AAISM AI Technologies And Controls Practice Test 7 — 15 Questions

Question 1

A financial institution uses a machine learning model to approve loan applications. The model was trained on historical data that includes sensitive attributes such as race and gender. An internal audit reveals that the model's decisions disproportionately deny loans to certain demographic groups, even after removing those attributes from the training data. Which technique should the security team implement to detect and mitigate this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply fairness-aware machine learning techniques such as adversarial debiasing or reweighting to adjust the model's training process.. The scenario describes a model exhibiting disparate impact despite removal of sensitive attributes, indicating bias through proxy features. Fairness-aware machine learning techniques like adversarial debiasing or reweighting are designed to mitigate such bias by adjusting the training process. Other options like SHAP values help detect bias but do not mitigate it, while differential privacy and watermarking are unrelated to fairness.

Answer

Implement differential privacy during training to ensure individual data points cannot be inferred.

Answer

Use SHAP (SHapley Additive exPlanations) values to interpret model predictions and identify biased features.

Answer

Use model watermarking to embed ownership information and track unauthorized use.

Question 2

A security architect is designing a document summarization service that uses a large language model (LLM) deployed in a virtual private cloud. The LLM must process confidential internal documents without any data leaving the organization's network. Which deployment approach should the architect choose to meet this requirement?

Accepted Answer

Deploy the LLM on a self-hosted inference server within the organization's virtual private cloud.. The requirement is that confidential documents must not leave the organization's network. A self-hosted inference server inside the virtual private cloud ensures that both training and inference occur locally, with no external data transmission. Public APIs, serverless calls to third-party services, and provider-hosted fine-tuned models all involve sending data outside the network boundary, so they cannot meet the requirement.

Answer

Use a public LLM API with a data processing addendum that prohibits training on customer data.

Answer

Fine-tune a public LLM using the confidential documents and then use the fine-tuned model via the provider's API.

Answer

Use a serverless function that calls a third-party LLM API and stores the results in an encrypted S3 bucket.

Question 3

A company is using a third-party pre-trained large language model (LLM) via an API for generating marketing content. The security team wants to ensure that the model does not inadvertently generate content that violates company policy or leaks sensitive information. Which control should be implemented?

Accepted Answer

Implement an output filtering layer that scans generated content for policy violations and sensitive data.. Output filtering is the most effective control because it directly inspects and blocks generated content that violates policy or contains sensitive information. It works with any third-party LLM API and can be customized to enforce specific rules. This control provides a consistent enforcement layer independent of the model's training or behavior.

Answer

Use a smaller, locally hosted model instead of the third-party API.

Answer

Require users to sign an acceptable use policy before accessing the LLM.

Answer

Fine-tune the LLM on company-specific data to align its outputs with policy.

Question 4

An AI security analyst is reviewing a system that uses a large language model (LLM) for customer support. The LLM is fine-tuned on internal documents and deployed via an API. The analyst wants to detect if an attacker is attempting to extract sensitive training data through crafted prompts. Which control is most effective for this detection?

Accepted Answer

Analyzing query patterns for repeated or systematic probing of model outputs. Detecting training data extraction requires identifying the behavioral signature of an attacker systematically probing the model. Monitoring query patterns for repetition, structure, and volume can reveal such attempts, whereas watermarking, similarity checks, and injection firewalls address different threats and do not reliably detect extraction.

Answer

Monitoring for unusually high similarity between prompts and training data

Answer

Deploying a prompt injection firewall that filters malicious inputs

Answer

Implementing output watermarking to trace generated text

Question 5

A machine learning engineer is training a fraud detection model on a dataset that includes sensitive customer transaction records. The organization wants to ensure that individual records cannot be re-identified from the trained model. Which technique should the engineer apply during training to provide a formal privacy guarantee?

Accepted Answer

Differential privacy. Differential privacy is the only technique listed that provides a formal, mathematical guarantee that an individual's data cannot be re-identified from the model. It works by injecting noise into the training process, ensuring that the model's behavior is statistically similar whether or not any single record is included. Other techniques like data masking, homomorphic encryption, and secure multi-party computation address different aspects of privacy but do not offer this guarantee.

