AAISM Multiple Select — 30 Questions

Question 1

Which THREE practices are necessary for managing 'AI Model Version Control' as part of an overall risk management strategy?

Accepted Answer

Using Git-based tracking for model configuration and code.. Version control ensures reproducibility, rollback capability, and auditability in AI risk management.

Answer

Allowing only one developer to modify the model.

Answer

Storing only the production model artifact.

Question 2

Which THREE factors increase 'AI Model Risk'?

Accepted Answer

High model complexity (black box).. High complexity, lack of interpretability, and critical business impact are the top drivers of AI model risk.

Answer

Using a low-latency network.

Answer

Using a well-documented framework.

Question 3

Which TWO of the following are considered 'AI Supply Chain' risks?

Accepted Answer

Inclusion of poisoned data in third-party datasets.. AI supply chain risks include dependencies on external data and untrusted pre-trained models.

Answer

Lack of internal developer training.

Answer

Excessive use of cloud storage.

Answer

High turnover of AI research staff.

Question 4

Which THREE actions should be included in an AI incident response plan?

Accepted Answer

Conducting a root cause analysis post-incident.. Communication, containment, and root cause analysis are standard requirements for effective incident management.

Answer

Deleting the model without a backup.

Answer

Increasing the marketing budget.

Question 5

Which THREE security controls are effective against 'Data Leakage' in AI?

Accepted Answer

Data Loss Prevention (DLP) tools.. DLP, access control, and output filtering are the standard triad for preventing sensitive data exposure via AI.

Answer

Using a louder cooling system.

Answer

Increasing the model's training duration.

Question 6

Which THREE criteria are essential for evaluating the risk of an AI vendor's 'Model Card'?

Accepted Answer

Disclosure of training data sources.. Model Cards provide transparency regarding intended use, limitations, and performance, which are critical for risk assessment.

Answer

The vendor's annual financial report.

Answer

The number of employees at the vendor.

Question 7

Which TWO security controls are recommended for protecting 'Training Data'?

Accepted Answer

Encryption at rest for all dataset storage.. Training data should be protected using access controls and encryption at rest to prevent unauthorized access.

Answer

Publicly hosting the data on GitHub for reproducibility.

Answer

Storing all passwords in the training data.

Answer

Using only high-resolution images.

Question 8

Which THREE steps are needed for 'AI Risk Assessment'?

Accepted Answer

Perform a threat modeling exercise.. Assessment requires identifying the AI components, evaluating threats, and determining the business impact.

Answer

Publish the risk assessment on the public internet.

Answer

Train a new model to verify the findings.

Question 9

Which THREE technical controls are recommended to secure an AI model's API endpoint?

Accepted Answer

Enforcing strict schema validation on all inputs.. Securing AI APIs requires defense-in-depth including rate limiting, authentication, and input sanitization.

Answer

Encrypting the model weights at rest in the cloud.

Answer

Removing all logging to prevent log injection.

Question 10

Which TWO factors are critical when assessing the risk of a new Generative AI use case?

Accepted Answer

The potential business impact if the system fails.. Business impact and data sensitivity are the foundational elements for risk assessment in AI.

Answer

The aesthetic of the user interface.

Answer

The office location of the developers.

Answer

The programming language used.

Question 11

Which TWO activities ensure 'AI Safety' in development?

Accepted Answer

Adversarial testing (red teaming).. Adversarial testing and rigorous documentation are key safety practices.

Answer

Using unmonitored cloud servers.

Answer

Increasing the amount of public data used.

Answer

Removing all encryption.

Question 12

Which THREE documents are vital for an AI audit trail?

Accepted Answer

Model validation and testing reports.. Model version, training set, and validation report are the three pillars of a reconstructible audit trail.

Answer

The office lease agreement.

Answer

A copy of the employee handbook.

Question 13

Which TWO of the following are primary risks associated with 'membership inference attacks' against an AI model?

Accepted Answer

Exposure of sensitive information about training data subjects.. Membership inference attacks aim to determine if a specific data point was used in the training set, risking privacy leakage.

Answer

Unauthorized modification of model weights.

Answer

Unauthorized access to the model training algorithm.

Answer

Complete system shutdown via resource exhaustion.

Question 14

Which TWO components are essential for a robust AI Governance framework?

Accepted Answer

Defined roles and accountability structures.. Policies and clearly defined roles are the foundation of any governance system.

Answer

The company party schedule.

Answer

A list of all employee names.

Answer

The best-selling AI books.

Question 15

Which THREE items should be included in an 'AI Inventory'?

Accepted Answer

Unique model identifier and version.. Model version, owner, and risk rating are the core pieces of information needed to manage an AI portfolio.

Answer

The model's favorite color.

Answer

The developer's favorite food.

Question 16

Which THREE components are critical for an 'AI Incident Response' plan?

Accepted Answer

Communication channels with data scientists and legal teams.. An AI IR plan must account for model-specific issues like unexpected performance drops, bias, and adversarial attacks.

Answer

Requirements to publish all internal vulnerabilities publicly.

Answer

Automated deletion of all logs.

Question 17

Which THREE elements are essential for 'AI Governance'?

Accepted Answer

Defined AI ethics and safety policies.. AI governance requires clear policies, oversight committees, and defined risk frameworks.

Answer

Access to all employees' private emails.

Answer

A mandate to use the most expensive GPUs available.

Question 18

Which TWO of the following are effective methods for monitoring and detecting AI security incidents in a cloud environment?

Accepted Answer

Ingesting model inference logs into a SIEM. Centralized logging (e.g., CloudWatch, Azure Monitor) and anomaly detection are critical for identifying unexpected model interactions.

Answer

Disabling logging to reduce cloud spend

Answer

Using standard database backup schedules

Answer

Hardcoding API credentials in application code

Question 19

Which TWO measures are most effective in reducing the risk of 'Hallucinations' in LLM systems?

Accepted Answer

Using Retrieval-Augmented Generation (RAG).. RAG and Grounding ensure the model relies on external, verified context rather than its internal probabilistic memory.

Answer

Training the model on larger public internet datasets.

Answer

Removing all punctuation from the input.

Answer

Increasing the model's temperature parameter to 2.0.

Question 20

Which THREE factors must be included in a 'Model Risk Management' (MRM) policy?

Accepted Answer

Clear model lifecycle stages and governance gates.. A robust MRM policy covers the lifecycle from model development and validation to monitoring and retirement.

Answer

The names of all employees who use the AI.

Answer

A list of all model research papers published by the company.