AAISM Practice Test 1 — 30 Questions

Question 1

Which THREE components are critical for an 'AI Incident Response' plan?

Accepted Answer

Communication channels with data scientists and legal teams.. Option A is correct because an AI incident response plan must define communication channels that bring together data scientists (who understand model behavior and can diagnose failures) and legal teams (who handle regulatory, liability, and disclosure obligations), ensuring coordinated and compliant escalation. Option C is correct because procedures for model rollback or disablement are essential to quickly contain harm by reverting to a prior known-good model version or taking the model offline when it misbehaves. Option D is correct because identifying model-specific failure indicators — such as data drift, adversarial inputs, bias spikes, or anomalous confidence scores — enables early detection and triage of AI incidents that differ from traditional IT failures. Option B does not belong because publishing all internal vulnerabilities publicly is not a standard incident response requirement and could increase risk and violate disclosure norms. Option E does not belong because automated deletion of all logs destroys the forensic evidence needed for incident investigation, root-cause analysis, and compliance reporting.

Answer

Requirements to publish all internal vulnerabilities publicly.

Answer

Automated deletion of all logs.

Question 2

What is 'Model Stealing' and why is it considered a security incident?

Accepted Answer

It is the theft of intellectual property via query analysis. Model stealing is the extraction of a model's functionality or intellectual property through repeated query analysis — an attacker probes the API with crafted inputs and uses the input-output pairs to train a surrogate model that approximates the original. It is a security incident because it compromises the owner's IP and can enable further attacks such as adversarial example transfer and evasion of the original model. The economic value of a trained model is directly eroded when it can be cloned via the inference API.

Answer

It is the slow down of the model due to heavy load

Answer

It is the unauthorized access to the server room

Answer

It is the accidental deletion of model files

Question 3

A technology company has developed an AI model for autonomous decision-making in its supply chain. The AI governance team is tasked with establishing a process for continuous monitoring of the model's performance and risk. Which of the following is the MOST critical element to include in the monitoring process to detect model drift?

Accepted Answer

Tracking changes in the statistical distribution of input data over time.. Tracking changes in input data distributions is the most critical element for detecting model drift because it directly identifies covariate shift, a primary cause of performance degradation. Other options focus on usage metrics, static historical performance, or code management, none of which provide early warning of drift in a live supply chain environment.

Answer

Ensuring the model's code repository is version-controlled and changes are logged.

Answer

Recording the number of API calls made to the model each day.

Answer

Reviewing the model's training loss and accuracy metrics on the original test set.

Question 4

When a model fails in production, what is the first step in the 'Incident Response' process?

Accepted Answer

Containment and impact assessment.. The first step in incident response, including AI model failures, is containment and impact assessment. Containment stops the failure from spreading or causing further harm (e.g., disabling the model endpoint, reverting to a safe version), while impact assessment determines the scope, affected users, and business damage. This aligns with standard IR frameworks like NIST SP 800-61, where containment follows detection and precedes eradication and recovery.

Answer

Writing a press release.

Answer

Firing the developer.

Answer

Ignoring the error.

Question 5

An AI Security analyst is configuring Google Cloud Vertex AI Model Garden to ensure compliance with organization policies. Which IAM permission is strictly required to prevent unauthorized users from deploying a base model to a public endpoint?

Accepted Answer

aiplatform.endpoints.create. Deploying a model to a Vertex AI endpoint requires creating an endpoint resource, which is governed by the aiplatform.endpoints.create permission. Without this permission, a user cannot provision a public endpoint even if they can read metadata or upload models. Restricting this permission to authorized principals is the direct IAM control that prevents unauthorized public exposure of a base model.

Answer

aiplatform.metadata.read

Answer

aiplatform.jobs.create

Answer

aiplatform.models.upload

Question 6

Which TWO of the following are effective methods for monitoring and detecting AI security incidents in a cloud environment?

