AAISM Practice Test 5 — 25 Questions

Question 1

Which THREE of the following are effective ways to secure the 'ML Pipeline' (MLOps) against supply chain attacks?

Accepted Answer

Use isolated environments for pipeline stages. Securing the pipeline involves code signing, scanning dependencies for vulnerabilities, and using isolated container environments.

Answer

Disable all CI/CD pipeline logging

Answer

Always run the pipeline as a root user

Question 2

Which THREE of the following are common steps in an 'AI Incident Response Plan'?

Accepted Answer

Containment of the affected AI model. Incident response involves identification (detection), containment (isolation), and eradication/recovery, followed by post-incident learning.

Answer

Increasing the model's inference speed

Answer

Replacing all hardware in the data center

Question 3

What is the goal of 'Data Sanitization' before training?

Accepted Answer

Remove PII and malicious data from the training set. Data sanitization removes sensitive information (PII/PHI) and malicious patterns, ensuring that the model does not learn or leak private info.

Answer

Change the file format of the dataset

Answer

Reduce the cloud storage costs

Answer

Increase the number of images in the dataset

Question 4

To monitor for AI security incidents, you are integrating logs from an AI gateway into a SIEM. Which specific field in the request log is most critical for detecting 'Model Denial of Wallet' attacks?

Accepted Answer

usage.total_tokens. Denial of Wallet attacks involve high-cost, high-token-count requests. Monitoring the 'usage.total_tokens' or 'billing_tokens' field is critical for identifying this behavior.

Answer

latency_ms

Answer

request_ip_address

Answer

model_id

Question 5

You are configuring private connectivity for an AI model using AWS PrivateLink. Which component is required to ensure that model inference traffic never traverses the public internet?

Accepted Answer

VPC Interface Endpoint. An interface VPC endpoint (AWS PrivateLink) allows private connectivity to SageMaker endpoints from within a VPC.

Answer

Internet Gateway (IGW)

Answer

Security Group ingress rule

Answer

NAT Gateway

Question 6

What is the role of 'Homomorphic Encryption' in secure AI? (Theoretical concept)

Accepted Answer

Allows computation on encrypted data. Homomorphic encryption allows computation on encrypted data, enabling a provider to train or run a model on data without ever decrypting it.

Answer

Detects malicious prompts

Answer

Manages API user identities

Answer

Compresses the model size

Question 7

Which TWO steps are recommended to secure access to an AI model registry?

Accepted Answer

Implement Role-Based Access Control (RBAC). Access control for registries should follow the principle of least privilege and use identity federation.

Answer

Store registry credentials in plain text configuration files

Answer

Disable audit logging to reduce storage costs

Answer

Allow 'Public' access for all users to promote model sharing

Question 8

You are securing a PyTorch model and want to implement differential privacy to protect the training data. Which library is specifically designed to work with PyTorch for this purpose?

Accepted Answer

Opacus. Opacus is the official PyTorch library for training models with differential privacy.

Answer

TensorFlow Privacy

Answer

Hugging Face Evaluate

Answer

Adversarial Robustness Toolbox (ART)

Question 9

Which THREE security controls are essential for protecting the integrity of the AI model training supply chain?

Accepted Answer

Data provenance and lineage tracking. Supply chain security involves securing the training data, the model architecture, and the software dependencies.

Answer

Hardening the physical security of the server room

Answer

Increasing the number of neurons in the model

Question 10

Which THREE elements are essential components of an effective AI Incident Response Plan?

Accepted Answer

Procedures for model rollback or containment. An AI-specific incident response plan must address the unique nature of AI, including specialized stakeholders and specific technical triggers.

Answer

Physical site evacuation protocols

Answer

Mandatory weekly patching of all OS kernels

Question 11

When evaluating AI 'Bias', which concept must be governed first?

Accepted Answer

Defining the organization's fairness and equity metrics.. Defining fairness metrics is the foundational step before measurement or mitigation can occur.

Answer

Selecting the GPU brand.

Answer

Changing the model font.

Answer

Deleting the training database.

Question 12

Which metric should be used to track 'Data Quality' for AI training?

Accepted Answer

Data accuracy, completeness, and consistency.. Data completeness, accuracy, and representativeness are key metrics for assessing the quality of training sets.

Answer

The server rack temperature.

Answer

The number of emails sent.

Answer

The color of the data icons.

Question 13

Which THREE factors are critical when establishing an AI risk reporting structure for executive leadership?

Accepted Answer

Alignment of AI security posture with corporate risk appetite and strategic goals.. Executive reporting must focus on business impact, risk posture, and compliance with the regulatory landscape.

Answer

The total number of GPUs available in the data center.

Answer

The specific Python libraries used for model training.

Question 14

An organization is using RAG (Retrieval-Augmented Generation). What is the primary governance concern for the retrieved documents?

Accepted Answer

Enforcement of document-level access controls.. Ensuring that retrieved documents are subject to appropriate access controls is critical to prevent data leakage of sensitive or unauthorized information.

Answer

The file size of the documents.

Answer

The font size used in the documents.

Answer

The language of the documents.

Question 15

Which TWO aspects of 'Compliance' must be addressed by an AI governance program?

Accepted Answer

Alignment with applicable legal and regulatory requirements.. Regulatory alignment and contractual commitments are the two pillars of AI compliance.

Answer

Following the latest fashion trends.

Answer

The office building's architecture.

Answer

Selecting the cheapest printer brand.

Question 16

When drafting an AI policy, how should the organization address 'Human-in-the-Loop' (HITL) requirements?

Accepted Answer

Mandate HITL for high-impact or sensitive decision-making processes.. Policy must clearly define decision-making thresholds where automated systems require human intervention to mitigate high-impact risks.

Answer

Require HITL for every single AI inference.

Answer

Delegate HITL requirements to the software development team.

Answer

Exclude HITL to maximize system throughput.

Question 17

In the context of the EU AI Act, what is the 'Provider's' obligation regarding conformity assessments for high-risk AI systems?

Accepted Answer

Ensuring conformity assessment and compliance with technical standards.. Providers must ensure their systems undergo a conformity assessment and bear the CE marking before market entry.

Answer

Self-assessment is prohibited for all high-risk systems.

Answer

Providing a written promise of security.

Answer

Delegating all compliance to the system deployer.

Question 18

What is the primary risk associated with 'Data Poisoning' in an AI governance program?

Accepted Answer

Compromised model integrity and reliability.. Poisoned data compromises the model's integrity and reliability, leading to biased or malicious outputs.

Answer

System uptime improvement.

Answer

Increased cloud storage bills.

Answer

Reduced model file size.

Question 19

During an internal audit of the AI program, it is found that the organization lacks a 'Model Inventory'. What is the most immediate risk to the AI security program?

Accepted Answer

Inability to perform security risk assessments or lifecycle management for shadow AI models.. Without a model inventory, security teams cannot identify which models exist, making it impossible to manage risk or apply security patches.

Answer

High costs associated with cloud compute resources.

Answer

Incompatibility between the model and the underlying operating system.

Answer

Increased latency in AI model responses.

Question 20

An AI security manager is implementing an AI governance framework using the NIST AI RMF. Which action best demonstrates the 'Govern' function for a new generative AI deployment?

Accepted Answer

Defining roles, responsibilities, and accountability for AI system outcomes.. The 'Govern' function focuses on establishing a culture of risk management, accountability, and organizational processes to manage AI risks.

Answer

Configuring API rate limits in the AI gateway.

Answer

Conducting a red-teaming exercise for prompt injection.

Answer

Performing automated unit testing on model outputs.