AI Security, Ethics and Governance

A healthcare organization uses an AI model to recommend treatment plans. The model was trained on data from a single hospital, and now treats patients from multiple demographics. Which ethical concern is most critical?

An organization deploys an AI system that processes personal data of EU citizens. Which regulatory framework imposes strict requirements on automated decision-making and profiling?

A financial institution uses an AI model to approve loans. The model uses features including credit score and ZIP code. During an audit, it is discovered that the model has a high false positive rate for loan default predictions in certain ZIP codes. What should the institution do to address this?

A company is developing an AI chatbot for customer service. They want to ensure the bot does not generate offensive or harmful responses. Which governance practice should be implemented first?

A healthcare organization is deploying an AI system to analyze patient records and recommend treatment plans. To comply with data privacy regulations, what is the most important security measure to implement?

An image classification model misclassifies a stop sign as a speed limit sign after a few pixels are altered. What is the most effective defense against such attacks?

Which TWO are key requirements for AI governance under the EU AI Act for high-risk AI systems? (Choose two.)

An AI system used for autonomous driving is found to have a lower accuracy in detecting pedestrians with darker skin tones. The development team wants to address this ethical issue. Which action is most effective?

What is the primary function of an AI ethics board within an organization?

You are a security engineer at a large e-commerce company that uses an AI-based recommendation system. The system is deployed on a Kubernetes cluster and uses a TensorFlow model served via REST API. Recently, the security team detected unusual API calls that caused the model to return incorrect recommendations. Analysis shows that the inputs were crafted to maximize prediction error. The team suspects an adversarial attack. You need to implement a solution that detects and mitigates such attacks in real-time without requiring model retraining. Which approach should you take?

A financial institution uses a deep learning model for loan approvals. Under the EU AI Act, this is considered a high-risk AI system. Which mandatory requirement must the institution fulfill before deployment?

Which THREE are effective methods for ensuring data privacy in AI training? (Choose three.)

A bank uses an AI model to approve loans. During an audit, it is found that the model denies loans at a higher rate for a certain ethnic group. Which governance principle is primarily violated?

A hospital deploys an AI diagnostic assistant that analyzes medical images. The system has been in use for six months, and radiologists have reported that the AI is increasingly confident in its predictions, but sometimes misses rare conditions. The AI ethics board is concerned about overreliance and potential harm from false negatives. They want to implement a governance framework that ensures appropriate human oversight. The hospital has a limited IT budget. What is the best approach?

A financial institution uses an AI model to approve loan applications. The model was trained on historical data that included biased lending practices. The bank's ethics committee wants to mitigate bias without removing protected attributes. Which approach best balances fairness and model performance?

Refer to the exhibit. Which model is NOT in full compliance with the policy?

Which THREE are key principles of trustworthy AI according to the OECD?

Which THREE of the following are key components of an AI governance framework?

Which TWO of the following are common methods for mitigating bias in AI models?

Which THREE of the following are key components of an AI governance framework?

A team is deploying an AI model that predicts patient readmission risk. The model was trained on data from three hospitals but will be used in a fourth hospital with different patient demographics. What is the most important security risk to assess?

A company's AI governance board requires each model to have a model card documenting intended use, performance metrics, and limitations. What is the primary purpose of a model card?

A self-driving car company is testing an AI model for pedestrian detection. During simulation, the model fails to detect pedestrians in low-light conditions. The safety team wants to improve robustness without retraining the entire model from scratch. Which approach is most appropriate?

A large e-commerce company uses a recommendation engine trained on millions of user interactions. Recently, the marketing team noticed a sharp increase in click-through rates for a particular product category. Upon investigation, an engineer found that a competitor had injected fake user profiles that consistently clicked on their products, skewing the training data. The company needs to remediate the attack and prevent future occurrences. The team has limited time and budget. Which course of action should the company take first?

Refer to the exhibit. A security auditor identifies a critical vulnerability that could allow an attacker to manipulate model inputs to cause misclassification. Which configuration setting is most directly responsible for this vulnerability?

