AAISM AI Governance And Program Management Practice Test 4 — 15 Questions

Question 1

Which TWO areas should be covered by an AI procurement policy?

Accepted Answer

Contractual clauses for data privacy and IP protection.. Option D is correct because an AI procurement policy must address contractual clauses for data privacy and IP protection, ensuring that data used to train or operate AI systems is handled lawfully (e.g., under GDPR or CCPA) and that ownership of models, outputs, and training data is clearly defined. Option E is correct because mandatory security due diligence for AI vendors is essential to assess risks such as model poisoning, data leakage, insecure APIs, and supply-chain vulnerabilities before onboarding a third-party AI service. Options A, B, and C are incorrect because a vendor's logo color, office furniture, and employee headcount are irrelevant to the governance, legal, and security concerns that an AI procurement policy is designed to cover.

Answer

The color of the vendor's logo.

Answer

The vendor's choice of office furniture.

Answer

The number of employees at the vendor.

Question 2

Which THREE metrics should be monitored for 'Model Performance' and security?

Accepted Answer

Inference latency.. Inference latency (A) is a core Model Performance metric because it measures the time from request to prediction, and a rising latency can indicate resource contention, model degradation, or a denial-of-service condition affecting availability. Unexpected error rate increases (B) are essential for both performance and security, since spikes in failed inferences, exceptions, or 5xx responses can reveal model bugs, bad inputs, or adversarial probing and attacks. Model drift (D), the decay of predictive performance over time as data distributions change, must be monitored to detect accuracy degradation and potential data poisoning or concept drift that undermines model reliability. The unmarked options do not belong: developer coffee breaks (C) are irrelevant to system metrics, and total electricity cost (E) is a facilities or billing concern, not a model performance or security indicator.

Answer

Number of coffee breaks taken by developers.

Answer

Total cost of electricity.

Question 3

Which TWO components are essential for a robust AI Governance framework?

Accepted Answer

Defined roles and accountability structures.. Option B is correct because a robust AI Governance framework requires clearly defined roles and accountability structures—such as an AI governance board, responsible AI officers, and data stewards—so that decision rights, oversight, and escalation paths for AI systems are unambiguous. Option E is correct because formal AI policies and standards provide the documented rules, controls, and ethical principles (for example, risk classification, model approval, bias testing, and monitoring requirements) that make governance enforceable and auditable. The remaining options do not belong: a company party schedule (A) is unrelated to governance, a list of all employee names (C) is merely a personnel roster and not a governance mechanism, and best-selling AI books (D) are general educational resources rather than essential governance components.

Answer

The company party schedule.

Answer

A list of all employee names.

Answer

The best-selling AI books.

Question 4

Which THREE security controls are effective against 'Data Leakage' in AI?

Accepted Answer

Data Loss Prevention (DLP) tools.. Data Loss Prevention (DLP) tools (A) are effective because they inspect and block sensitive data such as PII, PHI, or credentials from leaving approved boundaries via email, endpoints, or cloud uploads, directly mitigating exfiltration. Granular Role-Based Access Control (RBAC) (C) limits which users, service accounts, or pipelines can query or retrieve sensitive datasets and model outputs, enforcing least privilege so unauthorized parties cannot access data that could leak. AI output filtering for PII (D) scans model responses before delivery and redacts or blocks regulated identifiers, preventing leakage through generated text that may reproduce memorized or inferred sensitive data. A louder cooling system (B) is purely a physical/thermal concern and has no bearing on confidentiality or data exfiltration. Increasing the model's training duration (E) affects model quality or convergence, not leakage prevention, and could even increase memorization risk.

Answer

Using a louder cooling system.

Answer

Increasing the model's training duration.

Question 5

Which THREE documents are vital for an AI audit trail?

Accepted Answer

Model validation and testing reports.. Model validation and testing reports (B) are vital because they document how the AI model's performance, accuracy, bias, and robustness were assessed before and after deployment, providing auditable evidence of due diligence. Training data source documentation (C) is essential since it records the provenance, licensing, collection methods, and characteristics of the data used to train the model, which is necessary for tracing outputs and demonstrating compliance with data governance requirements. Model versioning history (D) is required to establish a traceable record of changes, retraining events, hyperparameters, and rollbacks, enabling auditors to reproduce or explain the behavior of any given model version at a point in time. The office lease agreement (A) and a copy of the employee handbook (E) are unrelated to the technical and data governance artifacts needed to reconstruct an AI system's development and decision-making, so they do not belong in an AI audit trail.

Answer

The office lease agreement.

Answer

A copy of the employee handbook.

