AAISM Practice Exam 4 — 20 Questions

Question 1

Which THREE technical controls effectively manage 'Third-Party AI Vendor' risks?

Accepted Answer

Independent verification of the vendor's model performance.. Managing third-party AI risk involves technical validation, contractual oversight, and ongoing monitoring.

Answer

Asking the vendor to delete all their internal logs.

Answer

Requiring all employees to use the vendor's internal Wi-Fi.

Question 2

When establishing a risk management framework for GenAI, which THREE factors should be prioritized to satisfy the NIST AI Risk Management Framework requirements?

Accepted Answer

Continuous monitoring of model performance metrics.. NIST AI RMF prioritizes trustworthiness, safety, and reliability through continuous monitoring and governance.

Answer

Requiring all models to be open-source.

Answer

Implementing a strict 'no external API' policy for all models.

Question 3

What is the primary function of 'IAM' in an AI-driven cloud environment?

Accepted Answer

Manage identities and access to resources. IAM (Identity and Access Management) manages who can perform which actions on which resources (e.g., who can invoke a model).

Answer

Monitor the health of GPU clusters

Answer

Automate data cleaning tasks

Answer

Increase the training speed of models

Question 4

Which TWO actions should be taken when implementing an AI security monitoring strategy in a production environment?

Accepted Answer

Implement automated alerting for anomalous request patterns. Effective monitoring requires both tracking system health and analyzing input/output traffic for malicious patterns.

Answer

Disable all API telemetry to reduce attack surface

Answer

Use a static list of IP addresses for all model access

Answer

Perform daily model retraining regardless of drift

Question 5

Which THREE items should be included in an 'AI Vendor Assessment'?

Accepted Answer

Review of the model transparency/model card documentation.. Vendor assessments must verify security practices, compliance, and model transparency.

Answer

The personal home addresses of all employees.

Answer

The vendor's entire source code repository.

Question 6

Which of the following best describes 'Model Inversion' as a security risk?

Accepted Answer

An attacker probes the model to reconstruct training samples.. Model inversion involves exploiting model outputs to reconstruct the training data, potentially revealing sensitive information.

Answer

The model is overwritten with malicious logic.

Answer

The model becomes unavailable to users.

Answer

The model predicts the wrong output due to noisy inputs.

Question 7

What is the primary risk associated with 'Overfitting' in an AI model?

Accepted Answer

Lack of generalization to unseen data.. Overfitting means the model memorizes the training data rather than generalizing, leading to poor performance on new, unseen data, which is a reliability risk.

Answer

Increased latency in inference.

Answer

The model is too simple to solve the problem.

Answer

The model is too large to be deployed.

Question 8

You are auditing an AI system for 'Model Explainability' (XAI). Why is XAI critical from a risk management perspective?

Accepted Answer

It provides transparency for accountability and bias detection.. Explainability allows organizations to understand the 'why' behind model decisions, essential for regulatory compliance and debugging bias.

Answer

It is required to make the model run faster.

Answer

It encrypts the input data.

Answer

It enables models to train without labels.

Question 9

Which TWO items must be documented in an 'AI Model Card'?

Accepted Answer

Known limitations and failure modes.. Model Cards are meant to document intended use and limitations to ensure transparency.

Answer

The color scheme of the model's website.

Answer

The social security numbers of all developers.

Answer

The hardware purchase receipts.

Question 10

Which of the following describes the purpose of 'Differential Privacy' in a machine learning system?

Accepted Answer

To prevent the identification of individuals in the training data. Differential privacy ensures that an individual's data cannot be inferred from the aggregate model output by injecting statistical noise during training.

Answer

To enable cross-cloud model training

Answer

To allow for better interpretation of model layers

Answer

To ensure the model is faster at inference time

Question 11

When a model exhibits 'Hallucinations', what is the best strategy to improve its groundedness and security?

Accepted Answer

Implement Retrieval-Augmented Generation (RAG). RAG (Retrieval-Augmented Generation) forces the model to base its answers on specific, provided documents, reducing hallucination risks.

Answer

Restrict access to the model to root users only

Answer

Disable logging to hide hallucinations

Answer

Increase the model's training data volume

Question 12

When assessing AI third-party vendor risk, which document is most useful for understanding the vendor's data handling practices?

Accepted Answer

The Data Processing Agreement (DPA).. The Data Processing Agreement (DPA) outlines exactly how data is used, stored, and protected.

Answer

The user interface mockups.

Answer

The company's marketing brochure.

Answer

The vendor's quarterly earnings statement.

Question 13

What is 'Model Stealing' as a risk?

Accepted Answer

When an attacker extracts the model's parameters/weights.. Model stealing is the attempt to gain unauthorized access to the underlying weights of a model, often through side-channel attacks or memory scraping.

Answer

When the model is used for a purpose other than intended.

Answer

When the training data is corrupted.

Answer

When a developer quits and takes the code.

Question 14

A model is vulnerable to 'Evasion Attacks' using FGSM (Fast Gradient Sign Method). Which architectural change most effectively increases robustness?

Accepted Answer

Applying Defensive Distillation.. FGSM uses the model's gradients to craft perturbations; defensive distillation or adversarial training helps mask these gradients.

Answer

Increasing the learning rate during training.

Answer

Switching to a larger neural network.

Answer

Implementing input denoising.

Question 15

When evaluating an AI model for production, what does the 'F1 Score' tell you from a risk management perspective?

Accepted Answer

The balance between model precision and recall.. The F1 score provides a balanced view of precision and recall, helping assess the risk of both false positives and false negatives.

Answer

The latency of the model in milliseconds.

Answer

The total number of parameters in the model.

Answer

The total cost of training the model.

Question 16

Which THREE technical configurations help mitigate the risk of 'Model Exfiltration'?

Accepted Answer

Strict IAM policies limiting access to the model weight files.. Model exfiltration can be hindered by restricting access to the model, monitoring egress traffic, and obfuscating model responses.

Answer

Increasing the number of public endpoints.

Answer

Using clear text for all model logs.

Question 17

What is the primary goal of 'Model Monitoring' in the context of risk management?

Accepted Answer

To detect performance degradation, drift, and anomalous behavior.. Continuous monitoring detects anomalies, performance degradation, and drift, which are critical triggers for risk interventions.

Answer

To reduce the cost of GPU usage.

Answer

To block all internet traffic.

Answer

To update the marketing website automatically.

Question 18

In the context of AI governance, what is the primary role of a 'Model Card'?

Accepted Answer

Provide transparency on model capabilities and limitations. A Model Card is a documentation artifact that provides transparency into the model's intended use, limitations, and training data.

Answer

Grant IAM access to the model file

Answer

Enable encryption for the model weights

Answer

Automatically patch the model software

Question 19

Which TWO techniques help mitigate 'Model Poisoning'?

Accepted Answer

Data sanitization and filtering of training inputs.. Defensive techniques like data sanitization and robust aggregation algorithms help mitigate poisoning attempts.

Answer

Increasing the number of neurons in the model.

Answer

Moving the model to a public cloud environment.

Answer

Reducing the number of training epochs.

Question 20

What is 'AI Red Teaming'?

Accepted Answer

Proactive adversarial testing to identify model weaknesses.. AI Red Teaming is a structured process of testing an AI system's safety and security by attempting to find vulnerabilities through adversarial attacks.

Answer

The marketing department's review of AI ads.

Answer

An automated script that changes the model color.

Answer

The process of painting red marks on the server racks.