AAISM Hard Questions — 25 Difficult Questions

Question 1

Which THREE components are critical for an 'AI Incident Response' plan?

Accepted Answer

Communication channels with data scientists and legal teams.. Option A is correct because an AI incident response plan must define communication channels that bring together data scientists (who understand model behavior and can diagnose failures) and legal teams (who handle regulatory, liability, and disclosure obligations), ensuring coordinated and compliant escalation. Option C is correct because procedures for model rollback or disablement are essential to quickly contain harm by reverting to a prior known-good model version or taking the model offline when it misbehaves. Option D is correct because identifying model-specific failure indicators — such as data drift, adversarial inputs, bias spikes, or anomalous confidence scores — enables early detection and triage of AI incidents that differ from traditional IT failures. Option B does not belong because publishing all internal vulnerabilities publicly is not a standard incident response requirement and could increase risk and violate disclosure norms. Option E does not belong because automated deletion of all logs destroys the forensic evidence needed for incident investigation, root-cause analysis, and compliance reporting.

Answer

Requirements to publish all internal vulnerabilities publicly.

Answer

Automated deletion of all logs.

Question 2

What is 'Model Stealing' and why is it considered a security incident?

Accepted Answer

It is the theft of intellectual property via query analysis. Model stealing is the extraction of a model's functionality or intellectual property through repeated query analysis — an attacker probes the API with crafted inputs and uses the input-output pairs to train a surrogate model that approximates the original. It is a security incident because it compromises the owner's IP and can enable further attacks such as adversarial example transfer and evasion of the original model. The economic value of a trained model is directly eroded when it can be cloned via the inference API.

Answer

It is the slow down of the model due to heavy load

Answer

It is the unauthorized access to the server room

Answer

It is the accidental deletion of model files

Question 3

A technology company has developed an AI model for autonomous decision-making in its supply chain. The AI governance team is tasked with establishing a process for continuous monitoring of the model's performance and risk. Which of the following is the MOST critical element to include in the monitoring process to detect model drift?

Accepted Answer

Tracking changes in the statistical distribution of input data over time.. Tracking changes in input data distributions is the most critical element for detecting model drift because it directly identifies covariate shift, a primary cause of performance degradation. Other options focus on usage metrics, static historical performance, or code management, none of which provide early warning of drift in a live supply chain environment.

Answer

Ensuring the model's code repository is version-controlled and changes are logged.

Answer

Recording the number of API calls made to the model each day.

Answer

Reviewing the model's training loss and accuracy metrics on the original test set.

Question 4

An AI Security analyst is configuring Google Cloud Vertex AI Model Garden to ensure compliance with organization policies. Which IAM permission is strictly required to prevent unauthorized users from deploying a base model to a public endpoint?

Accepted Answer

aiplatform.endpoints.create. Deploying a model to a Vertex AI endpoint requires creating an endpoint resource, which is governed by the aiplatform.endpoints.create permission. Without this permission, a user cannot provision a public endpoint even if they can read metadata or upload models. Restricting this permission to authorized principals is the direct IAM control that prevents unauthorized public exposure of a base model.

Answer

aiplatform.metadata.read

Answer

aiplatform.jobs.create

Answer

aiplatform.models.upload

Question 5

Which THREE activities help manage 'AI Lifecycle' risk?

Accepted Answer

Pre-deployment design and threat modeling.. Option A is correct because pre-deployment design and threat modeling identify AI-specific risks (e.g., data poisoning, model evasion, prompt injection, bias) before the system is fielded, allowing controls to be built in rather than bolted on. Option B is correct because formal decommissioning and sunsetting processes manage end-of-life risk by retiring models, revoking credentials, archiving or destroying training data, and preventing stale or unsupported AI components from remaining exploitable. Option E is correct because continuous operational monitoring detects model drift, data drift, performance degradation, and anomalous inference behavior during runtime, which is essential since AI risk evolves after deployment. Option C is incorrect because ignoring software updates leaves known vulnerabilities unpatched and increases lifecycle risk. Option D is incorrect because bypassing security reviews for speed skips necessary risk assessment and control validation, directly undermining AI lifecycle risk management.

Answer

Ignoring all software updates.

