AAISM AI Risk Management Practice Test 5 — 15 Questions

Question 1

Which TWO items must be documented in an 'AI Model Card'?

Accepted Answer

Known limitations and failure modes.. Option A is correct because an AI Model Card must document known limitations and failure modes, which are essential for transparency about where and how the model may fail or produce unreliable outputs. Option E is correct because the model's intended use cases are a core section of a Model Card, specifying the tasks and contexts the model was designed for and helping users avoid misuse. Option B is incorrect because a model's website color scheme is a cosmetic design detail unrelated to model documentation. Option C is incorrect because developers' social security numbers are sensitive personal data that have no place in a Model Card. Option D is incorrect because hardware purchase receipts are procurement records, not information about the model's capabilities, limitations, or intended use.

Answer

The color scheme of the model's website.

Answer

The social security numbers of all developers.

Answer

The hardware purchase receipts.

Question 2

What is the primary risk of 'Over-reliance' on AI outputs?

Accepted Answer

Users may accept incorrect or harmful AI-generated information.. Over-reliance on AI outputs occurs when users treat AI-generated content as authoritative without independent verification, leading them to accept incorrect, biased, or harmful information. Because AI models can hallucinate or produce plausible-sounding but false outputs, unchecked trust creates direct business, safety, and compliance risk. The primary risk is therefore the acceptance of bad outputs, not any performance or infrastructure issue.

Answer

The model will perform too well.

Answer

The server will overheat.

Answer

The model runs out of memory.

Question 3

Which risk management activity happens during the 'Design' phase of an AI project?

Accepted Answer

Threat modeling and initial risk assessment.. During the Design phase, the team defines architecture, data flows, and trust boundaries, making it the natural point for threat modeling and initial risk assessment. Identifying threats and risks before build avoids costly rework and ensures controls are baked in rather than bolted on. This aligns with secure-by-design and AI risk management frameworks that place risk identification early in the lifecycle.

Answer

User manual writing.

Answer

Hardware installation.

Answer

Full-scale production deployment.

Question 4

What is a 'Side-Channel Attack' against an AI model?

Accepted Answer

An attack that exploits timing or power consumption patterns.. A side-channel attack infers secret information (such as model parameters or training data) by observing indirect physical or behavioral characteristics like timing, power consumption, electromagnetic emissions, or cache behavior. It does not attack the algorithm directly but exploits implementation leakage. Timing and power analysis are classic examples of this class.

Answer

An attack that uses a phishing email.

Answer

An attack that uses a VPN.

Answer

An attack that involves physical tampering.

Question 5

Which control is most effective against 'Data Poisoning' in a collaborative learning environment?

Accepted Answer

Using robust statistical aggregation algorithms.. Robust statistical aggregation algorithms (such as trimmed mean, median, or Krum) detect and down-weight malicious updates from poisoned participants in collaborative/federated learning. Because poisoning manifests as outlier model updates, aggregation that is resistant to outliers neutralizes the attack. This is the most effective control because it operates at the point where poisoned contributions would otherwise be incorporated.

Answer

Changing the model to a non-collaborative one.

Answer

Removing all participants from the collaboration.

Answer

Using a faster internet connection.

Question 6

A hospital's AI governance committee is deciding how to treat a vendor-supplied diagnostic model that flags possible intracranial hemorrhage on CT scans but only reports a single binary output with no confidence score. Clinicians have already overridden the tool several times, and two misses have been logged. The committee wants the residual risk to be formally owned rather than absorbed silently by the radiology department. Which action best satisfies that objective?

Accepted Answer

Register the model in the AI inventory and assign a named accountable owner who must review override and miss data at a defined cadence and record accept-or-mitigate decisions.. Residual risk in AI systems must be explicitly owned, not left to the operators closest to the output. Because this vendor model exposes no confidence score, override and miss data are the primary signal of degradation, and only an accountable owner with a defined review cadence can convert that signal into documented accept, mitigate, or retire decisions. The other actions either tune or study the model without establishing ownership.

Answer

Increase the model's decision threshold so that fewer positive cases are surfaced, reducing the volume of alerts clinicians must evaluate.

Answer

Reclassify the model as a clinical decision support aid in the risk register so that clinical staff remain solely responsible for final interpretation.

Answer

Commission a retrospective validation study comparing the model's outputs against radiologist reads to quantify its error rate before any further deployment.

