AAISM AI Risk Management Practice Test 2 — 15 Questions

Question 1

Which of the following best describes 'Model Inversion' as a security risk?

Accepted Answer

An attacker probes the model to reconstruct training samples.. Model Inversion is a privacy attack in which an adversary repeatedly queries a deployed model and analyzes the input-output relationship to reverse-engineer sensitive details of the training data, potentially reconstructing representative samples or inferring attributes of individuals in the training set. It exploits the fact that ML models memorize statistical patterns (and sometimes specific records) from their training data, leaking that information through predictions and confidence scores.

Answer

The model is overwritten with malicious logic.

Answer

The model becomes unavailable to users.

Answer

The model predicts the wrong output due to noisy inputs.

Question 2

Which THREE technical controls are recommended to secure an AI model's API endpoint?

Accepted Answer

Enforcing strict schema validation on all inputs.. Option C is correct because enforcing strict schema validation on all inputs rejects malformed or unexpected payloads before they reach the model, mitigating injection attacks, prompt manipulation, and deserialization issues at the API boundary. Option D is correct because rate limiting (e.g., token-bucket or fixed-window limits per API key/IP) throttles abusive request volumes, which directly hinders model scraping, extraction attacks, and denial-of-service attempts against the endpoint. Option E is correct because OIDC or API key-based authentication verifies caller identity and enforces authorization before any inference request is processed, preventing anonymous or unauthorized access to the model API. Option A does not belong because encrypting model weights at rest protects stored artifacts, not the API endpoint's runtime traffic or access. Option B does not belong because removing all logging eliminates audit trails and detection capability; log injection should instead be prevented by sanitizing and encoding log output, not by disabling logging.

Answer

Encrypting the model weights at rest in the cloud.

Answer

Removing all logging to prevent log injection.

Question 3

When conducting a risk assessment for an AI system, which TWO of the following are considered 'AI System' components that require individual threat assessment?

Accepted Answer

The training and inference data pipelines.. Option A is correct because the training and inference data pipelines are core AI System components: they ingest, transform, and serve the data the model learns from and acts on, so threats such as data poisoning, tampering, or pipeline compromise must be assessed individually. Option D is correct because the model artifact and its weights constitute the trained model itself, and threats like model theft, weight tampering, backdoor insertion, or adversarial manipulation require dedicated assessment. Options B, C, and E are not AI System components: physical office building security, developers' personal devices, and internal organizational culture are general environmental, endpoint, or human/organizational factors that may influence overall risk but are not part of the AI system's technical architecture requiring component-level threat assessment.

Answer

The physical office building security.

Answer

The personal devices of the developers.

Answer

The internal organizational culture.

Question 4

You are implementing 'AI Red Teaming'. What is the most effective way to test against prompt injection?

Accepted Answer

Execute a series of iterative adversarial prompt attempts against the production model.. Executing iterative adversarial prompt attempts against the production model is the most effective way to test for prompt injection because it directly exercises the attack surface — the model's input handling — under real conditions. Prompt injection is an input-layer vulnerability, so the only reliable test is to attempt injections and observe whether the model follows injected instructions, leaks system prompts, or bypasses guardrails. Iterative testing (red teaming) allows testers to refine payloads based on model responses.

Answer

Check for compliance with data privacy laws.

Answer

Review the training data logs for errors.

Answer

Scan the code repository for hardcoded secrets.

Question 5

You are managing risks for a federated learning deployment. What is the primary security concern regarding the 'model updates' sent from the edge clients to the aggregator?

Accepted Answer

Gradient leakage leading to privacy loss.. In federated learning, edge clients send model updates (e.g., gradients) to a central aggregator. These updates can inadvertently leak sensitive information about the local training data. Gradient leakage attacks can reconstruct original data from gradients, leading to privacy loss. Thus, the primary security concern is privacy leakage from model updates.

Answer

The aggregator becoming a single point of failure.

Answer

Encryption of the communication channel.

Answer

Slow network speeds at the edge.

Question 6

Which THREE criteria are essential for evaluating the risk of an AI vendor's 'Model Card'?