Answer

Bypassing security reviews for speed.

Question 6

Which THREE security controls are essential for protecting the integrity of the AI model training supply chain?

Accepted Answer

Data provenance and lineage tracking. Data provenance and lineage tracking (A) is essential because it records the origin, transformations, and custody of every training dataset, allowing integrity violations such as tampered or poisoned data to be detected and traced through the pipeline. SBOM analysis for dependencies (B) is required because AI training stacks pull in numerous third-party libraries and frameworks, and an SBOM lets you identify and remediate vulnerable or malicious components before they affect the model. Cryptographic signing of model artifacts (D) is essential because digital signatures (e.g., using asymmetric keys over hashes of weights and checkpoints) let consumers verify that a model was produced by a trusted source and has not been altered in transit or storage. Hardening the physical security of the server room (C) protects physical access to hardware but does not address the logical integrity of data, dependencies, or model artifacts across the supply chain, and increasing the number of neurons (E) is a model-capacity design choice that has no bearing on supply chain security.

Answer

Hardening the physical security of the server room

Answer

Increasing the number of neurons in the model

Question 7

A researcher is using 'Adversarial Training' to defend against evasion. How exactly does this work?

Accepted Answer

It trains the model on adversarial examples alongside clean data.. Adversarial training is a defense technique where the model is trained on a dataset that includes both clean examples and adversarial examples—inputs intentionally perturbed to fool the model. By learning from these adversarial examples, the model becomes more robust and can correctly classify them, thereby improving its resistance to evasion attacks.

Answer

It uses a secondary model to detect malicious input.

Answer

It restricts input to a whitelist of authorized users.

Answer

It adds noise to the weights of the model.

Question 8

Which THREE elements are essential for 'AI Governance'?

Accepted Answer

Defined AI ethics and safety policies.. AI governance requires a formal policy foundation, so option A (defined AI ethics and safety policies) is correct because written principles for fairness, transparency, accountability, and safety give the organization enforceable rules and decision criteria for AI use. Option C (a standard AI risk management framework) is correct because a recognized framework such as the NIST AI RMF or ISO/IEC 42001 provides a structured, repeatable process for identifying, assessing, treating, and monitoring AI risks across the lifecycle. Option E (a cross-functional oversight committee) is correct because governance needs an accountable body drawing on legal, compliance, security, data science, and business stakeholders to approve, review, and enforce AI decisions. Option B is not essential and would violate privacy and least-privilege principles, since governance never requires blanket access to employees' private emails. Option D is not essential because governance is about policy, risk, and accountability, not about mandating the most expensive GPU hardware, which is a cost and performance decision rather than a governance element.

Answer

Access to all employees' private emails.

Answer

A mandate to use the most expensive GPUs available.

Question 9

Which technique is best suited to defend against 'Model Extraction' where an adversary queries a public API to build a clone of your proprietary model?

Accepted Answer

Implement output perturbation. Output perturbation deliberately adds noise or rounds confidence scores returned by the API, degrading the fidelity of the information an adversary can use to train a clone. Model extraction relies on precise output signals, so perturbing them reduces clone accuracy while preserving acceptable utility for legitimate users. This is a direct, low-cost mitigation at the inference boundary.

Answer

Enable data augmentation

Answer

Use a larger model architecture

Answer

Rotate API tokens every 30 days

Question 10

Which THREE of the following are potential indicators of a 'Model Poisoning' attack occurring during the training phase?

Accepted Answer

Inconsistent model convergence during training. Option B is correct because model poisoning corrupts the training data or update process, so the loss curve and parameter updates no longer converge consistently, producing erratic or stalled convergence during training. Option C is correct because poisoned training samples can cause the model to memorize manipulated patterns, yielding high training-set accuracy while validation accuracy degrades due to the corrupted decision boundary. Option E is correct because attackers often implant backdoors or trigger-based behaviors, so the model behaves normally on ordinary inputs but produces attacker-chosen outputs when a specific trigger pattern is present. Option A is not a training-phase indicator, since increased API request latency reflects inference or service performance rather than poisoned training data. Option D is also not indicative, because larger model-weight storage is a resource/cost artifact and does not by itself demonstrate poisoned training behavior.

