AAISM Practice Test 20 — 15 Questions

Question 1

A security team is evaluating controls to protect an AI model from model extraction attacks, where an adversary attempts to replicate the model's functionality by querying its API. Which two controls are most effective for mitigating this risk? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Rate limiting and query throttling to restrict the number of API calls per user.. Rate limiting and query throttling directly constrain the attacker's ability to query the model extensively, while monitoring API queries for extraction patterns enables early detection and response. Together, they form a strong defense against model extraction by making it difficult and risky for attackers to gather sufficient data to replicate the model.

Answer

Encrypting the model's API responses to prevent interception.

Answer

Implementing differential privacy during model training to obfuscate decision boundaries.

Answer

Watermarking model outputs to detect unauthorized replication.

Question 2

A hospital's AI governance committee is deciding how to treat a vendor-supplied diagnostic model that flags possible intracranial hemorrhage on CT scans but only reports a single binary output with no confidence score. Clinicians have already overridden the tool several times, and two misses have been logged. The committee wants the residual risk to be formally owned rather than absorbed silently by the radiology department. Which action best satisfies that objective?

Accepted Answer

Register the model in the AI inventory and assign a named accountable owner who must review override and miss data at a defined cadence and record accept-or-mitigate decisions.. Residual risk in AI systems must be explicitly owned, not left to the operators closest to the output. Because this vendor model exposes no confidence score, override and miss data are the primary signal of degradation, and only an accountable owner with a defined review cadence can convert that signal into documented accept, mitigate, or retire decisions. The other actions either tune or study the model without establishing ownership.

Answer

Increase the model's decision threshold so that fewer positive cases are surfaced, reducing the volume of alerts clinicians must evaluate.

Answer

Reclassify the model as a clinical decision support aid in the risk register so that clinical staff remain solely responsible for final interpretation.

Answer

Commission a retrospective validation study comparing the model's outputs against radiologist reads to quantify its error rate before any further deployment.

Question 3

A healthcare insurer has deployed an AI claims-triage model. Six months after launch, the model's denial rate for one demographic has drifted upward while overall accuracy remains stable. The AI program manager needs to detect and respond to this issue as part of ongoing AI governance. Which control is most appropriate?

Accepted Answer

Implement continuous post-deployment monitoring with disaggregated performance metrics by protected group and defined thresholds that trigger review or rollback.. The scenario describes demographic performance drift hidden by stable aggregate accuracy, which only disaggregated, continuous monitoring can detect. Defining thresholds in advance converts detection into action, enabling review, retraining, or rollback. Pre-deployment validation, blanket manual review, and annual revalidation all fail to provide timely, subgroup-level detection and response, which is the core governance requirement for a live high-impact model.

Answer

Re-run the pre-deployment validation test suite and confirm the model still passes its original acceptance thresholds.

Answer

Increase the human review rate for all denied claims from ten percent to one hundred percent and pause model retraining indefinitely.

Answer

Document the drift in the model risk register and schedule a comprehensive model revalidation for the next annual review cycle.

Question 4

When conducting a risk assessment for an AI system, which TWO of the following are considered 'AI System' components that require individual threat assessment?

Accepted Answer

The training and inference data pipelines.. Option A is correct because the training and inference data pipelines are core AI System components: they ingest, transform, and serve the data the model learns from and acts on, so threats such as data poisoning, tampering, or pipeline compromise must be assessed individually. Option D is correct because the model artifact and its weights constitute the trained model itself, and threats like model theft, weight tampering, backdoor insertion, or adversarial manipulation require dedicated assessment. Options B, C, and E are not AI System components: physical office building security, developers' personal devices, and internal organizational culture are general environmental, endpoint, or human/organizational factors that may influence overall risk but are not part of the AI system's technical architecture requiring component-level threat assessment.

Answer

The physical office building security.

Answer

The personal devices of the developers.

Answer

The internal organizational culture.

Question 5

A company is using a third-party pre-trained large language model (LLM) via an API for generating marketing content. The security team wants to ensure that the model does not inadvertently generate content that violates company policy or leaks sensitive information. Which control should be implemented?