An AI development team is building a system to detect fraudulent transactions. They want to ensure the model complies with regulations requiring that individuals can question automated decisions. Which governance element is most relevant?

A financial institution is implementing an AI-based fraud detection system. The compliance officer is concerned about potential bias in the model that could lead to unfair treatment of certain customer groups. Which governance practice should be prioritized to address this concern?

After deploying a model for fraud detection, the data scientist observes a steady decline in precision over two months. Which issue is most likely occurring?

A security researcher demonstrates that by adding small perturbations to an image of a stop sign, an autonomous vehicle's AI misclassifies it as a speed limit sign. This is an example of which type of attack?

Which principle ensures that AI decisions can be traced back and understood by humans?

Which TWO of the following are effective techniques for detecting bias in an AI model?

A bank deploys an AI system to approve loan applications. During testing, the model denies a disproportionate number of applicants from a particular demographic group, even after controlling for credit history. Which ethical principle is being violated?

A credit union uses an AI model to approve personal loans. The model was trained on historical data from the past five years. A recent internal review shows that the model approves loans predominantly for white applicants compared to other ethnicities, even when income and credit scores are similar. The credit union wants to comply with fair lending laws without significantly reducing overall approval rates. The data science team has access to the training data. What is the most appropriate remediation step?

Refer to the exhibit. An auditor reports that the model's fairness check was bypassed in a recent deployment. Based on the policy, what is the most likely cause?

A security analyst notices that an AI model used for facial recognition is returning unusually high confidence scores for certain individuals while consistently misidentifying others. Which type of attack is most likely occurring?

Which TWO of the following are common techniques to improve the transparency and interpretability of an AI model?

A security team discovers that an AI-based anomaly detection system frequently misclassifies benign network traffic as malicious when the source IP is from a specific geographic region. Which type of AI vulnerability is most likely being exploited?

A healthcare startup deploys an AI model to predict patient readmission rates. An internal audit reveals that the model consistently underestimates readmission risk for non-native English speakers. According to AI ethics principles, what is the most appropriate course of action?

A security analyst is reviewing logs from an AI-powered recommendation system and notices an unusually high number of requests for products from a specific vendor. The analyst suspects data poisoning. Which mitigation strategy should be implemented first?

Which TWO are common types of adversarial attacks on AI models?

Refer to the exhibit. An AI governance review finds that a model was deployed without required ethics approval. Based on the audit log, who is most responsible for the compliance failure?

A large hospital system deploys an AI triage system for emergency rooms. The system uses patient vitals and symptoms to recommend treatment priority. Six months after deployment, complaints arise that the system frequently underestimates the severity of symptoms for patients from certain ethnic backgrounds. A data scientist runs a bias audit and finds that the model's false negative rate is 20% higher for the minority group. The hospital's AI governance board requires immediate corrective action. The data science team has limited resources and cannot retrain the entire model from scratch. They have access to the training data, which is imbalanced. The model is a gradient boosted tree. Which course of action best addresses the bias while minimizing operational impact?

An AI model's performance drops significantly in production compared to testing. The data shows distribution shift. What is the best first step?

An e-commerce company uses an AI system to set dynamic prices for products. A customer complains that the price they see is higher than the price shown to a friend for the same product at the same time. The company wants to ensure pricing fairness. Which ethical principle should guide the redesign of the pricing algorithm?

A research lab trains a language model using DP-SGD. What primary privacy risk does this technique mitigate?

You are an AI governance officer at a bank that uses a machine learning model to predict credit risk. The model was developed by an external vendor and uses a proprietary algorithm. The bank's compliance team has determined that the model must be explainable to meet regulatory requirements. However, the vendor claims the model is a 'black box' and cannot provide explanations. You need to ensure compliance while maintaining the model's performance. What is the best course of action?

Which AI governance framework is specifically designed by the U.S. National Institute of Standards and Technology (NIST) to help organizations manage AI risks?

Which TWO techniques are specifically designed to protect individual privacy when training AI models?

Which TWO of the following are effective defenses against adversarial examples in AI systems?

