AAISM Practice Test 2 — 25 Questions

Question 1

What is the primary role of 'Model Versioning' in AI governance?

Accepted Answer

To ensure reproducibility and enable rollback of problematic versions.. Versioning ensures that changes to the model can be tracked, reverted, and audited, which is vital for reproducibility and risk control.

Answer

To automate user login.

Answer

To maximize server storage usage.

Answer

To hide model architecture from hackers.

Question 2

Which THREE technical controls are recommended to secure an AI model's API endpoint?

Accepted Answer

Enforcing strict schema validation on all inputs.. Securing AI APIs requires defense-in-depth including rate limiting, authentication, and input sanitization.

Answer

Encrypting the model weights at rest in the cloud.

Answer

Removing all logging to prevent log injection.

Question 3

What is the most effective control to prevent 'Model Scraping' from an exposed AI prediction API?

Accepted Answer

Implement tiered access and rate limiting.. Rate limiting and request authentication are the standard controls to prevent automated extraction of model knowledge.

Answer

Require users to sign a Terms of Service agreement.

Answer

Increase the complexity of the model.

Answer

Use an obfuscated model file name.

Question 4

You are assessing the risk of 'Data Poisoning'. Which stage of the machine learning lifecycle is most vulnerable to this attack?

Accepted Answer

Training data collection and ingestion.. Data poisoning occurs during the training data ingestion phase, where malicious samples are injected into the training set.

Answer

The model design and architecture selection.

Answer

Model monitoring and logging.

Answer

Inference and deployment.

Question 5

What is the goal of an 'AI Security Awareness Program'?

Accepted Answer

To educate employees on AI security risks and safe usage.. To ensure all staff understand the risks of AI, including prompt injection, data leakage, and ethical pitfalls.

Answer

To write Python code for everyone.

Answer

To mandate AI usage in all tasks.

Answer

To replace human workers.

Question 6

Which TWO factors are critical when assessing the risk of a new Generative AI use case?

Accepted Answer

The potential business impact if the system fails.. Business impact and data sensitivity are the foundational elements for risk assessment in AI.

Answer

The aesthetic of the user interface.

Answer

The office location of the developers.

Answer

The programming language used.

Question 7

Which TWO activities ensure 'AI Safety' in development?

Accepted Answer

Adversarial testing (red teaming).. Adversarial testing and rigorous documentation are key safety practices.

Answer

Using unmonitored cloud servers.

Answer

Increasing the amount of public data used.

Answer

Removing all encryption.

Question 8

Which THREE documents are vital for an AI audit trail?

Accepted Answer

Model validation and testing reports.. Model version, training set, and validation report are the three pillars of a reconstructible audit trail.

Answer

The office lease agreement.

Answer

A copy of the employee handbook.

Question 9

When using a 'Managed AI API' service, what is the best practice for handling API keys?

Accepted Answer

Store keys in a secure Secrets Manager. API keys should never be hardcoded; they should be stored in secrets managers like AWS Secrets Manager or Azure Key Vault.

Answer

Hardcode keys in the application source code

Answer

Email keys to team members for easy access

Answer

Embed keys in the public Git repository

Question 10

Which tool is best for managing 'Secrets' (like database passwords or API keys) used by your AI training pipeline?

Accepted Answer

HashiCorp Vault. Secrets management services (AWS Secrets Manager, HashiCorp Vault) are the secure way to manage credentials.

Answer

Hardcoded variables in the training script

Answer

A public Github repository

Answer

An Excel spreadsheet on a shared drive

Question 11

Which TWO of the following are primary risks associated with 'membership inference attacks' against an AI model?

Accepted Answer

Exposure of sensitive information about training data subjects.. Membership inference attacks aim to determine if a specific data point was used in the training set, risking privacy leakage.

Answer

Unauthorized modification of model weights.

Answer

Unauthorized access to the model training algorithm.

Answer

Complete system shutdown via resource exhaustion.

Question 12

What is the purpose of 'AI Model Inventory'?

Accepted Answer

To provide a central list of all AI assets for risk oversight.. An inventory tracks all models in production to ensure they are managed, monitored, and reviewed according to organizational policy.

Answer

To increase the speed of the training pipeline.

Answer

To reduce the number of GPUs used.

Answer

To automatically retrain all models.

Question 13

Which TWO components are essential for a robust AI Governance framework?

Accepted Answer

Defined roles and accountability structures.. Policies and clearly defined roles are the foundation of any governance system.

Answer

The company party schedule.

Answer

A list of all employee names.

Answer

The best-selling AI books.

Question 14

Which THREE items should be included in an 'AI Inventory'?

Accepted Answer

Unique model identifier and version.. Model version, owner, and risk rating are the core pieces of information needed to manage an AI portfolio.

Answer

The model's favorite color.

Answer

The developer's favorite food.

Question 15

An organization is using an LLM-based agent. What is the primary risk associated with 'indirect prompt injection' in this environment?

Accepted Answer

External data retrieved by the agent contains instructions that override system prompts.. Indirect prompt injection occurs when malicious data is embedded in a retrieved document that instructs the LLM to perform unintended actions.

Answer

The model produces hallucinatory facts.

Answer

The API key for the LLM is exposed in the code.

Answer

The training data includes PII of users.

Question 16

Which THREE components are critical for an 'AI Incident Response' plan?

Accepted Answer

Communication channels with data scientists and legal teams.. An AI IR plan must account for model-specific issues like unexpected performance drops, bias, and adversarial attacks.

Answer

Requirements to publish all internal vulnerabilities publicly.

Answer

Automated deletion of all logs.

Question 17

Which of the following describes 'Model Integrity' risk?

Accepted Answer

The risk of the model weights being maliciously modified.. Model integrity risk refers to the potential for the model to be altered or behave in an unauthorized way, such as through poisoning or unauthorized weight updates.

Answer

The risk that the model will be too slow.

Answer

The risk of data being leaked during training.

Answer

The risk that users will stop using the app.

Question 18

An organization is performing threat modeling for a RAG (Retrieval-Augmented Generation) pipeline. Which specific vulnerability is unique to the retrieval component?

Accepted Answer

Database poisoning within the retrieved document index.. In RAG, if the search or retrieval index is manipulated, the LLM will generate answers based on attacker-supplied context.

Answer

Overfitting of the LLM on the training set.

Answer

Gradient-based evasion attacks on the LLM.

Answer

Prompt injection targeting the LLM model weights.

Question 19

A firm is drafting a policy for 'AI Use in Marketing'. Which element is most important to include to ensure alignment with existing data protection regulations?

Accepted Answer

Mandatory disclosure requirements when content is generated by AI.. Ensuring the AI system complies with transparency and privacy requirements (like GDPR) is foundational to AI governance policy.

Answer

A mandate to use only open-source AI models.

Answer

A list of all approved GPU hardware vendors.

Answer

The specific programming languages authorized for AI development.

Question 20

Which THREE elements are essential for 'AI Governance'?

Accepted Answer

Defined AI ethics and safety policies.. AI governance requires clear policies, oversight committees, and defined risk frameworks.

Answer

Access to all employees' private emails.

Answer

A mandate to use the most expensive GPUs available.