Question 6

Which TWO activities ensure 'AI Safety' in development?

Accepted Answer

Adversarial testing (red teaming).. Option B, adversarial testing (red teaming), is correct because it proactively probes AI models for harmful, biased, or unsafe outputs by simulating malicious inputs, enabling developers to identify and remediate vulnerabilities before deployment. Option E, comprehensive documentation of safety guidelines, is correct because it establishes explicit policies, risk thresholds, and mitigation procedures that govern the AI lifecycle, ensuring accountability and consistent safety practices across teams. The remaining options do not ensure AI safety: unmonitored cloud servers (A) remove oversight and incident detection, increasing data exposure and misuse risk; simply increasing public data volume (C) can amplify bias, privacy violations, and unvetted content rather than improve safety; and removing all encryption (D) weakens data confidentiality and integrity, directly undermining security controls that support safe AI development.

Answer

Using unmonitored cloud servers.

Answer

Increasing the amount of public data used.

Answer

Removing all encryption.

Question 7

Which THREE factors increase 'AI Model Risk'?

Accepted Answer

High model complexity (black box).. Option A is correct because high model complexity, such as deep neural networks or ensemble methods that behave as black boxes, makes it harder to understand decision boundaries, validate behavior, and detect hidden failure modes, which directly raises AI model risk. Option B is correct because when a model drives safety-critical business processes, errors or biased outputs can cause physical harm, regulatory violations, or major financial loss, so the potential impact magnifies the overall risk. Option E is correct because low explainability/interpretability prevents stakeholders, auditors, and regulators from understanding why a prediction was made, undermining trust, accountability, and the ability to challenge or correct harmful outputs. Option C is not correct because a low-latency network is a performance and infrastructure characteristic that does not inherently increase model risk. Option D is not correct because using a well-documented framework generally improves governance, reproducibility, and transparency, thereby reducing rather than increasing model risk.

Answer

Using a low-latency network.

Answer

Using a well-documented framework.

Question 8

Which TWO aspects of 'Transparency' are most important for AI stakeholders?

Accepted Answer

Disclosing the use of AI to the end-user.. Transparency for AI stakeholders centers on making the AI's role and reasoning visible and understandable. Option C is correct because disclosing the use of AI to the end-user ensures people know when they are interacting with or affected by an AI system, which is a foundational transparency requirement in AI ethics frameworks and regulations such as the EU AI Act's transparency obligations. Option D is correct because providing a clear explanation of how the AI reaches decisions (e.g., explainability, interpretability, or model cards) lets stakeholders understand, audit, and challenge outputs, which is essential for accountability and trust. Option A is not relevant because server rack IDs are infrastructure asset details unrelated to AI transparency toward stakeholders. Option B is not relevant because marketing budget information does not reveal how the AI works or that it is being used. Option E is not relevant and would violate privacy, as developer home addresses have no bearing on AI transparency.

Answer

Providing a list of all server rack IDs.

Answer

Publishing the model's marketing budget.

Answer

Sharing the home addresses of developers.

Question 9

Which TWO reporting formats are effective for executive AI oversight?

Accepted Answer

Executive summaries of AI performance and risk.. Option C is correct because executive summaries distill AI performance metrics, business impact, and risk posture into a concise, decision-oriented format that non-technical leadership can act on quickly. Option D is correct because high-level risk heatmaps visually prioritize AI risks by likelihood and impact, enabling executives to focus oversight on the most material exposures. Options A, B, and E are not appropriate: full source code printouts and raw system logs are low-level technical artifacts that overwhelm executive audiences and obscure governance-relevant insight, while a list of server IP addresses is infrastructure detail with no bearing on AI performance, risk, or strategic oversight.

Answer

Full source code printouts.

Answer

Raw system logs in text files.

Answer

A list of all server IP addresses.

Question 10

Which THREE items should be included in an 'AI Inventory'?

Accepted Answer

Unique model identifier and version.. An AI inventory must track each model's unique model identifier and version (B) so that specific artifacts can be located, audited, and reproduced, since different versions can behave differently and require distinct governance. It should also record the assigned risk classification (D), because risk tiering (e.g., high-risk vs. minimal-risk) determines the controls, documentation, and review cadence applied to the model. The designated business owner (E) is essential for accountability, ensuring a named party is responsible for the model's lifecycle, approvals, and incident response. Options A and C are irrelevant personal preferences that have no bearing on governance, traceability, or risk management, so they do not belong in an AI inventory.

Answer

The model's favorite color.

Answer

The developer's favorite food.

Question 11

Which TWO aspects of 'Compliance' must be addressed by an AI governance program?

