AAISM AI Technologies And Controls Practice Test 5 — 15 Questions

Question 1

You are managing a model deployed in AWS SageMaker and observe drift in the ground truth data. Which SageMaker feature should be configured to automatically monitor and alert on this statistical deviation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SageMaker Model Monitor. SageMaker Model Monitor is designed to continuously monitor deployed models for data quality, model quality, bias drift, and feature attribution drift. It can detect statistical deviations in ground truth data by comparing live data to a baseline and trigger CloudWatch alarms. This directly addresses the requirement to monitor and alert on drift.

Answer

SageMaker Clarify for Bias Detection

Answer

SageMaker Feature Store

Answer

SageMaker Experiments

Question 2

To mitigate adversarial evasion attacks against a vision model, you decide to implement defensive distillation on your TensorFlow model. What is the primary operational trade-off you must evaluate?

Accepted Answer

Reduced model sensitivity to noise and potential drop in clean accuracy. Defensive distillation trains a student model on soft labels produced by a teacher, smoothing the decision surface and reducing sensitivity to small adversarial perturbations. The trade-off is that this smoothing can lower accuracy on clean, unperturbed inputs because the model becomes less confident and more regularized. Practitioners must measure this drop before deploying.

Answer

Requirement for GPU-based training clusters only

Answer

Incompatibility with gradient-based optimizers

Answer

Increased latency in inference requests

Question 3

When securing a large language model (LLM) using the OWASP Top 10 for LLMs, which control is most effective against 'Insecure Output Handling'?

Accepted Answer

Enforcing strict output validation and sanitization. Insecure Output Handling occurs when LLM output is passed to downstream systems (browsers, shells, databases, other APIs) without validation, enabling XSS, SSRF, command injection, or SQLi via crafted model responses. The most effective control is to treat all model output as untrusted user input and enforce strict output validation and sanitization before it reaches any sink. This directly neutralizes the injection vector regardless of what the model produces.

Answer

Using fine-grained RBAC

Answer

Implementing Rate Limiting

Answer

Encrypting training data

Question 4

An AI Security analyst is configuring Google Cloud Vertex AI Model Garden to ensure compliance with organization policies. Which IAM permission is strictly required to prevent unauthorized users from deploying a base model to a public endpoint?

Accepted Answer

aiplatform.endpoints.create. Deploying a model to a Vertex AI endpoint requires creating an endpoint resource, which is governed by the aiplatform.endpoints.create permission. Without this permission, a user cannot provision a public endpoint even if they can read metadata or upload models. Restricting this permission to authorized principals is the direct IAM control that prevents unauthorized public exposure of a base model.

Answer

aiplatform.metadata.read

Answer

aiplatform.jobs.create

Answer

aiplatform.models.upload

Question 5

You are configuring private connectivity for an AI model using AWS PrivateLink. Which component is required to ensure that model inference traffic never traverses the public internet?

Accepted Answer

VPC Interface Endpoint. A VPC Interface Endpoint (powered by AWS PrivateLink) creates an elastic network interface with a private IP address in your subnet that serves as an entry point for traffic destined to the AWS service or your own endpoint service. Because the endpoint is reachable only via private IPs inside the VPC, model inference requests are routed over the AWS private backbone and never traverse the public internet. This is the defining characteristic of PrivateLink connectivity.

Answer

Internet Gateway (IGW)

Answer

Security Group ingress rule

Answer

NAT Gateway

Question 6

In the context of poisoning attacks, which technique is most effective for detecting data contamination in an automated ML training pipeline?

Accepted Answer

Statistical outlier detection on training feature sets. Statistical outlier detection on training feature sets is the most effective technique because poisoning attacks introduce anomalous data points that deviate from the expected distribution of legitimate training data. By applying statistical methods (e.g., z-score, IQR, isolation forests) to feature distributions, contaminated samples can be flagged and removed before they influence model weights. This directly targets the integrity of the training pipeline at the data ingestion stage.

Answer

Increasing training epochs

Answer

Differential Privacy

Answer

Model quantization

Question 7

An organization uses IBM watsonx.ai to manage model governance. Which tool is primarily used to track 'FactSheets' for model lineage and auditability?

Accepted Answer

FactSheets. FactSheets is the correct answer because it is the specific tool within IBM watsonx.ai designed to document and track model lineage, auditability, and governance information. FactSheets provide a standardized, structured way to capture metadata about AI models—such as their purpose, training data, performance metrics, and ethical considerations—which is essential for regulatory compliance and internal audits. Unlike generic experiment trackers or dashboards, FactSheets are purpose-built to satisfy model governance requirements by offering a transparent, shareable record of a model's lifecycle.

Answer

AutoAI Experiment Tracker

Answer

Pipeline Orchestrator

Answer

Model Risk Management (MRM) dashboard

Question 8

You are securing a PyTorch model and want to implement differential privacy to protect the training data. Which library is specifically designed to work with PyTorch for this purpose?

Accepted Answer

Opacus. Opacus is a library developed by Meta specifically for training PyTorch models with differential privacy. It provides a PrivacyEngine that wraps standard PyTorch optimizers and DataLoaders to add per-sample gradient clipping and calibrated Gaussian noise, implementing the DP-SGD algorithm natively within the PyTorch autograd graph. This tight integration means you can make an existing PyTorch training loop differentially private with only a few lines of code.

Answer

TensorFlow Privacy

Answer

Hugging Face Evaluate

Answer

Adversarial Robustness Toolbox (ART)

Question 9

What is the purpose of 'Model Signing' in an MLOps pipeline?