Accepted Answer

Ingesting model inference logs into a SIEM. Option C is correct because ingesting model inference logs into a SIEM centralizes AI telemetry, enabling correlation of prompts, responses, and metadata with other security events to detect prompt injection, data exfiltration, or model abuse in near real time. Option E is correct because configuring anomaly detection for API call patterns baselines normal invocation frequency, latency, token usage, and source IPs, then alerts on deviations that indicate credential theft, model extraction, or denial-of-wallet attacks against AI endpoints. Option A is wrong because disabling logging removes the audit trail needed for detection and forensics, and cost reduction is not a security monitoring method. Option B is wrong because standard database backup schedules address data durability and recovery, not real-time detection of AI security incidents. Option D is wrong because hardcoding API credentials in application code exposes secrets and increases compromise risk rather than helping monitor or detect incidents.

Answer

Disabling logging to reduce cloud spend

Answer

Using standard database backup schedules

Answer

Hardcoding API credentials in application code

Question 7

What is the primary function of 'IAM' in an AI-driven cloud environment?

Accepted Answer

Manage identities and access to resources. Identity and Access Management (IAM) in an AI-driven cloud environment governs who (users, services, applications) can access which resources (models, datasets, compute, APIs) and under what conditions. Its primary function is authentication, authorization, and policy enforcement across the cloud environment, ensuring least-privilege access to AI assets.

Answer

Monitor the health of GPU clusters

Answer

Automate data cleaning tasks

Answer

Increase the training speed of models

Question 8

When conducting an AI audit, what should be the primary focus of the 'Data Governance' review?

Accepted Answer

Data quality, lineage, and access controls.. The primary focus of a Data Governance review in an AI audit is to ensure that the data used for training, validation, and inference is reliable, traceable, and properly protected. Data quality ensures the model's outputs are accurate and unbiased; lineage provides an audit trail from source to model; and access controls enforce security and privacy. These elements are foundational to trustworthy AI systems and are explicitly covered in governance frameworks like the NIST AI RMF and ISO/IEC 42001.

Answer

The model's marketing reach.

Answer

The color of the UI.

Answer

The model creator's salary.

Question 9

A multinational bank's AI governance committee is drafting its charter. The General Counsel insists that the charter explicitly state who bears ultimate responsibility for the organization's AI-related legal and regulatory outcomes, and that this be documented and approved at the highest level. Which element of the AI governance charter is the General Counsel requiring?

Accepted Answer

A defined AI accountability structure that assigns ultimate ownership of AI outcomes to a named executive body. The General Counsel is asking for governance ownership, not operational controls. An AI governance charter must name the executive or board-level body that ultimately owns AI outcomes, including legal and regulatory consequences. Intake processes, monitoring standards, and control baselines support that ownership but do not establish it.

Answer

A model performance monitoring standard defining drift thresholds and retraining triggers

Answer

A technical control baseline specifying minimum encryption and access controls for AI model endpoints

Answer

An AI use-case intake process requiring business units to register proposed AI tools before deployment

Question 10

You are securing a PyTorch model and want to implement differential privacy to protect the training data. Which library is specifically designed to work with PyTorch for this purpose?

Accepted Answer

Opacus. Opacus is a library developed by Meta specifically for training PyTorch models with differential privacy. It provides a PrivacyEngine that wraps standard PyTorch optimizers and DataLoaders to add per-sample gradient clipping and calibrated Gaussian noise, implementing the DP-SGD algorithm natively within the PyTorch autograd graph. This tight integration means you can make an existing PyTorch training loop differentially private with only a few lines of code.

Answer

TensorFlow Privacy

Answer

Hugging Face Evaluate

Answer

Adversarial Robustness Toolbox (ART)

Question 11

Which THREE activities help manage 'AI Lifecycle' risk?

