AAISM Practice Test 3 — 10 Questions

Question 1

A firm is drafting a policy for 'AI Use in Marketing'. Which element is most important to include to ensure alignment with existing data protection regulations?

Accepted Answer

Mandatory disclosure requirements when content is generated by AI.. Mandatory disclosure requirements when content is generated by AI directly support transparency and accountability obligations under data protection regulations like GDPR and CCPA. These laws require individuals to be informed about how their data is used and to have the ability to exercise rights; AI-generated content that involves personal data must be disclosed to avoid deceptive practices. By embedding disclosure into the marketing policy, the firm ensures that consumers are aware of automated decision-making and can challenge or opt out, aligning with legal requirements for fair and transparent processing.

Answer

A mandate to use only open-source AI models.

Answer

A list of all approved GPU hardware vendors.

Answer

The specific programming languages authorized for AI development.

Question 2

An organization is using an LLM-based agent. What is the primary risk associated with 'indirect prompt injection' in this environment?

Accepted Answer

External data retrieved by the agent contains instructions that override system prompts.. Indirect prompt injection occurs when an LLM-based agent retrieves external content (web pages, documents, emails, tool outputs) that contains hidden instructions, and those instructions are interpreted by the model as if they came from the system or user. The attacker does not need direct access to the prompt — they poison the data the agent will later ingest. This can cause the agent to exfiltrate data, call tools with malicious parameters, or ignore its original system prompt.

Answer

The model produces hallucinatory facts.

Answer

The API key for the LLM is exposed in the code.

Answer

The training data includes PII of users.

Question 3

A security analyst is evaluating an AI-based intrusion detection system (IDS) that uses a machine learning model to classify network traffic. The analyst wants to assess the model's robustness against adversarial attacks. Which two techniques should be used to test the model's resilience? (Choose two.)

Accepted Answer

Projected Gradient Descent (PGD). FGSM and PGD are both adversarial attack techniques used to generate perturbed inputs that can fool a model. They are standard methods for testing a model's robustness, especially in security-sensitive applications like intrusion detection. By applying these attacks, analysts can identify vulnerabilities and improve defenses.

Answer

Membership inference

Answer

Model inversion

Answer

Data poisoning

Question 4

Which THREE documents are vital for an AI audit trail?

Accepted Answer

Model validation and testing reports.. Model validation and testing reports (B) are vital because they document how the AI model's performance, accuracy, bias, and robustness were assessed before and after deployment, providing auditable evidence of due diligence. Training data source documentation (C) is essential since it records the provenance, licensing, collection methods, and characteristics of the data used to train the model, which is necessary for tracing outputs and demonstrating compliance with data governance requirements. Model versioning history (D) is required to establish a traceable record of changes, retraining events, hyperparameters, and rollbacks, enabling auditors to reproduce or explain the behavior of any given model version at a point in time. The office lease agreement (A) and a copy of the employee handbook (E) are unrelated to the technical and data governance artifacts needed to reconstruct an AI system's development and decision-making, so they do not belong in an AI audit trail.

Answer

The office lease agreement.

Answer

A copy of the employee handbook.

Question 5

A healthcare provider is deploying an AI triage tool that recommends patient priority in the emergency department. The governance committee wants to ensure that the tool's decisions can be explained to clinicians and regulators. Which practice best supports this requirement?

Accepted Answer

Maintaining model documentation that records features, decision logic, and known limitations. Model documentation that records features, decision logic, and known limitations is the practice that enables the provider to explain triage recommendations to clinicians and regulators. It creates an inspectable record of how the model behaves, which is what explainability governance requires, unlike architecture choice, access restriction, or dataset size.

Answer

Restricting access to the model's source code to the vendor only

Answer

Increasing the size of the training dataset to improve accuracy

Answer

Using only open-source model architectures for the triage tool

Question 6

Which cryptographic tool is used to ensure the authenticity of a model file stored in an S3 bucket?

Accepted Answer

Digital signatures. Digital signatures use asymmetric cryptography to provide authenticity and integrity for a model file. The signer creates a hash of the model artifact and encrypts it with their private key; anyone with the public key can verify that the file originated from the trusted source and has not been tampered with. This is the standard mechanism for ensuring model provenance in S3 or any artifact repository.

Answer

Data masking

Answer

Model quantization

Answer

Base64 encoding

Question 7

Which of the following is a 'Human-in-the-Loop' (HITL) control used for AI risk management?

Accepted Answer

Requiring human approval for high-risk model outputs. Human-in-the-Loop (HITL) means a human reviews, approves, or overrides model outputs before they take effect, which is a direct risk control for high-stakes decisions. Requiring human approval for high-risk model outputs ensures accountability and catches errors, bias, or unsafe recommendations before harm occurs. This is a core control in AI risk management frameworks for high-impact use cases.

Answer

Using only open-source libraries

Answer

Deploying the model to a public server

Answer

Automating all model output without review

Question 8

An organization uses IBM watsonx.ai to manage model governance. Which tool is primarily used to track 'FactSheets' for model lineage and auditability?

Accepted Answer

FactSheets. FactSheets is the correct answer because it is the specific tool within IBM watsonx.ai designed to document and track model lineage, auditability, and governance information. FactSheets provide a standardized, structured way to capture metadata about AI models—such as their purpose, training data, performance metrics, and ethical considerations—which is essential for regulatory compliance and internal audits. Unlike generic experiment trackers or dashboards, FactSheets are purpose-built to satisfy model governance requirements by offering a transparent, shareable record of a model's lifecycle.

Answer

AutoAI Experiment Tracker

Answer

Pipeline Orchestrator

Answer

Model Risk Management (MRM) dashboard

Question 9

A retail company uses a machine learning model to approve credit applications. Regulators require the company to explain adverse decisions to applicants. The data science team wants a method that provides local, instance-level explanations of feature contributions that are additive and consistent. Which technique should they adopt?

Accepted Answer

SHAP (SHapley Additive exPlanations) values.. SHAP values provide consistent, additive, instance-level attributions that can explain individual credit decisions, meeting both technical and regulatory needs. Global importance, partial dependence, and LIME either lack local specificity or lack the consistency and additivity required for defensible adverse action explanations.

Answer

LIME (Local Interpretable Model-agnostic Explanations).

Answer

Partial dependence plots.

Answer

Global permutation feature importance.

Question 10

A financial services firm has deployed an AI governance framework with a central AI risk committee. Business units complain that the committee is a bottleneck, delaying low-risk AI pilots by weeks. The Chief AI Officer wants to maintain oversight while accelerating delivery. Which governance design change best addresses this?

Accepted Answer

Delegate approval authority for low-risk AI use cases to business-unit AI risk champions using a pre-approved risk pattern library, with the central committee retaining review of high-risk and novel cases.. The bottleneck stems from a single-tier approval model in which all AI pilots, regardless of risk, route through the central committee. Delegating low-risk approvals to trained business-unit champions using pre-approved patterns keeps the central committee as the owner of the risk framework and the approver of high-risk or novel cases, while materially reducing cycle time for routine pilots. This is a governance design change rather than a capacity or oversight removal.

Answer

Dissolve the central AI risk committee and assign all AI risk decisions to each business unit's existing operational risk function.

Answer

Keep the central committee as the sole approver but add more staff and increase meeting frequency to clear the backlog.

Answer

Allow business units to self-certify all AI pilots as low risk and proceed without notifying the central committee.