Question 7

A financial services firm uses a third-party large language model for internal research summarization. The vendor publishes a model card but will not disclose training data composition, and the firm's regulator has begun asking how the organization would detect and respond if the model began producing outputs that subtly favor one issuer's securities. The CISO wants a control that provides early warning without requiring vendor source code. Which approach is most appropriate?

Accepted Answer

Deploy an output monitoring pipeline that scores responses for issuer sentiment drift against a frozen baseline and routes statistical anomalies to an AI risk owner for investigation.. When a vendor will not disclose training data and source code is unavailable, the organization must monitor observable behavior. Scoring outputs for issuer sentiment drift against a frozen baseline creates a measurable, repeatable signal that can be automated and escalated. This satisfies the regulator's expectation of ongoing detection while respecting the vendor's opacity, and it keeps accountability with the firm's own AI risk owner.

Answer

Restrict the model to summarization of documents that already contain an explicit issuer rating, so that any bias in free-text generation cannot influence downstream decisions.

Answer

Request that the vendor provide a signed attestation that the model does not favor any issuer and retain the attestation as evidence of due diligence.

Answer

Fine-tune the vendor model on the firm's own curated research corpus so that issuer preferences in the base model are overwritten by internal data.

Question 8

A hospital's AI governance committee is assessing an AI diagnostic imaging model that was trained on data from a single urban medical center. The model will now be deployed across a network of rural clinics. The committee wants to quantify the risk that model performance will degrade in the new environment. Which risk management activity should be performed FIRST to address this concern?

Accepted Answer

Conduct a dataset distribution shift analysis comparing the training population demographics to the target clinic populations.. The first step in managing any AI risk is to identify and analyze it with evidence. Comparing the training data distribution against the target deployment population is the analytical activity that reveals whether and how much the model's inputs will differ, which is the root cause of performance degradation. Only after that quantification can the committee rationally choose among mitigations such as retraining, local validation, or restricting use.

Answer

Document the model's intended use in the AI system inventory and assign a risk tier based on the vendor's claims.

Answer

Immediately retrain the model on data collected from the rural clinics to eliminate any demographic differences.

Answer

Deploy the model in shadow mode at the rural clinics and monitor for adverse events before making any assessment.

Question 9

A financial services firm uses a third-party large language model via API for customer-facing investment guidance. The AI risk manager is told that the vendor has updated the model weights without changing the API version number or notifying customers. The firm's own testing now shows different outputs for the same regulated prompts. Which risk management control failure does this scenario MOST directly illustrate?

Accepted Answer

Inadequate third-party AI supply chain transparency and change notification requirements in the vendor contract.. When an organization consumes a third-party model, its risk posture depends on the provider's change management practices. Silent weight updates invalidate prior validation, testing, and regulatory attestations. The most direct control failure is the absence of supply chain transparency: contracts must require advance notice of material model changes, and technical measures such as version pinning or pinned endpoints must ensure the organization can detect and revalidate changes before they affect production.

Answer

Insufficient adversarial robustness testing against prompt injection attacks on the API endpoint.

Answer

Failure to implement differential privacy on the prompts sent to the third-party model.

Answer

Lack of model explainability tooling to interpret why outputs changed after the update.

Question 10

A risk manager at a financial services firm is evaluating a third-party large language model (LLM) that will be used for internal knowledge retrieval. The vendor's contract does not specify whether customer prompts and outputs are used for model retraining. Which action BEST addresses the residual risk of confidential data being incorporated into future model versions?

Accepted Answer

Negotiate a contractual no-retraining clause and obtain technical evidence of data isolation.. The residual risk arises from the vendor's unspecified data-retention and retraining practices. Contractual commitments are necessary but must be validated with technical controls such as zero-retention configurations or tenant isolation. Together, they provide assurance that confidential prompts will not be incorporated into future model versions, which is the specific risk the firm needs to manage.

Answer

Deploy the model in a private VPC and rely on network segmentation to prevent data exposure.

Answer

Require the vendor to provide a SOC 2 Type II report and accept the residual risk.

Answer

Implement prompt filtering to redact sensitive entities before sending requests to the model.

Question 11

An AI risk analyst is reviewing a credit scoring model and finds that the model's output for an applicant can change materially when a single input feature is altered by a tiny amount within its normal range. The analyst is concerned this indicates the model is relying on unstable decision boundaries. Which technique should the analyst use to systematically quantify this sensitivity across the applicant population?