Accepted Answer

Pre-deployment design and threat modeling.. Option A is correct because pre-deployment design and threat modeling identify AI-specific risks (e.g., data poisoning, model evasion, prompt injection, bias) before the system is fielded, allowing controls to be built in rather than bolted on. Option B is correct because formal decommissioning and sunsetting processes manage end-of-life risk by retiring models, revoking credentials, archiving or destroying training data, and preventing stale or unsupported AI components from remaining exploitable. Option E is correct because continuous operational monitoring detects model drift, data drift, performance degradation, and anomalous inference behavior during runtime, which is essential since AI risk evolves after deployment. Option C is incorrect because ignoring software updates leaves known vulnerabilities unpatched and increases lifecycle risk. Option D is incorrect because bypassing security reviews for speed skips necessary risk assessment and control validation, directly undermining AI lifecycle risk management.

Answer

Ignoring all software updates.

Answer

Bypassing security reviews for speed.

Question 12

Which THREE security controls are essential for protecting the integrity of the AI model training supply chain?

Accepted Answer

Data provenance and lineage tracking. Data provenance and lineage tracking (A) is essential because it records the origin, transformations, and custody of every training dataset, allowing integrity violations such as tampered or poisoned data to be detected and traced through the pipeline. SBOM analysis for dependencies (B) is required because AI training stacks pull in numerous third-party libraries and frameworks, and an SBOM lets you identify and remediate vulnerable or malicious components before they affect the model. Cryptographic signing of model artifacts (D) is essential because digital signatures (e.g., using asymmetric keys over hashes of weights and checkpoints) let consumers verify that a model was produced by a trusted source and has not been altered in transit or storage. Hardening the physical security of the server room (C) protects physical access to hardware but does not address the logical integrity of data, dependencies, or model artifacts across the supply chain, and increasing the number of neurons (E) is a model-capacity design choice that has no bearing on supply chain security.

Answer

Hardening the physical security of the server room

Answer

Increasing the number of neurons in the model

Question 13

A researcher is using 'Adversarial Training' to defend against evasion. How exactly does this work?

Accepted Answer

It trains the model on adversarial examples alongside clean data.. Adversarial training is a defense technique where the model is trained on a dataset that includes both clean examples and adversarial examples—inputs intentionally perturbed to fool the model. By learning from these adversarial examples, the model becomes more robust and can correctly classify them, thereby improving its resistance to evasion attacks.

Answer

It uses a secondary model to detect malicious input.

Answer

It restricts input to a whitelist of authorized users.

Answer

It adds noise to the weights of the model.

Question 14

What is the purpose of 'Logging' in an AI system?

Accepted Answer

To provide an audit trail for incident investigation. Logging in an AI system captures events, inputs, outputs, model versions, and decisions over time so that incidents can be reconstructed and responsibility assigned. Its primary governance purpose is to provide an audit trail for incident investigation (B) — determining what the model did, why, and under what conditions when something goes wrong. This is foundational to AI incident response, regulatory reporting, and post-mortem analysis.

Answer

To prevent unauthorized access to the server

Answer

To encrypt data at rest

Answer

To compress the model for faster deployment

Question 15

Which THREE elements are essential for 'AI Governance'?

Accepted Answer

Defined AI ethics and safety policies.. AI governance requires a formal policy foundation, so option A (defined AI ethics and safety policies) is correct because written principles for fairness, transparency, accountability, and safety give the organization enforceable rules and decision criteria for AI use. Option C (a standard AI risk management framework) is correct because a recognized framework such as the NIST AI RMF or ISO/IEC 42001 provides a structured, repeatable process for identifying, assessing, treating, and monitoring AI risks across the lifecycle. Option E (a cross-functional oversight committee) is correct because governance needs an accountable body drawing on legal, compliance, security, data science, and business stakeholders to approve, review, and enforce AI decisions. Option B is not essential and would violate privacy and least-privilege principles, since governance never requires blanket access to employees' private emails. Option D is not essential because governance is about policy, risk, and accountability, not about mandating the most expensive GPU hardware, which is a cost and performance decision rather than a governance element.

Answer

Access to all employees' private emails.

Answer

A mandate to use the most expensive GPUs available.

