AAISM Practice Test 7 — 10 Questions

Question 1

Which THREE technical controls effectively manage 'Third-Party AI Vendor' risks?

Accepted Answer

Independent verification of the vendor's model performance.. Managing third-party AI risk involves technical validation, contractual oversight, and ongoing monitoring.

Answer

Asking the vendor to delete all their internal logs.

Answer

Requiring all employees to use the vendor's internal Wi-Fi.

Question 2

When establishing a risk management framework for GenAI, which THREE factors should be prioritized to satisfy the NIST AI Risk Management Framework requirements?

Accepted Answer

Continuous monitoring of model performance metrics.. NIST AI RMF prioritizes trustworthiness, safety, and reliability through continuous monitoring and governance.

Answer

Requiring all models to be open-source.

Answer

Implementing a strict 'no external API' policy for all models.

Question 3

What is the primary function of 'IAM' in an AI-driven cloud environment?

Accepted Answer

Manage identities and access to resources. IAM (Identity and Access Management) manages who can perform which actions on which resources (e.g., who can invoke a model).

Answer

Monitor the health of GPU clusters

Answer

Automate data cleaning tasks

Answer

Increase the training speed of models

Question 4

Which TWO actions should be taken when implementing an AI security monitoring strategy in a production environment?

Accepted Answer

Implement automated alerting for anomalous request patterns. Effective monitoring requires both tracking system health and analyzing input/output traffic for malicious patterns.

Answer

Disable all API telemetry to reduce attack surface

Answer

Use a static list of IP addresses for all model access

Answer

Perform daily model retraining regardless of drift

Question 5

Which THREE items should be included in an 'AI Vendor Assessment'?

Accepted Answer

Review of the model transparency/model card documentation.. Vendor assessments must verify security practices, compliance, and model transparency.

Answer

The personal home addresses of all employees.

Answer

The vendor's entire source code repository.

Question 6

Which of the following best describes 'Model Inversion' as a security risk?

Accepted Answer

An attacker probes the model to reconstruct training samples.. Model inversion involves exploiting model outputs to reconstruct the training data, potentially revealing sensitive information.

Answer

The model is overwritten with malicious logic.

Answer

The model becomes unavailable to users.

Answer

The model predicts the wrong output due to noisy inputs.

Question 7

What is the primary risk associated with 'Overfitting' in an AI model?

Accepted Answer

Lack of generalization to unseen data.. Overfitting means the model memorizes the training data rather than generalizing, leading to poor performance on new, unseen data, which is a reliability risk.

Answer

Increased latency in inference.

Answer

The model is too simple to solve the problem.

Answer

The model is too large to be deployed.

Question 8

You are auditing an AI system for 'Model Explainability' (XAI). Why is XAI critical from a risk management perspective?

Accepted Answer

It provides transparency for accountability and bias detection.. Explainability allows organizations to understand the 'why' behind model decisions, essential for regulatory compliance and debugging bias.

Answer

It is required to make the model run faster.

Answer

It encrypts the input data.

Answer

It enables models to train without labels.

Question 9

Which TWO items must be documented in an 'AI Model Card'?

Accepted Answer

Known limitations and failure modes.. Model Cards are meant to document intended use and limitations to ensure transparency.

Answer

The color scheme of the model's website.

Answer

The social security numbers of all developers.

Answer

The hardware purchase receipts.

Question 10

Which of the following describes the purpose of 'Differential Privacy' in a machine learning system?

Accepted Answer

To prevent the identification of individuals in the training data. Differential privacy ensures that an individual's data cannot be inferred from the aggregate model output by injecting statistical noise during training.

Answer

To enable cross-cloud model training

Answer

To allow for better interpretation of model layers

Answer

To ensure the model is faster at inference time