Accepted Answer

Alignment with applicable legal and regulatory requirements.. Compliance in an AI governance program means ensuring the organization's AI systems and processes conform to binding external and internal requirements. Option A is correct because alignment with applicable legal and regulatory requirements is a core compliance obligation — for example, adhering to data protection laws such as GDPR, sector rules like HIPAA, or emerging AI regulations such as the EU AI Act, which impose mandatory duties on AI providers and deployers. Option D is correct because adherence to client-specific contractual obligations is also a compliance requirement; contracts often impose AI-related terms such as data processing agreements, model usage restrictions, service-level commitments, and audit rights that the governance program must enforce. The remaining options do not belong: following fashion trends (B) is irrelevant to governance, office building architecture (C) concerns facilities rather than AI compliance, and selecting the cheapest printer brand (E) is a procurement cost decision unrelated to regulatory or contractual compliance.

Answer

Following the latest fashion trends.

Answer

The office building's architecture.

Answer

Selecting the cheapest printer brand.

Question 12

Which THREE activities help manage 'AI Lifecycle' risk?

Accepted Answer

Pre-deployment design and threat modeling.. Option A is correct because pre-deployment design and threat modeling identify AI-specific risks (e.g., data poisoning, model evasion, prompt injection, bias) before the system is fielded, allowing controls to be built in rather than bolted on. Option B is correct because formal decommissioning and sunsetting processes manage end-of-life risk by retiring models, revoking credentials, archiving or destroying training data, and preventing stale or unsupported AI components from remaining exploitable. Option E is correct because continuous operational monitoring detects model drift, data drift, performance degradation, and anomalous inference behavior during runtime, which is essential since AI risk evolves after deployment. Option C is incorrect because ignoring software updates leaves known vulnerabilities unpatched and increases lifecycle risk. Option D is incorrect because bypassing security reviews for speed skips necessary risk assessment and control validation, directly undermining AI lifecycle risk management.

Answer

Ignoring all software updates.

Answer

Bypassing security reviews for speed.

Question 13

Which TWO strategies are recommended for 'Human-in-the-Loop' governance?

Accepted Answer

Standardizing workflows for human intervention.. Option C is correct because standardizing workflows for human intervention ensures that Human-in-the-Loop governance is applied consistently, repeatably, and auditably across processes rather than relying on ad hoc judgment. Option E is correct because defining clear decision-making thresholds specifies exactly when a human must review, approve, or escalate an AI-generated decision, which is the core mechanism that keeps humans meaningfully in control. Together, these strategies establish both the process structure and the trigger criteria needed for effective human oversight. Option A is incorrect because using only AI for all HR decisions eliminates the human element entirely, which contradicts the Human-in-the-Loop principle. Option B is incorrect because allowing overrides without logging destroys the audit trail and accountability that governance requires. Option D is incorrect because removing humans to save money is the opposite of Human-in-the-Loop governance and removes necessary oversight.

Answer

Using only AI for all HR decisions.

Answer

Allowing humans to override without logging.

Answer

Removing humans to save money.

Question 14

A security manager is integrating AI governance into the existing NIST AI RMF framework. Which action best ensures alignment between AI security controls and business risk appetite?

Accepted Answer

Establishing a cross-functional AI steering committee to review and approve risk tolerance thresholds for AI use cases.. Aligning AI security controls with business risk appetite requires governance, not just technology. A cross-functional AI steering committee (C) brings together security, legal, data science, and business owners to define, review, and approve risk tolerance thresholds for AI use cases, ensuring controls map to what the business is actually willing to accept. This is the NIST AI RMF 'Govern' function in action, linking MAP, MEASURE, and MANAGE outcomes to organizational risk posture.

Answer

Deploying automated adversarial attack simulations against all LLM endpoints.

Answer

Implementing a strict zero-trust policy for all internal AI model training datasets.

Answer

Configuring AWS GuardDuty for Amazon Bedrock to monitor for unauthorized API calls.

Question 15

A board of directors requests a summary of AI risk exposure. Which metric provides the most relevant insight into AI security program maturity?

Accepted Answer

The percentage of AI models that have completed a formal governance and security certification.. The percentage of AI models that have completed formal governance and security certification is the most direct indicator of program maturity because it measures how much of the AI estate has been subjected to structured review. It reflects both coverage (how many models are in scope) and rigor (whether they passed certification). Board-level reporting needs this kind of governance coverage metric, not operational telemetry.

Answer

The average response time of the AI chatbot interface.

Answer

The total number of GPU hours utilized for model training.

Answer

The total number of AI-related code commits in the CI/CD pipeline.