AAISM Practice Test 3 — 25 Questions

Question 1

What is the purpose of 'AI Model Transparency' in a risk management framework?

Accepted Answer

To enable stakeholders to evaluate model safety and performance.. Transparency allows stakeholders to understand how a model functions, its limitations, and its provenance to ensure accountability.

Answer

To speed up the training process.

Answer

To hide the model architecture from competitors.

Answer

To minimize the number of API calls.

Question 2

What is the best way to manage 'Bias' in an AI system?

Accepted Answer

Perform regular audits and dataset balancing.. Regular auditing and dataset balancing are the most effective ways to identify and mitigate bias in AI systems.

Answer

Ignore the bias until a user complains.

Answer

Change the font on the website.

Answer

Delete all data that has bias.

Question 3

You are assessing a supply chain risk where an AI model uses a pre-trained base model from a third-party hub. Which action most effectively mitigates the risk of model poisoning during the integration phase?

Accepted Answer

Validate the model hash against the vendor's provided checksum manifest.. Verifying the cryptographic hash of the model weights against the provider's manifest ensures integrity before deployment.

Answer

Implement role-based access control for the training pipeline.

Answer

Run a sensitivity analysis on the model output.

Answer

Enable MFA for the model registry access.

Question 4

What is the primary objective of a 'Bias Audit' in an AI risk management program?

Accepted Answer

To identify disparate impacts on protected populations.. Bias audits ensure that AI models do not produce discriminatory outcomes based on protected classes.

Answer

To verify the model meets legal data storage requirements.

Answer

To reduce the cost of model deployment.

Answer

To ensure the model is computationally efficient.

Question 5

What is 'Model Stealing' and why is it considered a security incident?

Accepted Answer

It is the theft of intellectual property via query analysis. Model stealing involves querying a model to extract enough information to replicate its functionality, leading to the loss of proprietary intellectual property.

Answer

It is the slow down of the model due to heavy load

Answer

It is the unauthorized access to the server room

Answer

It is the accidental deletion of model files

Question 6

What is the 'Membership Inference' attack in machine learning?

Accepted Answer

Determining if a specific record was in the training set. This attack determines whether a specific data point was included in the training set, potentially compromising privacy if the data is sensitive.

Answer

Brute forcing the user password

Answer

Adding noise to the output

Answer

Stealing the model's entire weights file

Question 7

Which THREE factors must be included in a 'Model Risk Management' (MRM) policy?

Accepted Answer

Clear model lifecycle stages and governance gates.. A robust MRM policy covers the lifecycle from model development and validation to monitoring and retirement.

Answer

The names of all employees who use the AI.

Answer

A list of all model research papers published by the company.

Question 8

Which TWO factors contribute to 'Model Obsolescence' risk?

Accepted Answer

Availability of superior, more efficient alternatives.. Obsolescence occurs when models become ineffective due to changing data distributions (drift) or superior new models.

Answer

The model has reached its maximum iteration count.

Answer

The training data was encrypted.

Answer

The model is stored on a local server.

Question 9

What is the primary function of an 'AI Firewall' or 'LLM Gateway' in an enterprise AI architecture?

Accepted Answer

To intercept and filter prompts and responses. An LLM gateway acts as a proxy to enforce security policies, redact PII, and prevent prompt injection before requests reach the model.

Answer

To optimize the GPU utilization of the model

Answer

To store model weights in a secure archive

Answer

To automate the labeling of training data

Question 10

What is the primary role of 'Data Encryption at Rest' for AI datasets?

Accepted Answer

Protect data from unauthorized access on storage media. Encryption at rest ensures that even if the storage media is stolen or accessed unauthorized, the data remains unreadable.

Answer

Increase the training speed of the model

Answer

Detect potential poisoning attacks

Answer

Automatically patch model software

Question 11

Which THREE technical controls effectively manage 'Third-Party AI Vendor' risks?

Accepted Answer

Independent verification of the vendor's model performance.. Managing third-party AI risk involves technical validation, contractual oversight, and ongoing monitoring.

Answer

Asking the vendor to delete all their internal logs.

Answer

Requiring all employees to use the vendor's internal Wi-Fi.

Question 12

When establishing a risk management framework for GenAI, which THREE factors should be prioritized to satisfy the NIST AI Risk Management Framework requirements?

Accepted Answer

Continuous monitoring of model performance metrics.. NIST AI RMF prioritizes trustworthiness, safety, and reliability through continuous monitoring and governance.

Answer

Requiring all models to be open-source.

Answer

Implementing a strict 'no external API' policy for all models.

Question 13

What is the primary function of 'IAM' in an AI-driven cloud environment?

Accepted Answer

Manage identities and access to resources. IAM (Identity and Access Management) manages who can perform which actions on which resources (e.g., who can invoke a model).

Answer

Monitor the health of GPU clusters

Answer

Automate data cleaning tasks

Answer

Increase the training speed of models

Question 14

Which TWO actions should be taken when implementing an AI security monitoring strategy in a production environment?

Accepted Answer

Implement automated alerting for anomalous request patterns. Effective monitoring requires both tracking system health and analyzing input/output traffic for malicious patterns.

Answer

Disable all API telemetry to reduce attack surface

Answer

Use a static list of IP addresses for all model access

Answer

Perform daily model retraining regardless of drift

Question 15

Which THREE items should be included in an 'AI Vendor Assessment'?

Accepted Answer

Review of the model transparency/model card documentation.. Vendor assessments must verify security practices, compliance, and model transparency.

Answer

The personal home addresses of all employees.

Answer

The vendor's entire source code repository.

Question 16

Which of the following best describes 'Model Inversion' as a security risk?

Accepted Answer

An attacker probes the model to reconstruct training samples.. Model inversion involves exploiting model outputs to reconstruct the training data, potentially revealing sensitive information.

Answer

The model is overwritten with malicious logic.

Answer

The model becomes unavailable to users.

Answer

The model predicts the wrong output due to noisy inputs.

Question 17

What is the primary risk associated with 'Overfitting' in an AI model?

Accepted Answer

Lack of generalization to unseen data.. Overfitting means the model memorizes the training data rather than generalizing, leading to poor performance on new, unseen data, which is a reliability risk.

Answer

Increased latency in inference.

Answer

The model is too simple to solve the problem.

Answer

The model is too large to be deployed.

Question 18

You are auditing an AI system for 'Model Explainability' (XAI). Why is XAI critical from a risk management perspective?

Accepted Answer

It provides transparency for accountability and bias detection.. Explainability allows organizations to understand the 'why' behind model decisions, essential for regulatory compliance and debugging bias.

Answer

It is required to make the model run faster.

Answer

It encrypts the input data.

Answer

It enables models to train without labels.

Question 19

Which TWO items must be documented in an 'AI Model Card'?

Accepted Answer

Known limitations and failure modes.. Model Cards are meant to document intended use and limitations to ensure transparency.

Answer

The color scheme of the model's website.

Answer

The social security numbers of all developers.

Answer

The hardware purchase receipts.

Question 20

Which of the following describes the purpose of 'Differential Privacy' in a machine learning system?

Accepted Answer

To prevent the identification of individuals in the training data. Differential privacy ensures that an individual's data cannot be inferred from the aggregate model output by injecting statistical noise during training.

Answer

To enable cross-cloud model training

Answer

To allow for better interpretation of model layers

Answer

To ensure the model is faster at inference time