Accepted Answer

Implement an output filtering layer that scans generated content for policy violations and sensitive data.. Output filtering is the most effective control because it directly inspects and blocks generated content that violates policy or contains sensitive information. It works with any third-party LLM API and can be customized to enforce specific rules. This control provides a consistent enforcement layer independent of the model's training or behavior.

Answer

Use a smaller, locally hosted model instead of the third-party API.

Answer

Require users to sign an acceptable use policy before accessing the LLM.

Answer

Fine-tune the LLM on company-specific data to align its outputs with policy.

Question 6

You are configuring private connectivity for an AI model using AWS PrivateLink. Which component is required to ensure that model inference traffic never traverses the public internet?

Accepted Answer

VPC Interface Endpoint. A VPC Interface Endpoint (powered by AWS PrivateLink) creates an elastic network interface with a private IP address in your subnet that serves as an entry point for traffic destined to the AWS service or your own endpoint service. Because the endpoint is reachable only via private IPs inside the VPC, model inference requests are routed over the AWS private backbone and never traverse the public internet. This is the defining characteristic of PrivateLink connectivity.

Answer

Internet Gateway (IGW)

Answer

Security Group ingress rule

Answer

NAT Gateway

Question 7

A security engineer is deploying a real-time fraud detection model that processes customer transaction data. The model was trained on historical data that included a temporary promotional period with unusually high transaction volumes. The engineer notices that during the promotion, the model's false positive rate spiked dramatically, flagging many legitimate transactions as fraudulent. Post-promotion, performance returned to normal. Which AI-specific control should the engineer prioritize to prevent similar future incidents?

Accepted Answer

Implement drift detection to monitor changes in input data distribution and trigger retraining when drift exceeds a threshold.. The scenario describes a distributional shift in input data due to a promotional period, leading to model performance degradation. Drift detection is the AI-specific control that monitors for such changes and enables timely intervention, such as retraining. Other controls like differential privacy, input validation, or adversarial training do not directly address natural data drift and would not prevent the false positive spike.

Answer

Enforce strict input validation to reject transactions that fall outside the historical range.

Answer

Apply differential privacy during model training to reduce the model's sensitivity to individual transactions.

Answer

Use adversarial training to make the model robust against malicious inputs.

Question 8

In the context of the EU AI Act, what is the 'Provider's' obligation regarding conformity assessments for high-risk AI systems?

Accepted Answer

Ensuring conformity assessment and compliance with technical standards.. Under the EU AI Act, the Provider (the entity that develops or places a high-risk AI system on the market) bears the primary obligation to ensure the system undergoes a conformity assessment and complies with the applicable technical standards before market placement. This includes maintaining technical documentation, a quality management system, and a declaration of conformity, and affixing the CE marking. The obligation cannot be shifted to the deployer.

Answer

Self-assessment is prohibited for all high-risk systems.

Answer

Providing a written promise of security.

Answer

Delegating all compliance to the system deployer.

Question 9

You are implementing 'Red Teaming' for a Large Language Model (LLM). What is the main objective of this exercise?

Accepted Answer

Proactively identify safety and security vulnerabilities. The main objective of red teaming an LLM is to proactively identify safety and security vulnerabilities before adversaries exploit them. Red teaming involves adversarial testing—crafting prompts designed to bypass guardrails, elicit harmful outputs, or extract sensitive information—to uncover weaknesses that can then be remediated. It is a defensive exercise focused on discovery, not on model improvement or cost reduction.

Answer

Train the model on new, proprietary datasets

Answer

Reduce the cost of API inference

Answer

Increase the accuracy of the model's predictions

Question 10

What is the role of 'Homomorphic Encryption' in secure AI? (Theoretical concept)

Accepted Answer

Allows computation on encrypted data. Homomorphic encryption allows computations to be performed directly on encrypted data without decrypting it first, producing an encrypted result that, when decrypted, matches the result of the same computation on the plaintext. In secure AI, this enables model inference or training on sensitive data while the data remains encrypted end-to-end, protecting privacy even from the compute provider. This is the defining property of homomorphic encryption.

Answer

Detects malicious prompts

Answer

Manages API user identities

Answer

Compresses the model size

Question 11

An organization is using RAG (Retrieval-Augmented Generation). What is the primary governance concern for the retrieved documents?

