AAISM AI Risk Management Practice Test 3 — 15 Questions

Question 1

What is the purpose of 'AI Model Transparency' in a risk management framework?

Accepted Answer

To enable stakeholders to evaluate model safety and performance.. Transparency allows stakeholders to understand how a model functions, its limitations, and its provenance to ensure accountability.

Answer

To speed up the training process.

Answer

To hide the model architecture from competitors.

Answer

To minimize the number of API calls.

Question 2

A researcher is using 'Adversarial Training' to defend against evasion. How exactly does this work?

Accepted Answer

It trains the model on adversarial examples alongside clean data.. Adversarial training includes adversarial examples in the training set, allowing the model to learn to classify them correctly.

Answer

It uses a secondary model to detect malicious input.

Answer

It restricts input to a whitelist of authorized users.

Answer

It adds noise to the weights of the model.

Question 3

Which THREE components are critical for an 'AI Incident Response' plan?

Accepted Answer

Communication channels with data scientists and legal teams.. An AI IR plan must account for model-specific issues like unexpected performance drops, bias, and adversarial attacks.

Answer

Requirements to publish all internal vulnerabilities publicly.

Answer

Automated deletion of all logs.

Question 4

Which TWO factors contribute to 'Model Obsolescence' risk?

Accepted Answer

Availability of superior, more efficient alternatives.. Obsolescence occurs when models become ineffective due to changing data distributions (drift) or superior new models.

Answer

The model has reached its maximum iteration count.

Answer

The training data was encrypted.

Answer

The model is stored on a local server.

Question 5

When assessing the risk of 'Prompt Leaking', what is the most important control to implement?

Accepted Answer

Strict output filtering and instruction separation.. Prompt leaking occurs when a model reveals its system instructions. Limiting the LLM's access to sensitive context and using robust system prompts is key.

Answer

Increasing the model's parameter count.

Answer

Encrypting the model output.

Answer

Only allowing access from internal IP addresses.

Question 6

What is the key risk difference between 'Data Privacy' and 'Model Security' in AI?

Accepted Answer

Data privacy is about PII protection; model security is about system integrity.. Data privacy focuses on the protection of the information used in models (PII), while model security focuses on the integrity/availability of the model logic.

Answer

Data privacy is only for training data, not inference data.

Answer

There is no difference.

Answer

Model security is only about physical hardware.

Question 7

An organization is evaluating 'Third-Party AI Models'. Which risk is most effectively addressed by a 'Model Evaluation Report'?

Accepted Answer

The risk of model unsuitability or unexpected behavior.. An evaluation report details the model's capabilities, limitations, and performance, helping the user determine if it fits their risk profile.

Answer

The risk of the vendor going bankrupt.

Answer

The risk of poor UI/UX design.

Answer

The risk of high API latency.

Question 8

Which THREE technical configurations help mitigate the risk of 'Model Exfiltration'?

Accepted Answer

Strict IAM policies limiting access to the model weight files.. Model exfiltration can be hindered by restricting access to the model, monitoring egress traffic, and obfuscating model responses.

Answer

Increasing the number of public endpoints.

Answer

Using clear text for all model logs.

Question 9

You are auditing an AI system for 'Model Explainability' (XAI). Why is XAI critical from a risk management perspective?

Accepted Answer

It provides transparency for accountability and bias detection.. Explainability allows organizations to understand the 'why' behind model decisions, essential for regulatory compliance and debugging bias.

Answer

It is required to make the model run faster.

Answer

It encrypts the input data.

Answer

It enables models to train without labels.

Question 10

What is the primary role of a 'Human-in-the-loop' (HITL) in AI risk management?

Accepted Answer

To provide oversight and intervention for critical model decisions.. HITL ensures that human oversight is present in high-stakes decisions, mitigating risks of automation bias or AI failure.

Answer

To write the model code.

Answer

To speed up the inference process.

Answer

To handle technical server maintenance.

Question 11

Which TWO security controls are recommended for protecting 'Training Data'?

Accepted Answer

Encryption at rest for all dataset storage.. Training data should be protected using access controls and encryption at rest to prevent unauthorized access.

Answer

Publicly hosting the data on GitHub for reproducibility.

Answer

Storing all passwords in the training data.

Answer

Using only high-resolution images.

Question 12

What is the purpose of 'AI Model Inventory'?

Accepted Answer

To provide a central list of all AI assets for risk oversight.. An inventory tracks all models in production to ensure they are managed, monitored, and reviewed according to organizational policy.

Answer

To increase the speed of the training pipeline.

Answer

To reduce the number of GPUs used.

Answer

To automatically retrain all models.

Question 13

Which THREE items should be included in an 'AI Vendor Assessment'?

Accepted Answer

Review of the model transparency/model card documentation.. Vendor assessments must verify security practices, compliance, and model transparency.

Answer

The personal home addresses of all employees.

Answer

The vendor's entire source code repository.

Question 14

Which of the following describes 'Model Integrity' risk?

Accepted Answer

The risk of the model weights being maliciously modified.. Model integrity risk refers to the potential for the model to be altered or behave in an unauthorized way, such as through poisoning or unauthorized weight updates.

Answer

The risk that the model will be too slow.

Answer

The risk of data being leaked during training.

Answer

The risk that users will stop using the app.

Question 15

When dealing with 'Adversarial Evasion', why is the 'black-box' nature of an API a risk?

Accepted Answer

Because it allows attackers to build surrogate models via iterative querying.. In a black-box attack, an attacker can craft perturbations by repeatedly querying the API and analyzing the outputs to build a substitute model.

Answer

Because it makes the model impossible to update.

Answer

Because it prevents log auditing.

Answer

Because it forces the use of HTTPS.