AAISM AI Governance And Program Management Practice Test 5 — 15 Questions

Question 1

An AI security team needs to ensure that internal AI tools comply with the organization's 'Human-in-the-Loop' policy. Which architectural control best enforces this governance requirement?

Accepted Answer

Integrating a mandatory 'human approval' task within the business logic workflow of the AI orchestration layer.. Embedding a mandatory human approval task directly in the orchestration workflow's business logic ensures that no AI decision proceeds to action without explicit human sign-off. This is an architectural enforcement — it cannot be bypassed by model behavior or user configuration. The other options are supporting controls but do not enforce the HITL gate.

Answer

Enabling role-based access control (RBAC) in the AI model management system.

Answer

Configuring audit logs for all AI interactions.

Answer

Updating the model weights to penalize autonomous decision-making.

Answer

Applying data loss prevention (DLP) rules to the model training dataset.

Question 2

When designing a secure AI development lifecycle (SDLC), which of the following is an essential governance activity during the 'Model Deployment' phase?

Accepted Answer

Finalizing the Model Card to document intended use, limitations, and security parameters.. The Model Card is the governance artifact that documents a model's intended use, limitations, performance characteristics, and security parameters, and finalizing it at deployment ensures downstream consumers and reviewers understand the model's boundaries and risks. It is an essential governance activity because it creates the accountability record required before a model goes live. Deployment gates typically require a completed model card as evidence of responsible release.

Answer

Running a brute-force attack on the model API.

Answer

Updating the GPU drivers on the inference servers.

Answer

Resetting the encryption keys for the production database.

Answer

Removing all training data from the production environment.

Question 3

A firm is drafting a policy for 'AI Use in Marketing'. Which element is most important to include to ensure alignment with existing data protection regulations?

Accepted Answer

Mandatory disclosure requirements when content is generated by AI.. Mandatory disclosure requirements when content is generated by AI directly support transparency and accountability obligations under data protection regulations like GDPR and CCPA. These laws require individuals to be informed about how their data is used and to have the ability to exercise rights; AI-generated content that involves personal data must be disclosed to avoid deceptive practices. By embedding disclosure into the marketing policy, the firm ensures that consumers are aware of automated decision-making and can challenge or opt out, aligning with legal requirements for fair and transparent processing.

Answer

A mandate to use only open-source AI models.

Answer

A list of all approved GPU hardware vendors.

Answer

The specific programming languages authorized for AI development.

Question 4

During an internal audit of the AI program, it is found that the organization lacks a 'Model Inventory'. What is the most immediate risk to the AI security program?

Accepted Answer

Inability to perform security risk assessments or lifecycle management for shadow AI models.. A Model Inventory is the foundational register that catalogs all AI/ML models in use, their owners, purposes, data sources, risk classifications, and lifecycle status. Without it, the organization cannot identify which models exist, cannot assess their security risks, and cannot manage them through their lifecycle — critically, shadow AI models deployed outside governance visibility go completely unmanaged. This directly undermines the AI security program's ability to perform risk assessments and lifecycle management.

Answer

High costs associated with cloud compute resources.

Answer

Incompatibility between the model and the underlying operating system.

Answer

Increased latency in AI model responses.

Question 5

Which THREE activities should be included in an AI Security Governance Program to effectively manage model supply chain risks?

Accepted Answer

Verifying the integrity and origin of pre-trained models via digital signatures.. Option A is correct because verifying the integrity and origin of pre-trained models via digital signatures ensures that models pulled from external sources have not been tampered with and come from trusted publishers, directly mitigating supply chain tampering and substitution attacks. Option B is correct because automating the review of model license agreements enforces open-source compliance policies, preventing legal and licensing risks that arise when third-party or pre-trained models carry restrictive or incompatible terms. Option E is correct because maintaining a Software Bill of Materials (SBOM) for all AI model components and dependencies provides the transparency needed to track libraries, datasets, and transitive dependencies, enabling rapid vulnerability and provenance response across the model supply chain. Option C does not belong because monthly inference-speed benchmarking is a performance/operations activity, not a supply chain risk control. Option D does not belong because increasing R&D budget is a financial/resourcing decision and does not itself manage model supply chain risks.

Answer

Conducting monthly performance benchmarking of model inference speed.

Answer

Increasing the budget for AI model research and development.

Question 6

Which THREE factors are critical when establishing an AI risk reporting structure for executive leadership?