Accepted Answer

Enforcement of document-level access controls.. In a RAG architecture, the retrieval layer pulls documents from external sources (vector stores, wikis, SharePoint, databases) and injects their content into the LLM's context window. The primary governance concern is ensuring that the retrieval mechanism enforces the same document-level access controls (ACLs) that apply in the source system, so a user cannot receive an answer synthesized from documents they are not authorized to read. Without this, RAG becomes a privilege-escalation and data-exfiltration channel that bypasses existing permissions.

Answer

The file size of the documents.

Answer

The font size used in the documents.

Answer

The language of the documents.

Question 12

An organization's AI governance committee is revising its AI risk taxonomy. The Chief Risk Officer wants to ensure that risks arising from third-party foundation model APIs are captured distinctly from risks of internally developed models. Which change to the taxonomy best achieves this?

Accepted Answer

Add a 'Model Provenance' dimension that classifies each AI system by whether its underlying model is externally sourced, internally trained, or fine-tuned from an external base.. The CRO wants third-party foundation model API risk separated from internally developed model risk. A provenance dimension accomplishes this by tagging each AI system with how its model was obtained, allowing risk assessors to apply specific controls for external dependencies such as vendor model updates, contractual data handling, and upstream bias. The other options either distort scores, collapse AI risk into generic vendor risk, or apply uniform treatment.

Answer

Create a separate 'Vendor Management' risk category and move all AI systems procured from third parties into it.

Answer

Increase the likelihood rating of all AI systems that use any external API by a fixed factor of two.

Answer

Require every AI system to undergo a full security assessment regardless of whether the model is internal or external.

Question 13

Which THREE actions should be included in an AI incident response plan?

Accepted Answer

Conducting a root cause analysis post-incident.. Option C (Conducting a root cause analysis post-incident) is correct because an AI incident response plan must include a post-incident review to determine why the failure occurred—such as data drift, model poisoning, or prompt injection—so controls can be improved and recurrence prevented. Option D (Isolating the affected AI system from production) is correct because containment is a core incident response step; quarantining the model, API endpoint, or inference pipeline prevents further harmful outputs, data leakage, or downstream impact while investigation proceeds. Option E (Notifying relevant stakeholders of the incident) is correct because timely communication to security, legal, compliance, affected users, and regulators is required for transparency, regulatory obligations, and coordinated remediation. Option A (Deleting the model without a backup) is not appropriate because destroying evidence and the model artifact prevents forensic analysis, rollback, and root cause investigation. Option B (Increasing the marketing budget) is unrelated to incident response and does nothing to contain, assess, or remediate an AI incident.

Answer

Deleting the model without a backup.

Answer

Increasing the marketing budget.

Question 14

A global retailer's AI program office is defining how AI risks will be escalated. The Chief Risk Officer wants assurance that a severe AI incident, such as a customer-facing model producing discriminatory pricing, reaches executive leadership within hours rather than days. Which element of the AI risk reporting structure is most critical to meet this requirement?

Accepted Answer

Predefined severity classification criteria with explicit escalation triggers and time-bound notification paths to executive leadership. Rapid escalation depends on agreed severity thresholds and pre-built notification paths with target times. Dashboards, audits, and inventories are valuable governance artifacts, but none of them ensures a severe incident reaches executives within hours. Predefined triggers remove ambiguity and delay at the moment of crisis.

Answer

An annual third-party audit of AI model fairness and bias testing procedures

Answer

A centralized AI model inventory listing owners, versions, and deployment environments

Answer

A quarterly AI risk dashboard summarizing model performance metrics across all business units

Question 15

A government agency is deploying an AI system for facial recognition in public spaces. The security team must ensure that the system complies with privacy regulations and minimizes the risk of unauthorized surveillance. Which control is most appropriate for this scenario?

Accepted Answer

Implement on-device processing that only stores anonymized feature vectors instead of raw images.. On-device processing with anonymized feature vectors is the most appropriate control because it minimizes the collection and storage of sensitive biometric data. By processing locally and discarding raw images, the system reduces the risk of unauthorized surveillance and helps comply with privacy regulations that mandate data minimization and purpose limitation.

Answer

Use a cloud-based facial recognition API with strong encryption for data in transit and at rest.

Answer

Regularly audit the facial recognition model for bias and accuracy.

Answer

Obtain consent from all individuals entering the public space before processing their faces.