Which TWO of the following are effective defenses against adversarial evasion attacks on image classifiers?

An AI system in a self-driving car misinterprets a stop sign due to a small sticker placed on it. This is an example of which security vulnerability?

Which TWO are common attack vectors against AI systems? (Choose two.)

A company deployed an AI chatbot that started generating offensive responses after a data update. The security team needs to quickly mitigate the issue. What should they do first?

A healthcare AI system used for diagnosis shows a significant accuracy difference between demographic groups. Which technique should be applied to directly reduce this bias during model training?

An organization wants to ensure its AI systems comply with new regulations requiring explanations for automated decisions. Which governance practice is most directly relevant?

An organization uses an AI-based hiring tool. To prevent bias, they want to ensure the model's decisions are explainable. Which approach is most suitable?

Which THREE of the following are key principles of AI ethics as defined by major frameworks?

Which practice best ensures AI systems comply with regulations like GDPR?

Which ethical concern is most directly associated with AI systems that fully automate decision-making without human oversight?

Which TWO of the following are common threats to AI model security?

A cybersecurity analyst monitors an AI chatbot that frequently produces offensive responses when given specific prompts. The development team suspects an adversarial attack. Which mitigation strategy is most effective against such prompt injection attacks?

Refer to the exhibit. A security analyst reviews the monitoring log for an AI fraud detection model. Which of the following is the most likely cause of the multiple alerts?

A financial services firm deploys an AI system to screen loan applications. The model was trained on historical data that reflected biased lending practices. After deployment, a regulatory body investigates and finds that the model denies loans at a disproportionately higher rate to a protected demographic group. The firm must address this issue while maintaining compliance with fair lending laws. The Chief AI Officer proposes four possible actions. Which action is the most appropriate first step?

An AI system used for resume screening is found to consistently rank male candidates higher than female candidates with similar qualifications. The HR director wants to remediate this bias without significantly reducing model accuracy. Which technique should be applied?

A startup develops an AI recruiting tool that screens resumes. After deployment, they receive a complaint from a candidate who claims the system rejected them due to age discrimination. The startup has no formal AI governance process. They want to quickly assess and remediate the issue. The dataset includes age as a feature. What should they do first?

During a penetration test, a security engineer discovers that an AI-powered chatbot can be tricked into revealing sensitive customer data by using specially crafted prompts. What type of attack is this, and what is the best mitigation?

Which TWO practices are most effective for ensuring the security of an AI model against adversarial attacks?

A company is developing an AI chatbot for customer service. The legal team is concerned that the chatbot might generate responses that violate privacy regulations. Which governance mechanism should be implemented to mitigate this risk?

Which THREE of the following are key principles of trustworthy AI as defined by major regulatory bodies?

Which TWO of the following are effective techniques to detect data poisoning attacks in a training dataset?

A company implements an AI-based chatbot for customer service. After deployment, customers report that the chatbot sometimes uses offensive language. The development team reviews the training data and finds no explicit offensive content. What is the most likely explanation?

A healthcare organization uses an AI model to predict patient readmission risk. To comply with patient privacy regulations, they apply differential privacy during training. What is the primary trade-off of using differential privacy?

An AI system used for resume screening is found to consistently reject female candidates for technical roles. The data science team retrains the model after removing the 'gender' feature, but the bias persists. What is the most likely cause?

A national security agency uses AI to analyze surveillance data for threat detection. The system is deployed in a high-stakes environment where false negatives could lead to missed threats, and false positives waste analyst time. Recently, a known hacker group attempted to evade detection by subtly modifying their communication patterns over time, a form of adversarial evasion. The agency wants to harden the system while maintaining performance. The system uses a deep neural network. Which mitigation strategy is most appropriate?

During a red-team exercise on an AI model, testers successfully extracted training data. Which vulnerability is this?

Refer to the exhibit. A system administrator sees these logs from an AI inference pipeline. What is the most likely sequence of events?

Which TWO of the following are best practices for securing an AI model against adversarial attacks?

An organization wants to implement an AI ethics board. Which composition best ensures independence and expertise?