Answer

Homomorphic encryption

Answer

Data masking

Answer

Secure multi-party computation

Question 6

A healthcare organization is developing an AI system to assist radiologists in detecting early signs of lung cancer from CT scans. The system will be deployed in a hospital network. Which AI-specific control is most critical to ensure that the model's predictions can be trusted and explained to medical professionals?

Accepted Answer

Implement model interpretability techniques such as LIME or SHAP to provide explanations for individual predictions.. The scenario highlights the need for trust and explainability in a healthcare AI system. Interpretability techniques like LIME and SHAP provide local explanations for predictions, enabling radiologists to understand and validate the model's outputs. Other controls such as encryption, federated learning, or rate limiting address different concerns (security, privacy, availability) and do not fulfill the requirement for explainable predictions.

Answer

Implement rate limiting on API calls to prevent denial-of-service attacks.

Answer

Apply encryption to the model weights to prevent unauthorized access.

Answer

Use federated learning to train the model across multiple hospitals without sharing patient data.

Question 7

A security team is evaluating controls to protect an AI model from model extraction attacks, where an adversary attempts to replicate the model's functionality by querying its API. Which two controls are most effective for mitigating this risk? (Choose two.)

Accepted Answer

Rate limiting and query throttling to restrict the number of API calls per user.. Rate limiting and query throttling directly constrain the attacker's ability to query the model extensively, while monitoring API queries for extraction patterns enables early detection and response. Together, they form a strong defense against model extraction by making it difficult and risky for attackers to gather sufficient data to replicate the model.

Answer

Encrypting the model's API responses to prevent interception.

Answer

Implementing differential privacy during model training to obfuscate decision boundaries.

Answer

Watermarking model outputs to detect unauthorized replication.

Question 8

A company uses a large language model (LLM) to generate code for its software development team. The security team is concerned that the LLM might inadvertently suggest code containing vulnerabilities. Which control should be implemented to mitigate this risk?

Accepted Answer

Implement a static application security testing (SAST) tool that scans the LLM-generated code for known vulnerabilities before it is committed.. The most effective control to mitigate the risk of vulnerable code from an LLM is to implement SAST that scans generated code before it is committed. SAST provides a deterministic, rule-based check that can catch known vulnerabilities, acting as a critical safety net. While fine-tuning, prompt engineering, and curated libraries can help, they are not foolproof and do not provide the same level of assurance as automated scanning.

Answer

Use prompt engineering to instruct the LLM to always generate secure code.

Answer

Fine-tune the LLM on a dataset of secure code examples to bias it toward safe coding practices.

Answer

Restrict the LLM to only suggest code from a curated library of pre-approved secure snippets.

Question 9

A security team is evaluating an AI-based malware detection system that uses a deep neural network. They want to test whether small, carefully crafted perturbations to malicious files can cause the model to misclassify them as benign. Which type of attack should they simulate?

Accepted Answer

Evasion attack. The scenario describes testing whether small perturbations to malicious files can cause misclassification at inference time. This is the definition of an evasion attack. Poisoning attacks target training data, model inversion aims to extract training data, and membership inference determines if a record was in the training set. Only an evasion attack matches the described goal of causing misclassification through input perturbations.

Answer

Membership inference attack

Answer

Poisoning attack

Answer

Model inversion attack

Question 10

A government agency is deploying an AI system for facial recognition in public spaces. The security team must ensure that the system complies with privacy regulations and minimizes the risk of unauthorized surveillance. Which control is most appropriate for this scenario?

Accepted Answer

Implement on-device processing that only stores anonymized feature vectors instead of raw images.. On-device processing with anonymized feature vectors is the most appropriate control because it minimizes the collection and storage of sensitive biometric data. By processing locally and discarding raw images, the system reduces the risk of unauthorized surveillance and helps comply with privacy regulations that mandate data minimization and purpose limitation.

Answer

Use a cloud-based facial recognition API with strong encryption for data in transit and at rest.

Answer

Regularly audit the facial recognition model for bias and accuracy.

Answer

Obtain consent from all individuals entering the public space before processing their faces.

