AAISM AI Governance And Program Management Practice Test 3 — 15 Questions

Question 1

When conducting an AI audit, what should be the primary focus of the 'Data Governance' review?

Accepted Answer

Data quality, lineage, and access controls.. The primary focus of a Data Governance review in an AI audit is to ensure that the data used for training, validation, and inference is reliable, traceable, and properly protected. Data quality ensures the model's outputs are accurate and unbiased; lineage provides an audit trail from source to model; and access controls enforce security and privacy. These elements are foundational to trustworthy AI systems and are explicitly covered in governance frameworks like the NIST AI RMF and ISO/IEC 42001.

Answer

The model's marketing reach.

Answer

The color of the UI.

Answer

The model creator's salary.

Question 2

An organization is implementing 'Red Teaming' for AI. What is the main governance objective?

Accepted Answer

To proactively identify vulnerabilities and failure modes.. Red teaming for AI is a structured adversarial exercise where internal or external experts deliberately attempt to make the model fail — via prompt injection, jailbreaks, data poisoning, bias elicitation, or tool misuse — to surface vulnerabilities before real attackers do. The governance objective is proactive risk identification: producing a documented inventory of failure modes, their severity, and recommended mitigations that feed into the organization's risk register and deployment decisions.

Answer

To reduce operational costs.

Answer

To speed up deployment.

Answer

To increase the model size.

Question 3

What is the primary role of 'Model Versioning' in AI governance?

Accepted Answer

To ensure reproducibility and enable rollback of problematic versions.. Model versioning creates an immutable record of each model iteration — weights, hyperparameters, training data snapshot, and code — so that any deployed model can be reproduced exactly and rolled back if it misbehaves. In AI governance, this supports auditability, incident response, and regulatory compliance by providing traceability from prediction back to the exact model artifact. Without versioning, a problematic model cannot be reliably reverted or investigated.

Answer

To automate user login.

Answer

To maximize server storage usage.

Answer

To hide model architecture from hackers.

Question 4

What does 'Model Explainability' (XAI) primarily support in governance?

Accepted Answer

Transparency, trust, and regulatory compliance.. Model Explainability (XAI) supports governance by making AI decision-making transparent and interpretable, which builds trust with stakeholders and satisfies regulatory requirements for explainability (e.g., GDPR Article 22, EU AI Act high-risk obligations). It enables auditors, regulators, and affected individuals to understand why a model produced a given output. Cost, hardware security, and training speed are unrelated to XAI's governance purpose.

Answer

Lower infrastructure costs.

Answer

Hardware security.

Answer

Increased training speed.

Question 5

When a model fails in production, what is the first step in the 'Incident Response' process?

Accepted Answer

Containment and impact assessment.. The first step in incident response, including AI model failures, is containment and impact assessment. Containment stops the failure from spreading or causing further harm (e.g., disabling the model endpoint, reverting to a safe version), while impact assessment determines the scope, affected users, and business damage. This aligns with standard IR frameworks like NIST SP 800-61, where containment follows detection and precedes eradication and recovery.

Answer

Writing a press release.

Answer

Firing the developer.

Answer

Ignoring the error.

Question 6

Which document outlines the 'Roles and Responsibilities' for AI security?

Accepted Answer

The AI Governance Charter.. The AI Governance Charter is the foundational document that defines the governance structure for AI, including who owns what — the roles and responsibilities of the AI governance board, model owners, data stewards, security teams, and business units. It establishes accountability, decision rights, and escalation paths. This makes it the authoritative source for 'Roles and Responsibilities' in AI security.

Answer

The printer configuration manual.

Answer

A software license file.

Answer

The company holiday calendar.

Question 7

Which metric should be used to track 'Data Quality' for AI training?

Accepted Answer

Data accuracy, completeness, and consistency.. Data Quality for AI training is measured by the intrinsic characteristics of the dataset itself: accuracy (values are correct), completeness (no missing fields/records), and consistency (uniform formats and no contradictions across sources). These three dimensions directly determine whether a model learns valid patterns rather than noise or bias. Infrastructure metrics, communication counts, and UI cosmetics have no bearing on the statistical fidelity of training data.

Answer

The server rack temperature.

Answer

The number of emails sent.

Answer

The color of the data icons.

Question 8

A company is developing an internal LLM-based tool. Which activity is required for 'Accountability'?

Accepted Answer

Maintaining a log of model development and decision-making.. Accountability in AI governance means being able to demonstrate who did what, when, and why across the model lifecycle. Maintaining a log of model development and decision-making (C) creates the evidentiary record that supports traceability, audit, incident investigation, and regulatory response. Without such records, an organization cannot prove that its AI was developed and operated responsibly, which is the essence of accountability.

Answer

Deleting all documentation.

Answer

Limiting access to the CEO.

Answer

Outsourcing to a third party.

Question 9

What is the primary function of an 'AI Steering Committee'?

