prompt injection, jailbreaks, data leakage, toxic content, and policy violations before they reach the model or the end user.

Answer

To optimize the GPU utilization of the model

Answer

To store model weights in a secure archive

Answer

To automate the labeling of training data

Question 11

Which THREE factors must be included in a 'Model Risk Management' (MRM) policy?

Accepted Answer

Clear model lifecycle stages and governance gates.. Option B is correct because an MRM policy must define the model lifecycle stages (e.g., development, validation, deployment, monitoring, retirement) and the governance gates/approvals required to move between them, ensuring accountability and control. Option D is correct because independent model validation — performed by parties not involved in model development — is a core MRM control to objectively assess conceptual soundness, data quality, and performance before and after deployment. Option E is correct because MRM requires defined quantitative thresholds for model performance and drift (e.g., PSI, KS statistic, accuracy/AUC degradation limits) so that monitoring can trigger remediation, retraining, or decommissioning. Option A is not required because an MRM policy governs models and processes, not an inventory of every individual AI user; user access is handled by separate access-management and training policies. Option C is not required because cataloging published research papers is not a governance control for model risk; MRM focuses on model inventory, validation, monitoring, and controls rather than publication records.

Answer

The names of all employees who use the AI.

Answer

A list of all model research papers published by the company.

Question 12

When using a 'Managed AI API' service, what is the best practice for handling API keys?

Accepted Answer

Store keys in a secure Secrets Manager. Storing API keys in a dedicated Secrets Manager (e.g., AWS Secrets Manager, Azure Key Vault, HashiCorp Vault) is the correct practice because it centralizes secret storage, enforces encryption at rest and in transit, supports fine-grained IAM access control, and enables automatic rotation and audit logging. This decouples credentials from application code, so keys are never exposed in source control, build artifacts, or logs. Managed AI API keys are high-value credentials that can incur cost, leak data, or allow model abuse if compromised, so they must be treated as sensitive secrets with lifecycle management.

Answer

Hardcode keys in the application source code

Answer

Email keys to team members for easy access

Answer

Embed keys in the public Git repository

Question 13

Which TWO of the following are primary security controls for preventing 'Model Inversion' attacks where an adversary attempts to reconstruct training data from model outputs?

Accepted Answer

Implementing 'Differential Privacy' during training. Model inversion attacks exploit a model's outputs to infer sensitive properties of its training data, so the two primary defenses are those that directly limit what any single output can reveal. Option B, implementing Differential Privacy during training, is correct because it injects calibrated noise into the training process (e.g., DP-SGD with a privacy budget epsilon) so that the learned parameters, and thus the outputs, provably depend only weakly on any individual training record, bounding what an adversary can reconstruct. Option C, applying Output Perturbation to model predictions, is correct because adding noise to the returned predictions (e.g., rounding confidence scores or adding Laplace/Gaussian noise) reduces the mutual information between outputs and training data, directly thwarting the iterative querying that inversion attacks rely on. Option A, API Rate Limits, only slows the volume of queries and does not change the information leaked per response, so a patient adversary can still reconstruct data. Option D, VPC Service Controls, is a network perimeter control that restricts data exfiltration across project boundaries but does nothing to limit inference leakage from legitimate model outputs. Option E, Hardware Security Modules, protect cryptographic keys and signing operations, not the statistical privacy of model predictions.

Answer

Setting 'API Rate Limits'

Answer

Enabling 'VPC Service Controls'

Answer

Using 'Hardware Security Modules' (HSM)

Question 14

You need to ensure that a model deployed on AWS ECS is only accessible by authorized microservices. What is the most appropriate network security control?

Accepted Answer

Use AWS Security Groups. AWS Security Groups act as virtual firewalls at the instance/ENI level and control inbound and outbound traffic based on protocol, port, and source/destination. To ensure a model on ECS is only accessible by authorized microservices, you attach a security group to the ECS tasks that allows traffic only from the security groups of those authorized microservices. This provides least-privilege network segmentation without exposing the service publicly.

Answer

Increase the container memory limit

Answer

Enable AWS WAF for all internal traffic

Answer

Use public routing for all endpoints

Question 15

What is the purpose of 'Model Signing' in an MLOps pipeline?

Accepted Answer

To ensure model integrity and non-repudiation. Model signing uses cryptographic signatures (typically via PKI or keyless frameworks like Sigstore) to bind a model artifact to a verified identity, providing both integrity — proving the weights were not altered after signing — and non-repudiation, since only the holder of the private key could have produced the signature. This lets downstream consumers verify provenance before deployment, which is essential for supply chain trust in MLOps.

Answer

To encrypt the model weights at rest

Answer

To restrict access to the model registry

Answer

To increase inference speed