Accepted Answer

Disclosure of training data sources.. Option A is correct because a Model Card must disclose training data sources so evaluators can assess provenance, licensing, consent, and potential bias introduced by the data. Option B is correct because performance metrics broken down across demographic groups reveal disparate impact and fairness risks that aggregate accuracy scores would hide. Option E is correct because documented known limitations and failure modes define the boundaries of safe use and the residual risk when the model is deployed outside its intended context. Option C does not belong because a vendor's annual financial report addresses corporate fiscal health, not the model's risk profile. Option D does not belong because headcount is an organizational metric with no direct bearing on model risk, bias, or reliability.

Answer

The vendor's annual financial report.

Answer

The number of employees at the vendor.

Question 7

Which TWO of the following are considered 'AI Supply Chain' risks?

Accepted Answer

Inclusion of poisoned data in third-party datasets.. Option A is correct because AI supply chain risk explicitly covers the ingestion of third-party datasets that may contain poisoned or tampered training data, which can corrupt model behavior or implant backdoors. Option B is correct because pre-trained model weights downloaded from model hubs are external artifacts that can carry hidden vulnerabilities, backdoors, or malicious code, making them a core supply chain risk. Options C, D, and E are not AI supply chain risks: lack of developer training is an internal skills/awareness issue, excessive cloud storage is a resource-management concern, and high staff turnover is a human-resources/continuity issue, none of which involve compromised external components or data flowing into the AI system.

Answer

Lack of internal developer training.

Answer

Excessive use of cloud storage.

Answer

High turnover of AI research staff.

Question 8

What is the most effective control to prevent 'Model Scraping' from an exposed AI prediction API?

Accepted Answer

Implement tiered access and rate limiting.. Model scraping involves repeatedly querying a prediction API to reconstruct the model's behavior or extract training data. Tiered access combined with rate limiting is the most effective control because it constrains query volume per identity and gates higher-volume access behind stricter authorization, making large-scale extraction economically and technically infeasible. This directly targets the scraping mechanism rather than relying on legal or cosmetic deterrents.

Answer

Require users to sign a Terms of Service agreement.

Answer

Increase the complexity of the model.

Answer

Use an obfuscated model file name.

Question 9

When assessing AI third-party vendor risk, which document is most useful for understanding the vendor's data handling practices?

Accepted Answer

The Data Processing Agreement (DPA).. A Data Processing Agreement (DPA) is the contractual document that specifies how a vendor processes, stores, transfers, and protects personal data, including subprocessors, retention, breach notification, and cross-border transfer mechanisms. It is the primary artifact for assessing third-party data handling risk under regulations like GDPR and CCPA.

Answer

The user interface mockups.

Answer

The company's marketing brochure.

Answer

The vendor's quarterly earnings statement.

Question 10

You are managing an AI project and notice the model is performing poorly on a subset of data representing a protected class. What is the correct next step in the risk assessment process?

Accepted Answer

Investigate the data representation and training balance for that subgroup.. When a model underperforms on a protected subgroup, the correct risk-management response is to investigate root causes — typically data underrepresentation, label imbalance, or sampling bias — before taking remediation action. This diagnostic step preserves the model and data while identifying the specific fairness gap to address.

Answer

Immediately delete all training data.

Answer

Dismiss the finding as a minor edge case.

Answer

Replace the model architecture with a simpler one.

Question 11

Which THREE practices are necessary for managing 'AI Model Version Control' as part of an overall risk management strategy?

Accepted Answer

Using Git-based tracking for model configuration and code.. Option B is correct because Git-based tracking provides immutable, auditable version history for model code, configuration files, and pipeline definitions, which is essential for reproducibility and rollback in a risk management strategy. Option C is correct because maintaining a complete lineage of training data for each model version enables traceability, bias investigation, and compliance auditing, ensuring you can reproduce and justify any deployed model. Option E is correct because automated logging of training parameters and hyperparameters (e.g., learning rate, batch size, epochs, random seeds) captures the exact conditions under which each version was produced, which is necessary for reproducibility and drift analysis. Option A is not appropriate because restricting modification to a single developer creates a single point of failure and removes peer review, weakening governance rather than strengthening version control. Option D is not appropriate because storing only the production model artifact discards prior versions, training metadata, and lineage, making rollback, auditing, and root-cause analysis impossible.