Question 16

Which technique is best suited to defend against 'Model Extraction' where an adversary queries a public API to build a clone of your proprietary model?

Accepted Answer

Implement output perturbation. Output perturbation deliberately adds noise or rounds confidence scores returned by the API, degrading the fidelity of the information an adversary can use to train a clone. Model extraction relies on precise output signals, so perturbing them reduces clone accuracy while preserving acceptable utility for legitimate users. This is a direct, low-cost mitigation at the inference boundary.

Answer

Enable data augmentation

Answer

Use a larger model architecture

Answer

Rotate API tokens every 30 days

Question 17

Which THREE of the following are potential indicators of a 'Model Poisoning' attack occurring during the training phase?

Accepted Answer

Inconsistent model convergence during training. Option B is correct because model poisoning corrupts the training data or update process, so the loss curve and parameter updates no longer converge consistently, producing erratic or stalled convergence during training. Option C is correct because poisoned training samples can cause the model to memorize manipulated patterns, yielding high training-set accuracy while validation accuracy degrades due to the corrupted decision boundary. Option E is correct because attackers often implant backdoors or trigger-based behaviors, so the model behaves normally on ordinary inputs but produces attacker-chosen outputs when a specific trigger pattern is present. Option A is not a training-phase indicator, since increased API request latency reflects inference or service performance rather than poisoned training data. Option D is also not indicative, because larger model-weight storage is a resource/cost artifact and does not by itself demonstrate poisoned training behavior.

Answer

Increased latency for API requests

Answer

Increase in storage costs for the model weights

Question 18

A healthcare organization uses an AI system to prioritize patient follow-up calls. The system was trained on historical data that underrepresented certain demographic groups. The governance team wants to implement a control that detects and mitigates bias in the model's outputs on an ongoing basis. Which approach is most effective?

Accepted Answer

Implement continuous monitoring of model outputs with fairness metrics and a defined mitigation workflow.. Continuous monitoring with fairness metrics and a mitigation workflow is the most effective approach because it provides ongoing detection and correction of bias in production. It acknowledges that bias is not a one-time issue and requires sustained vigilance. This control enables the governance team to fulfill its responsibility to ensure equitable AI outcomes and comply with regulations.

Answer

Rely on the vendor's claims that the model is fair and unbiased.

Answer

Remove all demographic data from the training set to prevent bias.

Answer

Conduct a one-time bias audit before deployment and document the results.

Question 19

What is the primary risk of using 'Pre-trained models' from public hubs without verification?

Accepted Answer

The model may contain backdoors or malicious code.. Pre-trained models downloaded from public hubs (e.g., Hugging Face, TensorFlow Hub) are serialized artifacts that may execute arbitrary code on load — Python pickle files, custom layers, or Lambda layers can embed malicious payloads. Without verification (checksums, signatures, model cards, or scanning), an attacker who uploaded a poisoned model can achieve code execution or implant a backdoor that triggers on specific inputs. This is the primary supply-chain risk of consuming untrusted model artifacts.

Answer

The model will not support Python.

Answer

The model will be too small.

Answer

The model will not have a web interface.

Question 20

A retail company's AI governance committee is drafting a policy for employee use of public generative AI tools. The Chief Information Security Officer wants to ensure the policy addresses the most significant risk of data leakage. Which policy element is MOST directly aimed at preventing sensitive corporate data from being exposed through these tools?

Accepted Answer

Prohibiting the input of confidential, personal, or proprietary data into public generative AI tools.. The most direct way to prevent sensitive data leakage through public generative AI tools is to prohibit entering such data into them. This policy element removes the risky behaviour itself, rather than relying on training, access controls, or endpoint monitoring that do not specifically address the content shared with external AI services. It is clear, enforceable, and targeted at the root cause.

Answer

Requiring employees to complete annual security awareness training.

Answer

Mandating multi-factor authentication for all corporate accounts.

Answer

Deploying endpoint detection and response agents on all employee laptops.