Accepted Answer

Alignment of AI security posture with corporate risk appetite and strategic goals.. Option B is correct because an AI risk reporting structure must tie AI security posture directly to the organization's stated risk appetite and strategic objectives, ensuring executives receive risk information framed in terms of business impact and tolerance thresholds. Option C is correct because current regulatory compliance status against applicable AI legal frameworks (e.g., the EU AI Act, NIST AI RMF, sector-specific rules) is a governance obligation that executives must monitor and report on to avoid legal and fiduciary exposure. Option D is correct because the evolving threat landscape targeting AI systems, such as prompt injection, model inversion, and data poisoning trends, determines which risks are material and should be surfaced to leadership for prioritization and resourcing. Option A is not correct because GPU count is an infrastructure capacity metric, not a governance or risk-reporting factor for executive leadership. Option E is not correct because specific Python libraries used in model training are low-level implementation details irrelevant to executive-level risk reporting.

Answer

The total number of GPUs available in the data center.

Answer

The specific Python libraries used for model training.

Question 7

An organization is updating its AI governance policy for high-risk systems. Which TWO requirements should be mandated to ensure accountability and forensic capability?

Accepted Answer

Enabling detailed audit logging of all user prompts and model responses.. Option C is correct because enabling detailed audit logging of all user prompts and model responses creates the forensic trail needed to reconstruct what the AI system received and produced, which is essential for incident investigation, root-cause analysis, and demonstrating compliance in high-risk AI governance. Option E is correct because a 'record of authority' that documents the individual responsible for each model's risk decisions establishes explicit accountability, ensuring that risk acceptance and mitigation choices can be traced to a named owner rather than an anonymous team. Options A, B, and D do not belong: restricting development to physical locations (A) is a weak physical-security control that does not provide accountability or forensic evidence, dual-factor authentication for IDE access (B) is a sound access control but authenticates developers rather than recording AI behavior or decision ownership, and limiting the number of users interacting with the model (D) reduces exposure but neither assigns responsibility for risk decisions nor preserves an auditable record of prompts and responses.

Answer

Restricting AI development to specific physical locations.

Answer

Requiring all AI developers to use dual-factor authentication for IDE access.

Answer

Limiting the number of users who can interact with the AI model.

Question 8

A multinational bank has deployed an AI governance program aligned with the NIST AI Risk Management Framework. The Chief Risk Officer asks how to ensure that AI risks are consistently identified, assessed, and treated across all business units. Which structural element is most critical for achieving this consistency?

Accepted Answer

A centralized AI risk register integrated into the enterprise risk management framework. A centralized AI risk register integrated into ERM provides the structured, consistent mechanism to identify, assess, and treat AI risks across all business units. It aligns with NIST AI RMF and enables aggregated reporting to the CRO. Other options are either awareness-focused or operational, and do not deliver enterprise-wide risk management consistency.

Answer

An annual AI ethics training program for all employees

Answer

A quarterly AI innovation committee that reviews new use cases

Answer

A dedicated AI security operations center (SOC) that monitors model APIs

Question 9

A healthcare organization has an AI governance policy that requires all AI systems to undergo a pre-deployment risk assessment. A data science team is eager to deploy a new diagnostic model and argues that the assessment will delay a critical clinical trial. As the AI governance lead, which action best upholds the governance program while addressing the team's urgency?

Accepted Answer

Escalate the conflict to the AI governance committee for a risk-based decision on whether to expedite or enforce the assessment. Escalating to the AI governance committee upholds the governance program by following the established decision-making process. The committee can weigh urgency against risk and authorize an expedited path if appropriate, maintaining accountability and policy integrity. Other options bypass or weaken the required pre-deployment assessment, undermining governance.

Answer

Instruct the team to self-assess the model using a checklist and proceed if no high risks are identified

Answer

Grant a temporary exemption from the risk assessment, provided the team submits a post-deployment assessment within 30 days

Answer

Allow the deployment to proceed and assign a risk analyst to perform the assessment concurrently

Question 10

A multinational financial services firm has deployed a generative AI assistant for its customer support agents. The AI governance committee has approved the tool, but the Chief Information Security Officer is concerned that the firm cannot demonstrate to regulators that the AI's outputs are being monitored for harmful or biased content on an ongoing basis. Which of the following is the MOST appropriate control to address this concern?

Accepted Answer

Implement an AI output monitoring and logging solution that captures model responses, flags anomalous or biased outputs, and retains records for audit review.. The correct answer is the implementation of an AI output monitoring and logging solution. This provides the continuous, auditable evidence regulators expect, showing that the organization actively monitors for harmful or biased content. Manual review, one-time assessments, and template restrictions do not deliver the systematic oversight and audit trail required for AI governance.

