AAISM Practice Test 5 — 25 Questions

Question 1

To monitor for AI security incidents, you are integrating logs from an AI gateway into a SIEM. Which specific field in the request log is most critical for detecting 'Model Denial of Wallet' attacks?

Accepted Answer

usage.total_tokens. Model Denial of Wallet attacks aim to drive up inference costs by forcing the model to process excessive tokens, so the total token count in the request log is the most direct indicator of financial impact. Monitoring usage.total_tokens per request, per user, or per API key reveals abnormal consumption patterns that signal an attack. Other fields like latency or IP address are useful context but do not directly measure cost.

Answer

latency_ms

Answer

request_ip_address

Answer

model_id

Question 2

When securing a large language model (LLM) using the OWASP Top 10 for LLMs, which control is most effective against 'Insecure Output Handling'?

Accepted Answer

Enforcing strict output validation and sanitization. Insecure Output Handling occurs when LLM output is passed to downstream systems (browsers, shells, databases, other APIs) without validation, enabling XSS, SSRF, command injection, or SQLi via crafted model responses. The most effective control is to treat all model output as untrusted user input and enforce strict output validation and sanitization before it reaches any sink. This directly neutralizes the injection vector regardless of what the model produces.

Answer

Using fine-grained RBAC

Answer

Implementing Rate Limiting

Answer

Encrypting training data

Question 3

When dealing with 'Adversarial Evasion', why is the 'black-box' nature of an API a risk?

Accepted Answer

Because it allows attackers to build surrogate models via iterative querying.. A black-box API exposes only inputs and outputs, so an attacker can iteratively query it to train a surrogate model that approximates the target's decision boundary. This surrogate then enables transferable adversarial examples — inputs crafted on the substitute that also fool the original model. The opacity that protects the model's internals simultaneously provides the query access needed for model extraction and evasion.

Answer

Because it makes the model impossible to update.

Answer

Because it prevents log auditing.

Answer

Because it forces the use of HTTPS.

Question 4

What is the primary risk associated with 'Overfitting' in an AI model?

Accepted Answer

Lack of generalization to unseen data.. Overfitting occurs when a model learns the training data too precisely, including its noise and idiosyncrasies, so it performs excellently on training data but poorly on new, unseen data. The primary risk is therefore a lack of generalization, meaning the model's predictions do not hold up in production where inputs differ from the training set.

Answer

Increased latency in inference.

Answer

The model is too simple to solve the problem.

Answer

The model is too large to be deployed.

Question 5

In the context of 'Model Poisoning', what is a 'Backdoor' attack?

Accepted Answer

Embedded trigger causing specific model behavior. A backdoor attack in model poisoning involves an adversary implanting a hidden trigger pattern into the training data so the model behaves normally on clean inputs but produces attacker-chosen outputs whenever the trigger is present. The trigger can be a rare token, a specific pixel pattern, or a syntactic phrase. This is distinct from general poisoning because the malicious behaviour is conditional and stealthy, evading standard accuracy benchmarks.

Answer

Deleting the model's training documentation

Answer

Increasing the model's complexity

Answer

Bypassing authentication servers

Question 6

What is the primary goal of 'Model Monitoring' in the context of risk management?

Accepted Answer

To detect performance degradation, drift, and anomalous behavior.. Model Monitoring in AI risk management exists to continuously observe a deployed model's inputs, outputs, and statistical behavior so that degradation (accuracy loss), data/concept drift, and anomalous activity are detected early. Because models decay as real-world data diverges from training data, monitoring is the control that surfaces these failures before they cause business or safety harm. Detection of these three failure modes is the core purpose, not cost or infrastructure management.

Answer

To reduce the cost of GPU usage.

Answer

To block all internet traffic.

Answer

To update the marketing website automatically.

Question 7

A bank operates a real-time fraud-detection model served behind a REST API. The security team wants to detect when an attacker probes the model with crafted inputs to reconstruct its decision boundary, a model-extraction attack. They have full access to production inference logs and want a control that flags anomalous query patterns without changing model behavior. Which approach best fits this objective?

Accepted Answer

Monitor inference logs for query-distribution anomalies and near-boundary probing, and alert when a client's query pattern diverges from the baseline.. Detecting model extraction requires observing how clients query the model over time. Inference logs already capture inputs, outputs, timing, and client identity, so statistical monitoring for anomalous volume, low-entropy inputs, and boundary-probing can surface extraction attempts without touching the model. Adversarial retraining, transport encryption, and output perturbation either miss the threat or alter behavior, contrary to the stated objective.

Answer

Apply output perturbation that adds noise to the fraud score returned to every caller.

Answer

Retrain the model with adversarial examples so its decision boundary is harder to approximate.

Answer

Encrypt all API responses with TLS 1.3 and rotate the server certificate every 90 days.

Question 8

Which THREE factors are critical when establishing an AI risk reporting structure for executive leadership?

