AAISM Practice Test 24 — 15 Questions

Question 1

A data scientist is preparing to train a model on a dataset that includes personally identifiable information (PII). Before training, they want to reduce the risk of the model memorizing and later leaking PII. Which data preprocessing technique is most appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Data anonymization. Data anonymization directly addresses the privacy risk by removing or altering PII before training, preventing the model from memorizing identifiable information. The other techniques are standard preprocessing steps but do not mitigate privacy concerns.

Answer

Feature scaling

Answer

One-hot encoding

Answer

Data augmentation

Question 2

A company is deploying a machine learning model in a production environment. The security team wants to ensure that if an attacker modifies the model file on disk, the system will detect it before loading the model. Which control should they implement?

Accepted Answer

Model signing. Model signing provides cryptographic integrity verification, ensuring that any modification to the model file is detected before loading. Watermarking proves ownership, encryption ensures confidentiality, and versioning tracks changes but does not verify integrity.

Answer

Model watermarking

Answer

Model versioning

Answer

Model encryption

Question 3

Which TWO areas should be covered by an AI procurement policy?

Accepted Answer

Contractual clauses for data privacy and IP protection.. Option D is correct because an AI procurement policy must address contractual clauses for data privacy and IP protection, ensuring that data used to train or operate AI systems is handled lawfully (e.g., under GDPR or CCPA) and that ownership of models, outputs, and training data is clearly defined. Option E is correct because mandatory security due diligence for AI vendors is essential to assess risks such as model poisoning, data leakage, insecure APIs, and supply-chain vulnerabilities before onboarding a third-party AI service. Options A, B, and C are incorrect because a vendor's logo color, office furniture, and employee headcount are irrelevant to the governance, legal, and security concerns that an AI procurement policy is designed to cover.

Answer

The color of the vendor's logo.

Answer

The vendor's choice of office furniture.

Answer

The number of employees at the vendor.

Question 4

A healthcare insurer is integrating a third-party AI diagnostic triage tool into its claims processing workflow. The AI security manager must ensure the vendor's model updates do not introduce new risks without the insurer's knowledge. Which contractual and technical control is MOST effective for this purpose?

Accepted Answer

Mandating a documented model change management process with advance notification, impact assessment, and insurer approval for material updates.. The core risk is undisclosed or unassessed model updates by a third party. Only a contractual requirement for documented model change management, with advance notification and insurer approval for material changes, provides proactive governance over those updates. SOC 2 reports, audit clauses, and firewalls address adjacent concerns but do not give the insurer timely visibility and control over AI model changes that could alter triage outcomes.

Answer

Deploying a web application firewall in front of the vendor's API to filter malicious inputs.

Answer

Requiring the vendor to provide a SOC 2 Type II report annually.

Answer

Including a right-to-audit clause that allows the insurer to inspect the vendor's development environment on 30 days' notice.

Question 5

A risk manager at a financial services firm is evaluating a third-party large language model (LLM) that will be used for internal knowledge retrieval. The vendor's contract does not specify whether customer prompts and outputs are used for model retraining. Which action BEST addresses the residual risk of confidential data being incorporated into future model versions?

Accepted Answer

Negotiate a contractual no-retraining clause and obtain technical evidence of data isolation.. The residual risk arises from the vendor's unspecified data-retention and retraining practices. Contractual commitments are necessary but must be validated with technical controls such as zero-retention configurations or tenant isolation. Together, they provide assurance that confidential prompts will not be incorporated into future model versions, which is the specific risk the firm needs to manage.

Answer

Deploy the model in a private VPC and rely on network segmentation to prevent data exposure.

Answer

Require the vendor to provide a SOC 2 Type II report and accept the residual risk.

Answer

Implement prompt filtering to redact sensitive entities before sending requests to the model.

Question 6

A multinational bank's AI governance lead is mapping AI systems to regulatory obligations across jurisdictions. The bank uses a single credit-scoring model that is trained in the EU, deployed in the US and Singapore, and fine-tuned locally. Which governance artifact is most critical to maintain so the bank can demonstrate compliance with differing regional AI regulations?

Accepted Answer

A regulatory obligation register mapped to each AI system and its deployment locations. A regulatory obligation register mapped to each AI system and deployment location is the artifact that connects jurisdictional legal requirements to specific model instances, including local fine-tuned variants. It supports evidence of compliance, gap analysis, and change management as regulations evolve, which model cards, DPAs, and penetration tests cannot provide on their own.

Answer

A penetration test report for the model's API endpoints

Answer

A data processing agreement (DPA) with the cloud provider hosting the model

Answer

A model card that documents intended use, training data, and performance metrics

Question 7

You are managing risks for a federated learning deployment. What is the primary security concern regarding the 'model updates' sent from the edge clients to the aggregator?

Accepted Answer

Gradient leakage leading to privacy loss.. In federated learning, edge clients send model updates (e.g., gradients) to a central aggregator. These updates can inadvertently leak sensitive information about the local training data. Gradient leakage attacks can reconstruct original data from gradients, leading to privacy loss. Thus, the primary security concern is privacy leakage from model updates.

Answer

The aggregator becoming a single point of failure.

Answer

Encryption of the communication channel.

Answer

Slow network speeds at the edge.

Question 8

When assessing a third-party AI provider, which document is most essential for due diligence?

Accepted Answer

A SOC 2 Type II audit report.. A SOC 2 Type II audit report is the most essential document for third-party AI due diligence because it independently validates the provider's security, availability, and confidentiality controls over time. It provides assurance that the provider meets industry standards. The other options lack the depth and independence required for risk assessment.