Answer

Increased latency for API requests

Answer

Increase in storage costs for the model weights

Question 11

A healthcare organization uses an AI system to prioritize patient follow-up calls. The system was trained on historical data that underrepresented certain demographic groups. The governance team wants to implement a control that detects and mitigates bias in the model's outputs on an ongoing basis. Which approach is most effective?

Accepted Answer

Implement continuous monitoring of model outputs with fairness metrics and a defined mitigation workflow.. Continuous monitoring with fairness metrics and a mitigation workflow is the most effective approach because it provides ongoing detection and correction of bias in production. It acknowledges that bias is not a one-time issue and requires sustained vigilance. This control enables the governance team to fulfill its responsibility to ensure equitable AI outcomes and comply with regulations.

Answer

Rely on the vendor's claims that the model is fair and unbiased.

Answer

Remove all demographic data from the training set to prevent bias.

Answer

Conduct a one-time bias audit before deployment and document the results.

Question 12

Which THREE documents are vital for an AI audit trail?

Accepted Answer

Model validation and testing reports.. Model validation and testing reports (B) are vital because they document how the AI model's performance, accuracy, bias, and robustness were assessed before and after deployment, providing auditable evidence of due diligence. Training data source documentation (C) is essential since it records the provenance, licensing, collection methods, and characteristics of the data used to train the model, which is necessary for tracing outputs and demonstrating compliance with data governance requirements. Model versioning history (D) is required to establish a traceable record of changes, retraining events, hyperparameters, and rollbacks, enabling auditors to reproduce or explain the behavior of any given model version at a point in time. The office lease agreement (A) and a copy of the employee handbook (E) are unrelated to the technical and data governance artifacts needed to reconstruct an AI system's development and decision-making, so they do not belong in an AI audit trail.

Answer

The office lease agreement.

Answer

A copy of the employee handbook.

Question 13

Which cryptographic tool is used to ensure the authenticity of a model file stored in an S3 bucket?

Accepted Answer

Digital signatures. Digital signatures use asymmetric cryptography to provide authenticity and integrity for a model file. The signer creates a hash of the model artifact and encrypts it with their private key; anyone with the public key can verify that the file originated from the trusted source and has not been tampered with. This is the standard mechanism for ensuring model provenance in S3 or any artifact repository.

Answer

Data masking

Answer

Model quantization

Answer

Base64 encoding

Question 14

A retail company uses a machine learning model to approve credit applications. Regulators require the company to explain adverse decisions to applicants. The data science team wants a method that provides local, instance-level explanations of feature contributions that are additive and consistent. Which technique should they adopt?

Accepted Answer

SHAP (SHapley Additive exPlanations) values.. SHAP values provide consistent, additive, instance-level attributions that can explain individual credit decisions, meeting both technical and regulatory needs. Global importance, partial dependence, and LIME either lack local specificity or lack the consistency and additivity required for defensible adverse action explanations.

Answer

LIME (Local Interpretable Model-agnostic Explanations).

Answer

Partial dependence plots.

Answer

Global permutation feature importance.

Question 15

A financial services firm has deployed an AI governance framework with a central AI risk committee. Business units complain that the committee is a bottleneck, delaying low-risk AI pilots by weeks. The Chief AI Officer wants to maintain oversight while accelerating delivery. Which governance design change best addresses this?

Accepted Answer

Delegate approval authority for low-risk AI use cases to business-unit AI risk champions using a pre-approved risk pattern library, with the central committee retaining review of high-risk and novel cases.. The bottleneck stems from a single-tier approval model in which all AI pilots, regardless of risk, route through the central committee. Delegating low-risk approvals to trained business-unit champions using pre-approved patterns keeps the central committee as the owner of the risk framework and the approver of high-risk or novel cases, while materially reducing cycle time for routine pilots. This is a governance design change rather than a capacity or oversight removal.

Answer

Dissolve the central AI risk committee and assign all AI risk decisions to each business unit's existing operational risk function.

Answer

Keep the central committee as the sole approver but add more staff and increase meeting frequency to clear the backlog.

Answer

Allow business units to self-certify all AI pilots as low risk and proceed without notifying the central committee.

