AAISM Practice Exam 1 — 20 Questions

Question 1

An organization is using Google Cloud Vertex AI and suspects an adversarial poisoning attack on a custom training dataset. Which tool should be used to verify the integrity and provenance of the training artifacts?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Vertex AI ML Metadata. Vertex AI Model Garden and Metadata are used for lineage tracking, but specifically for provenance and audit, the Vertex AI ML Metadata service allows tracking of dataset versions and training pipeline execution history.

Answer

Vertex AI Pipelines caching

Answer

Cloud Data Loss Prevention (DLP) API

Answer

Cloud Armor WAF

Question 2

Which of these is a 'Proactive' risk management strategy?

Accepted Answer

Adversarial testing and threat modeling.. Adversarial testing and threat modeling are proactive, as they identify risks before exploitation.

Answer

Shutting down the system after an attack.

Answer

Incident response to a breach.

Answer

Adding more security after a leak is discovered.

Question 3

What is the primary function of an 'AI Steering Committee'?

Accepted Answer

Strategic oversight, prioritization, and risk management.. To set direction, prioritize initiatives, and oversee the AI risk management strategy at the enterprise level.

Answer

Conducting individual performance reviews.

Answer

Writing all the software code.

Answer

To manage daily printer issues.

Question 4

Which THREE practices are necessary for managing 'AI Model Version Control' as part of an overall risk management strategy?

Accepted Answer

Using Git-based tracking for model configuration and code.. Version control ensures reproducibility, rollback capability, and auditability in AI risk management.

Answer

Allowing only one developer to modify the model.

Answer

Storing only the production model artifact.

Question 5

What is 'AI Risk Appetite'?

Accepted Answer

The level of risk an organization is willing to accept.. It is the level of risk the organization is willing to accept in pursuit of its AI-driven business objectives.

Answer

The amount of money spent on GPUs.

Answer

The number of employees using AI.

Answer

The speed of the AI model.

Question 6

A board of directors requests a summary of AI risk exposure. Which metric provides the most relevant insight into AI security program maturity?

Accepted Answer

The percentage of AI models that have completed a formal governance and security certification.. Reporting on the percentage of AI models subjected to formal security and bias audits provides a clear picture of governance coverage.

Answer

The average response time of the AI chatbot interface.

Answer

The total number of GPU hours utilized for model training.

Answer

The total number of AI-related code commits in the CI/CD pipeline.

Question 7

How does 'Continuous Monitoring' differ from 'Point-in-Time Auditing'?

Accepted Answer

Continuous monitoring provides real-time visibility into performance and threats.. Continuous monitoring provides real-time detection of drift or threats, whereas audits are snapshots in time.

Answer

Auditing is only for small companies.

Answer

Monitoring is only for external systems.

Answer

Continuous monitoring is cheaper.

Question 8

What is the primary role of an 'AI Ethics Board' in an organization's governance structure?

Accepted Answer

Reviewing AI use cases against organizational values and principles.. Ethics boards provide guidance on moral and societal implications beyond legal compliance, ensuring alignment with organizational values.

Answer

Directing daily stock market trades.

Answer

Conducting server hardware maintenance.

Answer

Writing all the Python code for the AI.

Question 9

Which THREE factors increase 'AI Model Risk'?

Accepted Answer

High model complexity (black box).. High complexity, lack of interpretability, and critical business impact are the top drivers of AI model risk.

Answer

Using a low-latency network.

Answer

Using a well-documented framework.

Question 10

A security manager is integrating AI governance into the existing NIST AI RMF framework. Which action best ensures alignment between AI security controls and business risk appetite?

Accepted Answer

Establishing a cross-functional AI steering committee to review and approve risk tolerance thresholds for AI use cases.. Mapping AI-specific controls to the organizational risk register ensures that security measures are proportionate to the business impact of AI system failure.

Answer

Deploying automated adversarial attack simulations against all LLM endpoints.

Answer

Implementing a strict zero-trust policy for all internal AI model training datasets.

Answer

Configuring AWS GuardDuty for Amazon Bedrock to monitor for unauthorized API calls.

Question 11

A machine learning model is showing signs of 'data drift'. What is the most effective initial step in the risk assessment process?

Accepted Answer

Analyze the statistical distribution of input production data versus training data.. Data drift monitoring involves comparing current production data distributions against training data distributions to detect performance decay.

Answer

Retrain the model immediately with all available data.

Answer

Shut down the application to prevent incorrect predictions.

Answer

Change the model architecture to a more complex design.

Question 12

A developer is implementing 'Differential Privacy' on a training dataset. What is the primary trade-off they are managing?

Accepted Answer

Privacy budget (epsilon) vs. model utility/accuracy.. Differential privacy adds noise to training data to preserve privacy, which inherently reduces the utility or accuracy of the model.

Answer

Model training speed vs. model cost.

Answer

Security of the training pipeline vs. developer productivity.

Answer

Deployment latency vs. model scalability.

Question 13

Which TWO of the following are considered 'AI Supply Chain' risks?

Accepted Answer

Inclusion of poisoned data in third-party datasets.. AI supply chain risks include dependencies on external data and untrusted pre-trained models.

Answer

Lack of internal developer training.

Answer

Excessive use of cloud storage.

Answer

High turnover of AI research staff.

Question 14

What is 'AI Shadowing' or 'Shadow AI' in an enterprise setting?

Accepted Answer

Employees using unapproved AI tools for work tasks.. Shadow AI refers to the use of AI tools and models by employees without the knowledge or approval of the IT/Security department.

Answer

The practice of monitoring AI usage in real-time.

Answer

The process of testing models before release.

Answer

The use of AI for internal cybersecurity tasks only.

Question 15

Which THREE actions should be included in an AI incident response plan?

Accepted Answer

Conducting a root cause analysis post-incident.. Communication, containment, and root cause analysis are standard requirements for effective incident management.

Answer

Deleting the model without a backup.

Answer

Increasing the marketing budget.

Question 16

Which document should define the organization's stance on AI transparency and explainability?

Accepted Answer

The Corporate AI Policy.. The AI Policy is the foundational document that sets the requirements for transparency, accountability, and explainability across the enterprise.

Answer

The employee breakroom notice.

Answer

The server configuration log.

Answer

The marketing brochure.

Question 17

When a model fails in production, what is the first step in the 'Incident Response' process?

Accepted Answer

Containment and impact assessment.. Identifying and containing the impact is the immediate priority to prevent further risk.

Answer

Writing a press release.

Answer

Firing the developer.

Answer

Ignoring the error.

Question 18

Which THREE security controls are effective against 'Data Leakage' in AI?

Accepted Answer

Data Loss Prevention (DLP) tools.. DLP, access control, and output filtering are the standard triad for preventing sensitive data exposure via AI.

Answer

Using a louder cooling system.

Answer

Increasing the model's training duration.

Question 19

Which mechanism best ensures 'Auditability' of AI decision-making?

Accepted Answer

Maintaining immutable logs of inputs, model versions, and outputs.. Comprehensive logging of inputs, model parameters, and outputs is essential to recreate and audit decisions.

Answer

Deleting logs after 24 hours.

Answer

Using proprietary black-box models only.

Answer

Hardcoding all decisions.

Question 20

Which THREE criteria are essential for evaluating the risk of an AI vendor's 'Model Card'?

Accepted Answer

Disclosure of training data sources.. Model Cards provide transparency regarding intended use, limitations, and performance, which are critical for risk assessment.

Answer

The vendor's annual financial report.

Answer

The number of employees at the vendor.