AAISM AI Risk Management Practice Test 2 — 15 Questions

Question 1

Which THREE criteria are essential for evaluating the risk of an AI vendor's 'Model Card'?

Accepted Answer

Disclosure of training data sources.. Model Cards provide transparency regarding intended use, limitations, and performance, which are critical for risk assessment.

Answer

The vendor's annual financial report.

Answer

The number of employees at the vendor.

Question 2

Which TWO of the following are considered 'AI Supply Chain' risks?

Accepted Answer

Inclusion of poisoned data in third-party datasets.. AI supply chain risks include dependencies on external data and untrusted pre-trained models.

Answer

Lack of internal developer training.

Answer

Excessive use of cloud storage.

Answer

High turnover of AI research staff.

Question 3

A model is vulnerable to 'Evasion Attacks' using FGSM (Fast Gradient Sign Method). Which architectural change most effectively increases robustness?

Accepted Answer

Applying Defensive Distillation.. FGSM uses the model's gradients to craft perturbations; defensive distillation or adversarial training helps mask these gradients.

Answer

Increasing the learning rate during training.

Answer

Switching to a larger neural network.

Answer

Implementing input denoising.

Question 4

What is the most effective control to prevent 'Model Scraping' from an exposed AI prediction API?

Accepted Answer

Implement tiered access and rate limiting.. Rate limiting and request authentication are the standard controls to prevent automated extraction of model knowledge.

Answer

Require users to sign a Terms of Service agreement.

Answer

Increase the complexity of the model.

Answer

Use an obfuscated model file name.

Question 5

When assessing AI third-party vendor risk, which document is most useful for understanding the vendor's data handling practices?

Accepted Answer

The Data Processing Agreement (DPA).. The Data Processing Agreement (DPA) outlines exactly how data is used, stored, and protected.

Answer

The user interface mockups.

Answer

The company's marketing brochure.

Answer

The vendor's quarterly earnings statement.

Question 6

You are managing an AI project and notice the model is performing poorly on a subset of data representing a protected class. What is the correct next step in the risk assessment process?

Accepted Answer

Investigate the data representation and training balance for that subgroup.. Performing a root cause analysis on the data used to train that specific segment is the correct diagnostic step.

Answer

Immediately delete all training data.

Answer

Dismiss the finding as a minor edge case.

Answer

Replace the model architecture with a simpler one.

Question 7

Which THREE practices are necessary for managing 'AI Model Version Control' as part of an overall risk management strategy?

Accepted Answer

Using Git-based tracking for model configuration and code.. Version control ensures reproducibility, rollback capability, and auditability in AI risk management.

Answer

Allowing only one developer to modify the model.

Answer

Storing only the production model artifact.

Question 8

An attacker is performing a 'Model Extraction' attack. What is the most likely goal of the attacker?

Accepted Answer

To steal the intellectual property of the model architecture.. Model extraction (or theft) aims to recreate the functionality or proprietary logic of a model by querying it and training a substitute model.

Answer

To gain access to the raw training database.

Answer

To cause the model to crash.

Answer

To inject malicious weights into the model.

Question 9

Which TWO measures are most effective in reducing the risk of 'Hallucinations' in LLM systems?

Accepted Answer

Using Retrieval-Augmented Generation (RAG).. RAG and Grounding ensure the model relies on external, verified context rather than its internal probabilistic memory.

Answer

Training the model on larger public internet datasets.

Answer

Removing all punctuation from the input.

Answer

Increasing the model's temperature parameter to 2.0.

Question 10

Which THREE factors must be included in a 'Model Risk Management' (MRM) policy?

Accepted Answer

Clear model lifecycle stages and governance gates.. A robust MRM policy covers the lifecycle from model development and validation to monitoring and retirement.

Answer

The names of all employees who use the AI.

Answer

A list of all model research papers published by the company.

Question 11

Which TWO techniques help mitigate 'Model Poisoning'?

Accepted Answer

Data sanitization and filtering of training inputs.. Defensive techniques like data sanitization and robust aggregation algorithms help mitigate poisoning attempts.

Answer

Increasing the number of neurons in the model.

Answer

Moving the model to a public cloud environment.

Answer

Reducing the number of training epochs.

Question 12

What is 'AI Shadowing' or 'Shadow AI' in an enterprise setting?

Accepted Answer

Employees using unapproved AI tools for work tasks.. Shadow AI refers to the use of AI tools and models by employees without the knowledge or approval of the IT/Security department.

Answer

The practice of monitoring AI usage in real-time.

Answer

The process of testing models before release.

Answer

The use of AI for internal cybersecurity tasks only.

Question 13

When evaluating an AI model for production, what does the 'F1 Score' tell you from a risk management perspective?

Accepted Answer

The balance between model precision and recall.. The F1 score provides a balanced view of precision and recall, helping assess the risk of both false positives and false negatives.

Answer

The latency of the model in milliseconds.

Answer

The total number of parameters in the model.

Answer

The total cost of training the model.

Question 14

What is the primary risk associated with 'Overfitting' in an AI model?

Accepted Answer

Lack of generalization to unseen data.. Overfitting means the model memorizes the training data rather than generalizing, leading to poor performance on new, unseen data, which is a reliability risk.

Answer

Increased latency in inference.

Answer

The model is too simple to solve the problem.

Answer

The model is too large to be deployed.

Question 15

You are assessing the risk of 'Data Poisoning'. Which stage of the machine learning lifecycle is most vulnerable to this attack?

Accepted Answer

Training data collection and ingestion.. Data poisoning occurs during the training data ingestion phase, where malicious samples are injected into the training set.

Answer

The model design and architecture selection.

Answer

Model monitoring and logging.

Answer

Inference and deployment.