Accepted Answer

Alignment of AI security posture with corporate risk appetite and strategic goals.. Option B is correct because an AI risk reporting structure must tie AI security posture directly to the organization's stated risk appetite and strategic objectives, ensuring executives receive risk information framed in terms of business impact and tolerance thresholds. Option C is correct because current regulatory compliance status against applicable AI legal frameworks (e.g., the EU AI Act, NIST AI RMF, sector-specific rules) is a governance obligation that executives must monitor and report on to avoid legal and fiduciary exposure. Option D is correct because the evolving threat landscape targeting AI systems, such as prompt injection, model inversion, and data poisoning trends, determines which risks are material and should be surfaced to leadership for prioritization and resourcing. Option A is not correct because GPU count is an infrastructure capacity metric, not a governance or risk-reporting factor for executive leadership. Option E is not correct because specific Python libraries used in model training are low-level implementation details irrelevant to executive-level risk reporting.

Answer

The total number of GPUs available in the data center.

Answer

The specific Python libraries used for model training.

Question 9

Which activity is part of 'Ongoing AI Monitoring'?

Accepted Answer

Monitoring model performance and risk metrics.. Ongoing AI monitoring is the continuous, post-deployment phase where the organization tracks model performance (accuracy, drift, latency) and risk metrics (bias, fairness, security anomalies) to ensure the model remains safe and effective over time. Monitoring model performance and risk metrics is the defining activity of this phase. It detects degradation, data drift, and emerging threats before they cause harm.

Answer

Choosing the AI vendor.

Answer

Installing the server OS.

Answer

Initial software design review.

Question 10

During an internal audit of the AI program, it is found that the organization lacks a 'Model Inventory'. What is the most immediate risk to the AI security program?

Accepted Answer

Inability to perform security risk assessments or lifecycle management for shadow AI models.. A Model Inventory is the foundational register that catalogs all AI/ML models in use, their owners, purposes, data sources, risk classifications, and lifecycle status. Without it, the organization cannot identify which models exist, cannot assess their security risks, and cannot manage them through their lifecycle — critically, shadow AI models deployed outside governance visibility go completely unmanaged. This directly undermines the AI security program's ability to perform risk assessments and lifecycle management.

Answer

High costs associated with cloud compute resources.

Answer

Incompatibility between the model and the underlying operating system.

Answer

Increased latency in AI model responses.

Question 11

Which metric should be used to track 'Data Quality' for AI training?

Accepted Answer

Data accuracy, completeness, and consistency.. Data Quality for AI training is measured by the intrinsic characteristics of the dataset itself: accuracy (values are correct), completeness (no missing fields/records), and consistency (uniform formats and no contradictions across sources). These three dimensions directly determine whether a model learns valid patterns rather than noise or bias. Infrastructure metrics, communication counts, and UI cosmetics have no bearing on the statistical fidelity of training data.

Answer

The server rack temperature.

Answer

The number of emails sent.

Answer

The color of the data icons.

Question 12

Which scenario best illustrates an 'AI Security Incident'?

Accepted Answer

Unauthorized access to the model training weights.. An AI security incident is any event that compromises the confidentiality, integrity, or availability of AI assets — including model weights, training data, prompts, or inference endpoints. Unauthorized access to model training weights is a classic example because stolen weights enable model theft, adversarial fine-tuning, and intellectual property loss. The other options describe performance degradation, planned maintenance, or subjective dissatisfaction, none of which are security events.

Answer

The AI system running slower than usual.

Answer

A scheduled server maintenance window.

Answer

A user simply disliking the AI output.

Question 13

Which TWO reporting formats are effective for executive AI oversight?

Accepted Answer

Executive summaries of AI performance and risk.. Option C is correct because executive summaries distill AI performance metrics, business impact, and risk posture into a concise, decision-oriented format that non-technical leadership can act on quickly. Option D is correct because high-level risk heatmaps visually prioritize AI risks by likelihood and impact, enabling executives to focus oversight on the most material exposures. Options A, B, and E are not appropriate: full source code printouts and raw system logs are low-level technical artifacts that overwhelm executive audiences and obscure governance-relevant insight, while a list of server IP addresses is infrastructure detail with no bearing on AI performance, risk, or strategic oversight.

Answer

Full source code printouts.

Answer

Raw system logs in text files.

Answer

A list of all server IP addresses.

Question 14

Which THREE activities should be included in an AI Security Governance Program to effectively manage model supply chain risks?

Accepted Answer

Verifying the integrity and origin of pre-trained models via digital signatures.. Option A is correct because verifying the integrity and origin of pre-trained models via digital signatures ensures that models pulled from external sources have not been tampered with and come from trusted publishers, directly mitigating supply chain tampering and substitution attacks. Option B is correct because automating the review of model license agreements enforces open-source compliance policies, preventing legal and licensing risks that arise when third-party or pre-trained models carry restrictive or incompatible terms. Option E is correct because maintaining a Software Bill of Materials (SBOM) for all AI model components and dependencies provides the transparency needed to track libraries, datasets, and transitive dependencies, enabling rapid vulnerability and provenance response across the model supply chain. Option C does not belong because monthly inference-speed benchmarking is a performance/operations activity, not a supply chain risk control. Option D does not belong because increasing R&D budget is a financial/resourcing decision and does not itself manage model supply chain risks.

