AAISM AI Technologies And Controls Practice Test 3 — 15 Questions

Question 1

When using a 'Managed AI API' service, what is the best practice for handling API keys?

Accepted Answer

Store keys in a secure Secrets Manager. API keys should never be hardcoded; they should be stored in secrets managers like AWS Secrets Manager or Azure Key Vault.

Answer

Hardcode keys in the application source code

Answer

Email keys to team members for easy access

Answer

Embed keys in the public Git repository

Question 2

What is the primary risk associated with 'Shadow AI' in an organization?

Accepted Answer

Unmonitored data leakage and compliance risk. Shadow AI refers to the use of AI tools without IT or security oversight, leading to data leaks and compliance violations.

Answer

Lower cloud costs

Answer

Increased model accuracy

Answer

Faster code development

Question 3

In the context of 'Adversarial Machine Learning', what is a 'Blind Spot' attack?

Accepted Answer

Exploiting low-confidence regions to force incorrect predictions. A blind spot attack exploits areas in the input space where the model's confidence is high, but its performance is actually incorrect due to poor training coverage.

Answer

Bypassing authentication on the server

Answer

Increasing the training time of the model

Answer

Deleting the model's weights from memory

Question 4

Which THREE of the following are effective ways to secure the 'ML Pipeline' (MLOps) against supply chain attacks?

Accepted Answer

Use isolated environments for pipeline stages. Securing the pipeline involves code signing, scanning dependencies for vulnerabilities, and using isolated container environments.

Answer

Disable all CI/CD pipeline logging

Answer

Always run the pipeline as a root user

Question 5

What is the primary function of 'IAM' in an AI-driven cloud environment?

Accepted Answer

Manage identities and access to resources. IAM (Identity and Access Management) manages who can perform which actions on which resources (e.g., who can invoke a model).

Answer

Monitor the health of GPU clusters

Answer

Automate data cleaning tasks

Answer

Increase the training speed of models

Question 6

When an AI model is suspected of being involved in a security incident, what is the first step in the incident response process?

Accepted Answer

Isolate the model endpoint from the network. Isolation is the first step to prevent further damage or exfiltration of sensitive data.

Answer

Retrain the model on new data

Answer

Delete the model weights

Answer

Update the documentation

Question 7

Which of the following is an example of an 'Evasion' attack on a computer vision model?

Accepted Answer

Adding adversarial noise to input images. Adding adversarial noise to an image (e.g., a sticker) causes the model to misclassify it, which is the definition of evasion.

Answer

Intercepting training data packets

Answer

Changing the model's learning rate

Answer

Brute forcing the administrator password

Question 8

Which TWO of the following are recommended when auditing an 'AI Model' for bias and fairness?

Accepted Answer

Measure performance metrics across subgroups. Auditing for fairness requires checking data representation and measuring model performance across different demographic subgroups.

Answer

Remove all logging to maintain anonymity

Answer

Increase the number of layers in the model

Answer

Use the model for all possible use cases

Question 9

What is the benefit of 'Versioning' your AI models in a production environment?

Accepted Answer

Enables rapid rollback to previous models. Versioning enables rapid rollback to a known good state if a new version is found to be insecure or perform poorly.

Answer

Reduces the size of the model file

Answer

Increases API speed

Answer

Automatically detects prompt injection

Question 10

When reviewing an AI architecture, what does the 'Attack Surface' refer to?

Accepted Answer

The set of points where an attacker can interact with the system. The attack surface includes all points where an adversary can enter or extract data from the system, including API endpoints and training interfaces.

Answer

The speed of the model's inference

Answer

The number of users allowed to access the system

Answer

The memory usage of the model during training

Question 11

What is the purpose of 'Logging' in an AI system?

Accepted Answer

To provide an audit trail for incident investigation. Logging provides the audit trail necessary to investigate security incidents and understand how the system reached a specific output.

Answer

To prevent unauthorized access to the server

Answer

To encrypt data at rest

Answer

To compress the model for faster deployment

Question 12

Which cryptographic tool is used to ensure the authenticity of a model file stored in an S3 bucket?

Accepted Answer

Digital signatures. Digital signatures (using tools like Cosign or AWS KMS) verify that the model has not been tampered with since being signed.

Answer

Data masking

Answer

Model quantization

Answer

Base64 encoding

Question 13

Which TWO of the following are risks associated with using public pre-trained models without further security validation?

Accepted Answer

Hidden backdoors injected into the model weights. Public models may contain hidden backdoors (poisoning) or have been trained on sensitive/copyrighted data that could cause legal or compliance issues.

Answer

Improved model interpretability

Answer

Reduced inference latency compared to custom models

Answer

Automatic hardware acceleration

Question 14

Which of the following is a 'Control' for mitigating the risk of 'Prompt Injection'?

Accepted Answer

Sandboxed execution environment for agents. A 'Sandboxed Execution Environment' for agents prevents the AI from accessing the host file system or network, limiting the impact of an injection.

Answer

Using a larger language model

Answer

Providing the agent with full root access

Answer

Disabling output validation

Question 15

What is 'Model Stealing' and why is it considered a security incident?

Accepted Answer

It is the theft of intellectual property via query analysis. Model stealing involves querying a model to extract enough information to replicate its functionality, leading to the loss of proprietary intellectual property.

Answer

It is the slow down of the model due to heavy load

Answer

It is the unauthorized access to the server room

Answer

It is the accidental deletion of model files