AAISM Practice Test 2 — 30 Questions

Question 1

Which TWO factors are critical when assessing the risk of a new Generative AI use case?

Accepted Answer

The potential business impact if the system fails.. Business impact and data sensitivity are the foundational elements for risk assessment in AI.

Answer

The aesthetic of the user interface.

Answer

The office location of the developers.

Answer

The programming language used.

Question 2

Which TWO activities ensure 'AI Safety' in development?

Accepted Answer

Adversarial testing (red teaming).. Adversarial testing and rigorous documentation are key safety practices.

Answer

Using unmonitored cloud servers.

Answer

Increasing the amount of public data used.

Answer

Removing all encryption.

Question 3

Which THREE documents are vital for an AI audit trail?

Accepted Answer

Model validation and testing reports.. Model version, training set, and validation report are the three pillars of a reconstructible audit trail.

Answer

The office lease agreement.

Answer

A copy of the employee handbook.

Question 4

When using a 'Managed AI API' service, what is the best practice for handling API keys?

Accepted Answer

Store keys in a secure Secrets Manager. API keys should never be hardcoded; they should be stored in secrets managers like AWS Secrets Manager or Azure Key Vault.

Answer

Hardcode keys in the application source code

Answer

Email keys to team members for easy access

Answer

Embed keys in the public Git repository

Question 5

Which tool is best for managing 'Secrets' (like database passwords or API keys) used by your AI training pipeline?

Accepted Answer

HashiCorp Vault. Secrets management services (AWS Secrets Manager, HashiCorp Vault) are the secure way to manage credentials.

Answer

Hardcoded variables in the training script

Answer

A public Github repository

Answer

An Excel spreadsheet on a shared drive

Question 6

Which TWO of the following are primary risks associated with 'membership inference attacks' against an AI model?

Accepted Answer

Exposure of sensitive information about training data subjects.. Membership inference attacks aim to determine if a specific data point was used in the training set, risking privacy leakage.

Answer

Unauthorized modification of model weights.

Answer

Unauthorized access to the model training algorithm.

Answer

Complete system shutdown via resource exhaustion.

Question 7

What is the purpose of 'AI Model Inventory'?

Accepted Answer

To provide a central list of all AI assets for risk oversight.. An inventory tracks all models in production to ensure they are managed, monitored, and reviewed according to organizational policy.

Answer

To increase the speed of the training pipeline.

Answer

To reduce the number of GPUs used.

Answer

To automatically retrain all models.

Question 8

Which TWO components are essential for a robust AI Governance framework?

Accepted Answer

Defined roles and accountability structures.. Policies and clearly defined roles are the foundation of any governance system.

Answer

The company party schedule.

Answer

A list of all employee names.

Answer

The best-selling AI books.

Question 9

Which THREE items should be included in an 'AI Inventory'?

Accepted Answer

Unique model identifier and version.. Model version, owner, and risk rating are the core pieces of information needed to manage an AI portfolio.

Answer

The model's favorite color.

Answer

The developer's favorite food.

Question 10

An organization is using an LLM-based agent. What is the primary risk associated with 'indirect prompt injection' in this environment?

Accepted Answer

External data retrieved by the agent contains instructions that override system prompts.. Indirect prompt injection occurs when malicious data is embedded in a retrieved document that instructs the LLM to perform unintended actions.

Answer

The model produces hallucinatory facts.

Answer

The API key for the LLM is exposed in the code.

Answer

The training data includes PII of users.

Question 11

Which THREE components are critical for an 'AI Incident Response' plan?

Accepted Answer

Communication channels with data scientists and legal teams.. An AI IR plan must account for model-specific issues like unexpected performance drops, bias, and adversarial attacks.

Answer

Requirements to publish all internal vulnerabilities publicly.

Answer

Automated deletion of all logs.

Question 12

Which of the following describes 'Model Integrity' risk?

Accepted Answer

The risk of the model weights being maliciously modified.. Model integrity risk refers to the potential for the model to be altered or behave in an unauthorized way, such as through poisoning or unauthorized weight updates.

Answer

The risk that the model will be too slow.

Answer

The risk of data being leaked during training.

Answer

The risk that users will stop using the app.

Question 13

An organization is performing threat modeling for a RAG (Retrieval-Augmented Generation) pipeline. Which specific vulnerability is unique to the retrieval component?

Accepted Answer

Database poisoning within the retrieved document index.. In RAG, if the search or retrieval index is manipulated, the LLM will generate answers based on attacker-supplied context.

Answer

Overfitting of the LLM on the training set.

Answer

Gradient-based evasion attacks on the LLM.

Answer

Prompt injection targeting the LLM model weights.

Question 14

A firm is drafting a policy for 'AI Use in Marketing'. Which element is most important to include to ensure alignment with existing data protection regulations?

Accepted Answer

Mandatory disclosure requirements when content is generated by AI.. Ensuring the AI system complies with transparency and privacy requirements (like GDPR) is foundational to AI governance policy.

Answer

A mandate to use only open-source AI models.

Answer

A list of all approved GPU hardware vendors.

Answer

The specific programming languages authorized for AI development.

Question 15

Which THREE elements are essential for 'AI Governance'?

Accepted Answer

Defined AI ethics and safety policies.. AI governance requires clear policies, oversight committees, and defined risk frameworks.

Answer

Access to all employees' private emails.

Answer

A mandate to use the most expensive GPUs available.

Question 16

When evaluating AI security, 'Model Drift' refers to performance degradation over time. Which tool would a practitioner use to detect drift in a production environment?

Accepted Answer

Amazon SageMaker Model Monitor. Model monitoring tools track statistical properties of features and predictions to identify drift.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Question 17

Which TWO of the following are effective methods for monitoring and detecting AI security incidents in a cloud environment?

Accepted Answer

Ingesting model inference logs into a SIEM. Centralized logging (e.g., CloudWatch, Azure Monitor) and anomaly detection are critical for identifying unexpected model interactions.

Answer

Disabling logging to reduce cloud spend

Answer

Using standard database backup schedules

Answer

Hardcoding API credentials in application code

Question 18

Which of the following is a 'Human-in-the-Loop' (HITL) control used for AI risk management?

Accepted Answer

Requiring human approval for high-risk model outputs. HITL involves human review of model decisions before they are finalized or acted upon, especially for high-stakes decisions.

Answer

Using only open-source libraries

Answer

Deploying the model to a public server

Answer

Automating all model output without review

Question 19

Which TWO measures are most effective in reducing the risk of 'Hallucinations' in LLM systems?

Accepted Answer

Using Retrieval-Augmented Generation (RAG).. RAG and Grounding ensure the model relies on external, verified context rather than its internal probabilistic memory.

Answer

Training the model on larger public internet datasets.

Answer

Removing all punctuation from the input.

Answer

Increasing the model's temperature parameter to 2.0.

Question 20

You are managing an AI project and notice the model is performing poorly on a subset of data representing a protected class. What is the correct next step in the risk assessment process?

Accepted Answer

Investigate the data representation and training balance for that subgroup.. Performing a root cause analysis on the data used to train that specific segment is the correct diagnostic step.

Answer

Immediately delete all training data.

Answer

Dismiss the finding as a minor edge case.

Answer

Replace the model architecture with a simpler one.