Question 11

A financial services firm deploys a gradient-boosted credit-scoring model served behind an internal REST endpoint. The security team wants to detect whether an attacker is probing the model to reconstruct its decision boundaries, but the endpoint does not log request payloads. Which control should be implemented FIRST to enable this detection?

Accepted Answer

Capture full inference request and response telemetry, including feature vectors, timestamps, and caller identity, into a tamper-evident store.. Model extraction detection is fundamentally a monitoring problem: you must observe the sequence and shape of queries reaching the model. The endpoint's gap is that it discards payloads, so no downstream analytics can identify systematic probing. Capturing inference requests and responses with caller identity and timestamps restores that visibility, while validation, privacy training, and mutual TLS all address different concerns and leave the detection gap open.

Answer

Apply differential privacy during the next retraining cycle to add calibrated noise to the model's outputs.

Answer

Enforce mutual TLS between the calling application and the inference service to authenticate every client.

Answer

Enable schema-based input validation that rejects any feature vector containing out-of-range or unexpected values.

Question 12

A security team is implementing controls for an AI-based image recognition system used in a public surveillance application. The system processes live video feeds to identify individuals matching certain criteria. Which TWO of the following are AI-specific controls that should be implemented to address privacy and security risks? (Choose two.)

Accepted Answer

Implement adversarial robustness testing to ensure the model cannot be fooled by physical adversarial patches.. The scenario requires AI-specific controls for privacy and security in a surveillance system. Face de-identification/blurring directly addresses privacy by minimizing processing of identifiable information. Adversarial robustness testing ensures the model resists evasion attacks, a unique AI security concern. HTTPS and RBAC are general controls, and model updates are maintenance, not specific mitigations for the risks described.

Answer

Enforce role-based access control (RBAC) to limit who can view the surveillance footage.

Answer

Use HTTPS to encrypt video feeds in transit between cameras and the processing server.

Answer

Regularly update the AI model with new data to improve accuracy.

Question 13

A financial services firm is deploying a third-party large language model (LLM) to summarize internal investment research. The security team must implement controls to detect when the model is induced to ignore its system instructions and leak confidential context. Which two controls directly address this risk? (Choose two.)

Accepted Answer

Deploy an input/output guardrail that uses a secondary classifier to flag instruction-override patterns and anomalous data egress in prompts and completions.. Runtime guardrails that inspect prompts and completions, combined with strict separation of system instructions from untrusted user content, directly counter instruction-override and context-leakage attempts. The other controls address unrelated concerns such as output randomness, training-data privacy, or user authentication, none of which stop an attacker from manipulating the model's instruction hierarchy during inference.

Answer

Apply differential privacy during fine-tuning of the third-party model to prevent memorization of training data.

Answer

Require multi-factor authentication for all users who access the summarization application.

Answer

Increase the model's temperature setting to make outputs less deterministic and harder for attackers to predict.

Question 14

A company is deploying a computer vision model for quality control on a manufacturing line. An attacker gains physical access to the camera feed and subtly alters a few pixels in the images to cause the model to misclassify defective products as non-defective. Which type of attack is this?

Accepted Answer

Adversarial example attack. An adversarial example attack occurs when an attacker intentionally modifies input data at inference time to cause the model to produce incorrect outputs. Here, the attacker alters camera feed pixels to make defective products appear non-defective. This is a direct example of an adversarial example attack, which is a key concern in AI security and requires defenses like input validation and robust model training.

Answer

Evasion attack

Answer

Poisoning attack

Answer

Model inversion attack

Question 15

An organization is deploying a machine learning model that makes automated decisions about loan applications. To comply with regulations, they need to ensure that the model's decisions can be explained to applicants and auditors. Which property of the model is most important to achieve this?

Accepted Answer

Interpretability. The scenario requires that the model's decisions be explained to applicants and auditors for regulatory compliance. Interpretability is the property that enables human understanding of how the model reaches its decisions. Scalability, latency, and accuracy are performance-related and do not address the need for explanation. Therefore, interpretability is the most important property in this context.

Answer

Accuracy

Answer

Latency

Answer

Scalability