Answer

Conducting monthly performance benchmarking of model inference speed.

Answer

Increasing the budget for AI model research and development.

Question 15

An AI security lead is configuring a 'Model Risk Management' (MRM) framework. What is the main objective of a 'Model Validation' report?

Accepted Answer

To provide independent verification of model performance and risk mitigation effectiveness.. A Model Validation report provides independent verification that a model performs as intended and that its risks are adequately mitigated. It is produced by a party separate from the model developers (the 'three lines of defense' model places validation in the second line) and covers conceptual soundness, data quality, performance testing, and ongoing monitoring plans. Its purpose is to give governance bodies and regulators assurance that the model is fit for purpose and that identified risks are controlled.

Answer

To market the model to external customers.

Answer

To reduce the model development time.

Answer

To guarantee 100% accuracy in all scenarios.

Question 16

What is the most effective control to prevent 'Model Scraping' from an exposed AI prediction API?

Accepted Answer

Implement tiered access and rate limiting.. Model scraping involves repeatedly querying a prediction API to reconstruct the model's behavior or extract training data. Tiered access combined with rate limiting is the most effective control because it constrains query volume per identity and gates higher-volume access behind stricter authorization, making large-scale extraction economically and technically infeasible. This directly targets the scraping mechanism rather than relying on legal or cosmetic deterrents.

Answer

Require users to sign a Terms of Service agreement.

Answer

Increase the complexity of the model.

Answer

Use an obfuscated model file name.

Question 17

You are auditing access controls for a Microsoft Azure OpenAI deployment. Which TWO of the following configurations are required to ensure identity-based access and logging for model inference?

Accepted Answer

Enable 'Diagnostic settings' to route logs to a Log Analytics workspace.. Option B is correct because enabling Diagnostic settings on the Azure OpenAI resource and routing logs (e.g., Audit, RequestResponse, and AzureOpenAIRequestResponse categories) to a Log Analytics workspace is the supported mechanism for capturing model inference and access telemetry for auditing. Option C is correct because identity-based access to Azure OpenAI requires assigning an appropriate Azure RBAC role, such as 'Cognitive Services OpenAI User', to the service principal (or managed identity) so it can call the inference endpoints without keys. Option A is not a real Azure Portal global setting and does not provide identity or logging controls. Option D is wrong because shared API keys are key-based authentication, not identity-based, and they weaken accountability and auditing. Option E is wrong because setting public network access improves reachability, not identity-based access or logging, and it actually broadens exposure.

Answer

Enable the 'Prompt Injection' toggle in the Azure Portal global settings.

Answer

Create a shared API key for all users to simplify service account management.

Answer

Set the model to 'Public Access' in the Networking tab for easier debugging.

Question 18

Which THREE strategies are effective for defending against model poisoning in an ML pipeline?

Accepted Answer

Implementing model validation against a clean, golden dataset. Option A is correct because validating a trained model against a clean, golden dataset lets you detect accuracy or behavioral degradation caused by poisoned training samples before deployment. Option D is correct because data sanitization and outlier detection remove or flag anomalous, mislabeled, or adversarially crafted samples that would otherwise corrupt the training set. Option E is correct because robust aggregation methods such as Krum and coordinate-wise Median limit the influence of malicious updates in distributed or federated training, preventing a few poisoned clients from shifting the global model. Option B is wrong because raising the learning rate does not neutralize poisoned data and typically destabilizes or degrades the model. Option C is wrong because changing activation functions is unrelated to poisoning defense and does not filter or mitigate malicious training inputs.

Answer

Increasing the model's learning rate to 'burn off' poison

Answer

Regularly changing the model's activation functions

Question 19

Who is ultimately responsible for the outcomes of an AI system deployed by a business unit?

Accepted Answer

The Business Unit Leader.. Ultimate accountability for an AI system's outcomes rests with the business unit leader who owns the system, its use case, and its business impact. Governance frameworks consistently assign ownership to the accountable executive rather than to vendors, auditors, or individual technical staff. The business unit leader has the authority, budget, and organizational standing to enforce controls and accept or mitigate risk.

Answer

The Cloud Service Provider.

Answer

The external auditor.

Answer

The junior data scientist.

Question 20

A developer is implementing 'Differential Privacy' on a training dataset. What is the primary trade-off they are managing?

Accepted Answer

Privacy budget (epsilon) vs. model utility/accuracy.. Differential privacy works by injecting calibrated noise into computations so that any single individual's data has a bounded influence on the output. The privacy budget, epsilon (ε), controls how much noise is added: smaller epsilon means stronger privacy but lower model utility/accuracy. The developer's primary trade-off is therefore between the privacy budget and model utility (A).

Answer

Model training speed vs. model cost.

Answer

Security of the training pipeline vs. developer productivity.

Answer

Deployment latency vs. model scalability.