Answer

Require customer support agents to manually review every AI-generated response before sending it to customers.

Answer

Disable the AI assistant's ability to generate free-text responses and restrict it to predefined templates.

Answer

Conduct a one-time bias assessment of the AI model before deployment and document the results.

Question 11

A global retailer is expanding its AI governance program to include third-party AI vendors. The Chief AI Officer wants to ensure that vendor-provided AI systems are subject to the same risk management rigor as internally developed models. Which TWO activities should be prioritized to integrate third-party AI into the governance framework? (Choose two.)

Accepted Answer

Conduct periodic security assessments of vendor AI systems, including penetration testing and review of their AI incident response plans.. Prioritizing vendor model documentation and periodic security assessments ensures transparency and ongoing risk management for third-party AI. Documentation reveals potential risks, while security assessments verify controls over time. Delegating responsibility, limiting usage, or mandating identical tools do not provide the necessary oversight and integration into the governance framework.

Answer

Require vendors to use the same AI development tools and platforms as the organization to ensure compatibility.

Answer

Delegate all AI risk management responsibilities to the vendor and rely on their internal governance processes.

Answer

Limit vendor AI usage to non-critical business functions to reduce potential impact.

Question 12

A multinational bank's AI governance committee is drafting its charter. The General Counsel insists that the charter explicitly state who bears ultimate responsibility for the organization's AI-related legal and regulatory outcomes, and that this be documented and approved at the highest level. Which element of the AI governance charter is the General Counsel requiring?

Accepted Answer

A defined AI accountability structure that assigns ultimate ownership of AI outcomes to a named executive body. The General Counsel is asking for governance ownership, not operational controls. An AI governance charter must name the executive or board-level body that ultimately owns AI outcomes, including legal and regulatory consequences. Intake processes, monitoring standards, and control baselines support that ownership but do not establish it.

Answer

A model performance monitoring standard defining drift thresholds and retraining triggers

Answer

A technical control baseline specifying minimum encryption and access controls for AI model endpoints

Answer

An AI use-case intake process requiring business units to register proposed AI tools before deployment

Question 13

A global retailer's AI program office is defining how AI risks will be escalated. The Chief Risk Officer wants assurance that a severe AI incident, such as a customer-facing model producing discriminatory pricing, reaches executive leadership within hours rather than days. Which element of the AI risk reporting structure is most critical to meet this requirement?

Accepted Answer

Predefined severity classification criteria with explicit escalation triggers and time-bound notification paths to executive leadership. Rapid escalation depends on agreed severity thresholds and pre-built notification paths with target times. Dashboards, audits, and inventories are valuable governance artifacts, but none of them ensures a severe incident reaches executives within hours. Predefined triggers remove ambiguity and delay at the moment of crisis.

Answer

An annual third-party audit of AI model fairness and bias testing procedures

Answer

A centralized AI model inventory listing owners, versions, and deployment environments

Answer

A quarterly AI risk dashboard summarizing model performance metrics across all business units

Question 14

A healthcare organization is deploying an AI system to triage patient symptoms. The AI governance committee is reviewing the program's compliance with the organization's AI ethics principles. Which of the following is the MOST effective way to ensure that the AI system's decisions are explainable to clinicians and patients?

Accepted Answer

Implement a post-hoc explanation tool that provides feature importance scores for each AI recommendation.. Implementing a post-hoc explanation tool provides feature importance scores that clarify why a specific recommendation was made, directly supporting explainability for clinicians and patients. The other options either sacrifice accuracy, provide irrelevant technical details, or offer only confidence levels without reasoning, failing to meet the ethical requirement for decision-level transparency.

Answer

Provide clinicians with a detailed technical report of the model's architecture and training data.

Answer

Use a simple, inherently interpretable model like a decision tree instead of a complex deep learning model.

Answer

Ensure the AI system's output includes a confidence score for each recommendation.

Question 15

A technology company has developed an AI model for autonomous decision-making in its supply chain. The AI governance team is tasked with establishing a process for continuous monitoring of the model's performance and risk. Which of the following is the MOST critical element to include in the monitoring process to detect model drift?

Accepted Answer

Tracking changes in the statistical distribution of input data over time.. Tracking changes in input data distributions is the most critical element for detecting model drift because it directly identifies covariate shift, a primary cause of performance degradation. Other options focus on usage metrics, static historical performance, or code management, none of which provide early warning of drift in a live supply chain environment.

Answer

Ensuring the model's code repository is version-controlled and changes are logged.

Answer

Recording the number of API calls made to the model each day.

Answer

Reviewing the model's training loss and accuracy metrics on the original test set.