Question 16

A company uses an AI model to screen job applicants. An internal audit finds that the model's decisions cannot be explained in terms a rejected candidate could understand, and the company operates in a jurisdiction with a right-to-explanation law. Which risk management response is MOST appropriate?

Accepted Answer

Implement post-hoc explanation techniques and a governance process that translates model outputs into candidate-understandable reasons, while monitoring explanation fidelity.. A right-to-explanation law requires that rejected candidates receive understandable reasons for decisions. Implementing post-hoc explanation techniques and a governance process to translate model outputs into candidate-friendly reasons addresses this directly while preserving the model. Monitoring explanation fidelity ensures the explanations remain valid as the model evolves, which is essential for sustained legal compliance.

Answer

Remove all demographic data from the training set to eliminate the need for explanations.

Answer

Replace the model with a simpler, inherently interpretable model such as a logistic regression or decision tree, accepting a possible accuracy trade-off.

Answer

Document the model's architecture and training procedure in detail and provide that documentation to rejected candidates upon request.

Question 17

A financial services firm uses an AI model to approve loan applications. The model was trained on historical data that reflects past lending biases. An internal audit finds that the model's decisions disproportionately deny loans to applicants from certain demographic groups, even though those groups are not explicitly represented in the input features. The AI security manager must address this risk. Which action is MOST effective for mitigating the identified bias?

Accepted Answer

Apply a bias mitigation technique such as adversarial debiasing during model training to reduce disparate impact across protected groups.. Bias that persists despite the absence of explicit protected attributes is often embedded in the model's learned representations through proxy variables. Adversarial debiasing actively removes this encoded bias during training by preventing the model from retaining information about protected groups. Simply removing attributes or adding data does not correct the learned bias, and post-processing may introduce other issues.

Answer

Implement a post-processing step that adjusts the model's decision threshold for each demographic group to achieve statistical parity.

Answer

Increase the size of the training dataset by collecting more historical loan data to improve the model's overall accuracy.

Answer

Remove all demographic attributes from the training dataset and retrain the model.

Question 18

A financial institution is using a large language model (LLM) for customer service. The security team wants to detect when the model is generating outputs that contain sensitive information from its training data. Which technique should be implemented to identify such leakage?

Accepted Answer

Canary insertion and monitoring. Canary insertion is a proactive detection technique where unique tokens are planted in training data. If they appear in model outputs, it signals that the model has memorized and potentially leaked sensitive information. This directly addresses the need to identify leakage, unlike preventive measures such as differential privacy or unrelated techniques like watermarking.

Answer

Membership inference attack testing

Answer

Differential privacy during training

Answer

Output watermarking

Question 19

A machine learning engineer is training a fraud detection model on a dataset that includes sensitive customer transaction records. The organization wants to ensure that individual records cannot be re-identified from the trained model. Which technique should the engineer apply during training to provide a formal privacy guarantee?

Accepted Answer

Differential privacy. Differential privacy is the only technique listed that provides a formal, mathematical guarantee that an individual's data cannot be re-identified from the model. It works by injecting noise into the training process, ensuring that the model's behavior is statistically similar whether or not any single record is included. Other techniques like data masking, homomorphic encryption, and secure multi-party computation address different aspects of privacy but do not offer this guarantee.

Answer

Homomorphic encryption

Answer

Data masking

Answer

Secure multi-party computation

Question 20

A hospital is preparing to fine-tune a clinical summarization model on de-identified patient notes. The AI security manager must select controls that reduce the risk of training-data memorization leaking back through model outputs. (Choose two.)

Accepted Answer

Apply differential privacy during fine-tuning with a formally tracked privacy budget.. Memorization leakage is mitigated by constraining how much any single record shapes the model and by verifying empirically that it did not. Differential privacy with a tracked budget provides the preventive, measurable constraint, while membership inference testing provides the detective evidence that the constraint held. Capacity scaling, data co-location, and log suppression either worsen the risk or address unrelated concerns.

Answer

Store the de-identified training corpus in the same object bucket used for model artifacts to simplify lineage tracking.

Answer

Increase the model's parameter count so that training examples are distributed across more weights.

Answer

Disable output logging on the summarization service so that generated text cannot be harvested.