Answer

A public press release.

Answer

A standard company invoice.

Answer

The employee directory.

Question 9

A global bank's AI governance committee is drafting its first enterprise AI policy. The CISO argues that a single 'AI Security Policy' owned by security is sufficient because most AI risk is security risk. The Chief Data Officer counters that the program needs a governing body with cross-functional authority. Which action best establishes durable AI governance accountability for the enterprise?

Accepted Answer

Charter a cross-functional AI governance board with an executive sponsor, a defined decision-rights matrix, and a standing reporting cadence to the board of directors.. Durable AI governance accountability comes from a chartered, cross-functional body with an executive sponsor, documented decision rights, and a reporting cadence to the board. This structure ensures every AI risk domain has an accountable owner and that trade-offs are adjudicated rather than defaulting to one function. Policies and attestations are supporting artifacts, not substitutes for governance infrastructure, and decentralized self-governance fragments accountability.

Answer

Delegate all AI governance decisions to the CISO and require quarterly security metrics to be the sole input to the risk committee.

Answer

Assign each business unit to govern its own AI systems independently and report only material incidents to the CISO after remediation is complete.

Answer

Publish an AI acceptable use policy signed by the CEO and rely on annual employee attestation to enforce compliance across business units.

Question 10

Which control is most effective against 'Prompt Injection' attacks?

Accepted Answer

Using a secure AI Gateway with input filtering.. Prompt injection attacks manipulate an LLM by embedding malicious instructions in user input or external data, causing the model to execute unintended actions. A secure AI Gateway with input filtering inspects and sanitizes prompts before they reach the model, blocking known injection patterns (e.g., 'ignore previous instructions') and enforcing policy. This is a preventive, architectural control that directly addresses the attack vector, unlike the other options which are either irrelevant or impractical.

Answer

Adding more training data.

Answer

Requiring a longer password.

Answer

Disabling the internet.

Question 11

What is the primary objective of a 'Bias Audit' in an AI risk management program?

Accepted Answer

To identify disparate impacts on protected populations.. A bias audit's primary objective is to identify disparate impacts on protected populations — that is, to measure whether the model produces systematically different outcomes for groups defined by race, gender, age, or other protected attributes. It uses fairness metrics such as demographic parity, equalized odds, and disparate impact ratio to surface such disparities. This is a fairness and non-discrimination control, not a storage, cost, or performance exercise.

Answer

To verify the model meets legal data storage requirements.

Answer

To reduce the cost of model deployment.

Answer

To ensure the model is computationally efficient.

Question 12

A financial institution uses a machine learning model to approve loan applications. The model was trained on historical data that includes sensitive attributes such as race and gender. An internal audit reveals that the model's decisions disproportionately deny loans to certain demographic groups, even after removing those attributes from the training data. Which technique should the security team implement to detect and mitigate this issue?

Accepted Answer

Apply fairness-aware machine learning techniques such as adversarial debiasing or reweighting to adjust the model's training process.. The scenario describes a model exhibiting disparate impact despite removal of sensitive attributes, indicating bias through proxy features. Fairness-aware machine learning techniques like adversarial debiasing or reweighting are designed to mitigate such bias by adjusting the training process. Other options like SHAP values help detect bias but do not mitigate it, while differential privacy and watermarking are unrelated to fairness.

Answer

Implement differential privacy during training to ensure individual data points cannot be inferred.

Answer

Use SHAP (SHapley Additive exPlanations) values to interpret model predictions and identify biased features.

Answer

Use model watermarking to embed ownership information and track unauthorized use.

Question 13

You are assessing a supply chain risk where an AI model uses a pre-trained base model from a third-party hub. Which action most effectively mitigates the risk of model poisoning during the integration phase?

Accepted Answer

Validate the model hash against the vendor's provided checksum manifest.. Validating the model hash against the vendor's checksum manifest is correct because it cryptographically verifies that the artifact received matches the artifact the vendor published, detecting tampering or substitution during download and integration. Model poisoning often occurs when an attacker swaps or modifies weights in transit or in the hub; a hash check catches any byte-level change. This is an integrity control applied at the point of ingestion, which is exactly where supply-chain poisoning is introduced.

Answer

Implement role-based access control for the training pipeline.

Answer

Run a sensitivity analysis on the model output.

Answer

Enable MFA for the model registry access.

Question 14

A security team is evaluating an AI-based malware detection system that uses a deep neural network. They want to test whether small, carefully crafted perturbations to malicious files can cause the model to misclassify them as benign. Which type of attack should they simulate?

Accepted Answer

Evasion attack. The scenario describes testing whether small perturbations to malicious files can cause misclassification at inference time. This is the definition of an evasion attack. Poisoning attacks target training data, model inversion aims to extract training data, and membership inference determines if a record was in the training set. Only an evasion attack matches the described goal of causing misclassification through input perturbations.

Answer

Membership inference attack

Answer

Poisoning attack

Answer

Model inversion attack

Question 15

When utilizing the 'Adversarial Robustness Toolbox' (ART) to defend against evasion attacks, which attack type is specifically mitigated by using 'Adversarial Training'?

Accepted Answer

Evasion attacks. Adversarial Training is a defense specifically designed to mitigate evasion attacks by augmenting the training set with adversarial examples so the model learns to classify perturbed inputs correctly. The Adversarial Robustness Toolbox (ART) implements this defense to improve robustness against evasion, where an attacker crafts inputs at inference time to cause misclassification. It does not directly address model inversion, model theft, or supply chain attacks.

Answer

Model Inversion attacks

Answer

Model Theft attacks

Answer

Supply Chain attacks