Accepted Answer

Strategic oversight, prioritization, and risk management.. An AI Steering Committee's primary function is strategic oversight, prioritization, and risk management for AI initiatives across the organization. It sets direction, approves high-risk use cases, allocates resources, and ensures AI activities align with business strategy and risk appetite. It is a governance body, not an operational or technical execution team.

Answer

Conducting individual performance reviews.

Answer

Writing all the software code.

Answer

To manage daily printer issues.

Question 10

What is 'AI Risk Appetite'?

Accepted Answer

The level of risk an organization is willing to accept.. AI Risk Appetite is the amount and type of risk an organization is willing to accept in pursuit of its AI objectives — it's a governance statement that bounds decision-making. It translates board-level tolerance into operational thresholds that guide model deployment, monitoring, and escalation. Without a defined appetite, risk decisions become ad hoc and inconsistent.

Answer

The amount of money spent on GPUs.

Answer

The number of employees using AI.

Answer

The speed of the AI model.

Question 11

What is the primary risk associated with 'Data Poisoning' in an AI governance program?

Accepted Answer

Compromised model integrity and reliability.. Data poisoning is an integrity attack in which an adversary manipulates training data to corrupt the model's learned behavior, degrading its accuracy, reliability, and trustworthiness. The primary governance risk is therefore compromised model integrity and reliability, which can lead to incorrect decisions, safety failures, and loss of stakeholder trust. This is a foundational AI security concern because it attacks the model at its source rather than at inference time.

Answer

System uptime improvement.

Answer

Increased cloud storage bills.

Answer

Reduced model file size.

Question 12

How does 'Continuous Monitoring' differ from 'Point-in-Time Auditing'?

Accepted Answer

Continuous monitoring provides real-time visibility into performance and threats.. Continuous monitoring provides real-time (or near-real-time) visibility into system performance, threats, and compliance posture, enabling immediate detection and response to anomalies. In contrast, point-in-time auditing captures a snapshot of controls and compliance at a specific moment, which can miss threats that emerge between audits. Continuous monitoring is a core principle of frameworks like NIST SP 800-137 and is essential for dynamic AI and cloud environments.

Answer

Auditing is only for small companies.

Answer

Monitoring is only for external systems.

Answer

Continuous monitoring is cheaper.

Question 13

Which department should own the 'AI Ethics Policy'?

Accepted Answer

Compliance/Legal or Ethics Office.. The AI Ethics Policy sets normative expectations for how AI is developed and used, covering fairness, transparency, privacy, and accountability. Ownership belongs with Compliance/Legal or the Ethics Office (D) because these functions interpret regulatory obligations, manage ethical risk, and have the independence and authority to enforce policy across business units. Placing ownership there ensures the policy is defensible, aligned with law and regulation, and not subordinated to IT operational priorities.

Answer

The IT helpdesk.

Answer

The cafeteria management.

Answer

The building security team.

Question 14

Which TWO factors are critical when assessing the risk of a new Generative AI use case?

Accepted Answer

The potential business impact if the system fails.. Option D is correct because risk assessment for a Generative AI use case must weigh the potential business impact if the system fails, including financial loss, operational disruption, reputational damage, and regulatory consequences, which determine the severity of the risk. Option E is correct because the sensitivity of the data being processed directly drives the likelihood and severity of harm, since handling PII, PHI, financial records, or trade secrets triggers stricter controls such as GDPR, HIPAA, or PCI DSS obligations and raises exposure to data leakage or misuse. Options A, B, and C are not critical risk factors: UI aesthetics affect user experience but not risk exposure, developer office location is irrelevant to the model's risk profile, and the programming language used is an implementation detail that does not materially change the business or data-sensitivity risk of the use case.

Answer

The aesthetic of the user interface.

Answer

The office location of the developers.

Answer

The programming language used.

Question 15

Which THREE actions should be included in an AI incident response plan?

Accepted Answer

Conducting a root cause analysis post-incident.. Option C (Conducting a root cause analysis post-incident) is correct because an AI incident response plan must include a post-incident review to determine why the failure occurred—such as data drift, model poisoning, or prompt injection—so controls can be improved and recurrence prevented. Option D (Isolating the affected AI system from production) is correct because containment is a core incident response step; quarantining the model, API endpoint, or inference pipeline prevents further harmful outputs, data leakage, or downstream impact while investigation proceeds. Option E (Notifying relevant stakeholders of the incident) is correct because timely communication to security, legal, compliance, affected users, and regulators is required for transparency, regulatory obligations, and coordinated remediation. Option A (Deleting the model without a backup) is not appropriate because destroying evidence and the model artifact prevents forensic analysis, rollback, and root cause investigation. Option B (Increasing the marketing budget) is unrelated to incident response and does nothing to contain, assess, or remediate an AI incident.

Answer

Deleting the model without a backup.

Answer

Increasing the marketing budget.