Accepted Answer

Global sensitivity analysis using variance-based methods such as Sobol indices.. To quantify output sensitivity across a population, the analyst needs a global method that attributes output variance to inputs over the whole distribution. Variance-based sensitivity analysis such as Sobol indices does precisely this, revealing which features, and which interactions, cause unstable decision boundaries. This evidence supports risk decisions such as constraining input precision, retraining, or adding human review for affected applicants.

Answer

Feature importance ranking derived from the model's built-in tree split gains.

Answer

SHAP values computed for a single high-risk applicant to explain that individual's score.

Answer

Adversarial example generation using the fast gradient sign method against the scoring model.

Question 12

A healthcare AI governance committee is reviewing a sepsis prediction model deployed across three hospitals. The model was trained on data from one hospital and shows a 12% drop in sensitivity when used at a second hospital with a different patient demographic. The committee must decide how to treat this risk. Which action is MOST appropriate?

Accepted Answer

Apply site-specific thresholds and enhanced monitoring at the second hospital while planning retraining.. The risk is a site-specific performance disparity, not a global model failure. The most appropriate treatment is to mitigate at the affected site through threshold adjustment and monitoring while addressing the root cause through retraining with more representative data. This preserves benefit where the model is validated and manages harm where it is not.

Answer

Replace the model with a simple rule-based sepsis score at all hospitals.

Answer

Suspend the model at all hospitals until it is retrained on data from every hospital.

Answer

Document the performance drop as a known limitation and continue use without changes.

Question 13

A global retailer is deploying an AI demand forecasting system that will automatically place supplier orders. The AI risk manager must establish controls that address the risk of automation bias, where human planners may defer to AI recommendations even when they are wrong. Which TWO controls BEST address this risk? (Choose two.)

Accepted Answer

Require planners to record an independent forecast before viewing the AI recommendation for a sample of orders.. Automation bias is best countered by controls that force independent human judgment and by information that helps humans calibrate their trust. Capturing a forecast before the AI output is shown breaks the anchoring cycle, while calibrated confidence scores tell planners when to be skeptical. Together they preserve meaningful human oversight, which is the control objective for consequential automated ordering decisions.

Answer

Increase the model's training data volume by tenfold to reduce the frequency of incorrect predictions.

Answer

Route all supplier orders through a fully automated approval workflow to eliminate inconsistent human decisions.

Answer

Grant planners full override authority without requiring justification for deviating from AI recommendations.

Question 14

An organization has a mature AI governance program with a complete AI asset inventory, but recent audits show that third-party foundation model providers are updating their models without notice, causing downstream performance drift in production. The CISO asks the AI security manager to reduce this supply-chain risk. Which action should the AI security manager take FIRST?

Accepted Answer

Establish contractual requirements with the foundation model provider for advance notification of model version changes and a stable, pinned model version for production use.. The core risk is that a third-party provider can change the model without the organization's knowledge, causing unexpected behavior. The most effective first step is to gain control over model versions through contractual terms and version pinning, which directly prevents silent updates from affecting production. Detection, red teaming, and replacement are either reactive or disproportionate as an initial response.

Answer

Deploy an automated anomaly detection system that alerts when model output distributions shift beyond a threshold.

Answer

Increase the frequency of red teaming exercises against the production AI system to identify new vulnerabilities introduced by provider updates.

Answer

Replace the third-party foundation model with an internally developed model that the organization fully controls.

Question 15

A financial services firm uses a third-party large language model (LLM) API to summarize internal audit reports. The CISO is concerned that confidential report content could be retained by the provider and later resurface in responses to other customers. Which risk management action BEST addresses this specific concern?

Accepted Answer

Require the provider to contractually commit to zero data retention and verify this through their SOC 2 Type II report and data processing addendum.. The core risk is that a third-party LLM provider may retain confidential audit content and expose it to other tenants. A contractual zero-retention commitment, backed by independent audit evidence and a data processing addendum, creates enforceable, verifiable assurance. Technical controls like prompt filtering or DLP address different threat vectors and would not prevent provider-side retention or cross-tenant leakage.

Answer

Deploy a data loss prevention (DLP) solution that blocks any audit report content from leaving the corporate network.

Answer

Fine-tune an open-source LLM on the audit reports and host it entirely on-premises.

Answer

Implement prompt injection filtering on all outbound requests to the LLM API.