Answer

Allowing only one developer to modify the model.

Answer

Storing only the production model artifact.

Question 12

Which TWO measures are most effective in reducing the risk of 'Hallucinations' in LLM systems?

Accepted Answer

Using Retrieval-Augmented Generation (RAG).. Option B, Retrieval-Augmented Generation (RAG), is correct because it grounds the model's responses in retrieved, verifiable external documents at inference time, so the LLM conditions its output on factual context rather than relying solely on parametric memory, which substantially reduces fabricated content. Option C, providing clear system prompts defining constraints, is correct because explicit instructions (e.g., 'answer only from the provided context,' 'say I don't know if unsure') steer the model away from speculative generation and reduce unsupported claims. Option A is not effective because simply training on larger public internet datasets does not eliminate hallucination and can even amplify it, since web data contains misinformation and the model still lacks a grounding mechanism at inference. Option D is irrelevant because removing punctuation does not affect factual grounding and may degrade input comprehension. Option E is counterproductive because raising temperature to 2.0 increases sampling randomness and diversity, which typically increases hallucination rather than reducing it.

Answer

Training the model on larger public internet datasets.

Answer

Removing all punctuation from the input.

Answer

Increasing the model's temperature parameter to 2.0.

Question 13

Which THREE factors must be included in a 'Model Risk Management' (MRM) policy?

Accepted Answer

Clear model lifecycle stages and governance gates.. Option B is correct because an MRM policy must define the model lifecycle stages (e.g., development, validation, deployment, monitoring, retirement) and the governance gates/approvals required to move between them, ensuring accountability and control. Option D is correct because independent model validation — performed by parties not involved in model development — is a core MRM control to objectively assess conceptual soundness, data quality, and performance before and after deployment. Option E is correct because MRM requires defined quantitative thresholds for model performance and drift (e.g., PSI, KS statistic, accuracy/AUC degradation limits) so that monitoring can trigger remediation, retraining, or decommissioning. Option A is not required because an MRM policy governs models and processes, not an inventory of every individual AI user; user access is handled by separate access-management and training policies. Option C is not required because cataloging published research papers is not a governance control for model risk; MRM focuses on model inventory, validation, monitoring, and controls rather than publication records.

Answer

The names of all employees who use the AI.

Answer

A list of all model research papers published by the company.

Question 14

Which TWO techniques help mitigate 'Model Poisoning'?

Accepted Answer

Data sanitization and filtering of training inputs.. Model poisoning occurs when an adversary injects malicious or corrupted samples into the training data to skew the learned parameters, so data sanitization and filtering of training inputs (A) is correct because it detects and removes anomalous, mislabeled, or adversarial records before they influence gradient updates. Robust statistical aggregation for training data (C) is also correct because techniques such as trimmed mean, median, or Krum-style aggregation limit the influence of outlier or poisoned updates, especially in distributed or federated learning. Increasing the number of neurons (B) only changes model capacity and does not address corrupted training inputs, while moving the model to a public cloud (D) may actually expand the attack surface rather than mitigate poisoning. Reducing the number of training epochs (E) merely shortens training and can even leave the model underfit without preventing poisoned data from being learned.

Answer

Increasing the number of neurons in the model.

Answer

Moving the model to a public cloud environment.

Answer

Reducing the number of training epochs.

Question 15

What is 'AI Shadowing' or 'Shadow AI' in an enterprise setting?

Accepted Answer

Employees using unapproved AI tools for work tasks.. Shadow AI refers to employees using unapproved AI tools — such as public LLM chatbots, browser extensions, or SaaS AI features — for work tasks without IT or security oversight. This creates data leakage, compliance, and intellectual property risks because sensitive information may be sent to third-party services outside the organization's governance.

Answer

The practice of monitoring AI usage in real-time.

Answer

The process of testing models before release.

Answer

The use of AI for internal cybersecurity tasks only.