Accepted Answer

To ensure model integrity and non-repudiation. Model signing uses cryptographic signatures (typically via PKI or keyless frameworks like Sigstore) to bind a model artifact to a verified identity, providing both integrity — proving the weights were not altered after signing — and non-repudiation, since only the holder of the private key could have produced the signature. This lets downstream consumers verify provenance before deployment, which is essential for supply chain trust in MLOps.

Answer

To encrypt the model weights at rest

Answer

To restrict access to the model registry

Answer

To increase inference speed

Question 10

To monitor for AI security incidents, you are integrating logs from an AI gateway into a SIEM. Which specific field in the request log is most critical for detecting 'Model Denial of Wallet' attacks?

Accepted Answer

usage.total_tokens. Model Denial of Wallet attacks aim to drive up inference costs by forcing the model to process excessive tokens, so the total token count in the request log is the most direct indicator of financial impact. Monitoring usage.total_tokens per request, per user, or per API key reveals abnormal consumption patterns that signal an attack. Other fields like latency or IP address are useful context but do not directly measure cost.

Answer

latency_ms

Answer

request_ip_address

Answer

model_id

Question 11

You are auditing an AI system for compliance with the EU AI Act. Which control is mandatory for 'High-Risk' AI systems to ensure transparency for human oversight?

Accepted Answer

Human-in-the-loop design and logging. The EU AI Act classifies certain AI systems as 'High-Risk' (e.g., in critical infrastructure, employment, education, or law enforcement) and imposes mandatory requirements including human oversight, risk management, technical documentation, logging/traceability, and transparency. Human-in-the-loop design combined with logging ensures that a human can interpret outputs, intervene, and that decisions are auditable — directly satisfying the transparency and oversight obligations under Articles 13-14.

Answer

Automated decision-making without oversight

Answer

Mandatory anonymization of all input data

Answer

Exclusive use of proprietary datasets

Question 12

You are using the Adversarial Robustness Toolbox (ART) to assess a classifier. Which attack technique would you simulate to test the model's vulnerability to 'Evasion' attacks?

Accepted Answer

Fast Gradient Sign Method (FGSM). The Fast Gradient Sign Method (FGSM) is a well-known evasion attack that generates adversarial examples by adding small perturbations to input data to fool a classifier. It is specifically designed to test a model's vulnerability to evasion, where the attacker manipulates inputs at inference time to cause misclassification. Therefore, simulating FGSM with ART is the correct choice for assessing evasion vulnerabilities.

Answer

Membership Inference

Answer

Model Inversion

Answer

Data Poisoning via label flipping

Question 13

Which TWO actions should be taken when implementing an AI security monitoring strategy in a production environment?

Accepted Answer

Implement automated alerting for anomalous request patterns. Option A is correct because automated alerting for anomalous request patterns enables continuous detection of threats such as prompt injection, model abuse, credential stuffing, or data exfiltration attempts, which is essential for a production AI security monitoring strategy. Option C is correct because real-time logging of all model inputs and outputs provides the audit trail and forensic evidence needed to investigate incidents, detect drift or misuse, and satisfy compliance requirements in production. Option B is incorrect because disabling API telemetry removes the visibility needed to detect and respond to attacks, weakening rather than strengthening security. Option D is incorrect because a static IP allowlist is brittle and insufficient for AI workloads that may use dynamic or distributed clients; stronger authentication and authorization controls are required. Option E is incorrect because daily retraining regardless of drift is an operational model-management decision, not a security monitoring action, and can introduce instability or new vulnerabilities.

Answer

Disable all API telemetry to reduce attack surface

Answer

Use a static list of IP addresses for all model access

Answer

Perform daily model retraining regardless of drift

Question 14

Which THREE security controls are essential for protecting the integrity of the AI model training supply chain?

Accepted Answer

Data provenance and lineage tracking. Data provenance and lineage tracking (A) is essential because it records the origin, transformations, and custody of every training dataset, allowing integrity violations such as tampered or poisoned data to be detected and traced through the pipeline. SBOM analysis for dependencies (B) is required because AI training stacks pull in numerous third-party libraries and frameworks, and an SBOM lets you identify and remediate vulnerable or malicious components before they affect the model. Cryptographic signing of model artifacts (D) is essential because digital signatures (e.g., using asymmetric keys over hashes of weights and checkpoints) let consumers verify that a model was produced by a trusted source and has not been altered in transit or storage. Hardening the physical security of the server room (C) protects physical access to hardware but does not address the logical integrity of data, dependencies, or model artifacts across the supply chain, and increasing the number of neurons (E) is a model-capacity design choice that has no bearing on supply chain security.

Answer

Hardening the physical security of the server room

Answer

Increasing the number of neurons in the model

Question 15

Which TWO steps are recommended to secure access to an AI model registry?

Accepted Answer

Implement Role-Based Access Control (RBAC). Option B is correct because implementing Role-Based Access Control (RBAC) enforces least-privilege access to the AI model registry, ensuring users and service accounts only receive the permissions (e.g., read, push, delete) required for their role, which limits unauthorized model access or tampering. Option D is correct because enforcing Multi-Factor Authentication (MFA) adds a second verification factor beyond a password, significantly reducing the risk of credential theft or replay attacks against registry accounts. The unmarked options do not belong: storing credentials in plain text (A) exposes secrets to anyone with file access, disabling audit logging (C) removes accountability and detection of suspicious registry activity, and allowing public access for all users (E) grants unrestricted access that violates least-privilege and confidentiality principles.

Answer

Store registry credentials in plain text configuration files

Answer

Disable audit logging to reduce storage costs

Answer

Allow 'Public' access for all users to promote model sharing