AI Security, Ethics and Governance

A healthcare organization uses an AI model to recommend treatment plans. The model was trained on data from a single hospital, and now treats patients from multiple demographics. Which ethical concern is most critical?

An organization deploys an AI system that processes personal data of EU citizens. Which regulatory framework imposes strict requirements on automated decision-making and profiling?

A financial institution uses an AI model to approve loans. The model uses features including credit score and ZIP code. During an audit, it is discovered that the model has a high false positive rate for loan default predictions in certain ZIP codes. What should the institution do to address this?

An image classification model misclassifies a stop sign as a speed limit sign after a few pixels are altered. What is the most effective defense against such attacks?

A social media company's AI recommendation system pushes extreme content to users, causing harm. Which ethical principle is most violated?

Which TWO are key requirements for AI governance under the EU AI Act for high-risk AI systems? (Choose two.)

An AI system used for autonomous driving is found to have a lower accuracy in detecting pedestrians with darker skin tones. The development team wants to address this ethical issue. Which action is most effective?

What is the primary function of an AI ethics board within an organization?

A healthcare AI system misdiagnosed patients due to adversarial inputs. What security measure should be prioritized?

You are a security engineer at a large e-commerce company that uses an AI-based recommendation system. The system is deployed on a Kubernetes cluster and uses a TensorFlow model served via REST API. Recently, the security team detected unusual API calls that caused the model to return incorrect recommendations. Analysis shows that the inputs were crafted to maximize prediction error. The team suspects an adversarial attack. You need to implement a solution that detects and mitigates such attacks in real-time without requiring model retraining. Which approach should you take?

A financial institution uses a deep learning model for loan approvals. Under the EU AI Act, this is considered a high-risk AI system. Which mandatory requirement must the institution fulfill before deployment?

Which THREE are effective methods for ensuring data privacy in AI training? (Choose three.)

A marketing team wants to use a third-party generative AI service to create ad copy. The service provider states that submitted prompts and outputs may be used to improve its models. The company's legal team is concerned about confidential product launch details being entered into the tool. Which of the following is the MOST appropriate first step?

A bank uses an AI model to approve loans. During an audit, it is found that the model denies loans at a higher rate for a certain ethnic group. Which governance principle is primarily violated?

A hospital deploys an AI diagnostic assistant that analyzes medical images. The system has been in use for six months, and radiologists have reported that the AI is increasingly confident in its predictions, but sometimes misses rare conditions. The AI ethics board is concerned about overreliance and potential harm from false negatives. They want to implement a governance framework that ensures appropriate human oversight. The hospital has a limited IT budget. What is the best approach?

A financial institution uses an AI model to approve loan applications. The model was trained on historical data that included biased lending practices. The bank's ethics committee wants to mitigate bias without removing protected attributes. Which approach best balances fairness and model performance?

Which THREE are key principles of trustworthy AI according to the OECD?

A manufacturing company uses a predictive maintenance AI system to schedule equipment repairs. The system was trained on sensor data from machinery. Recently, the system has been missing failures, leading to unexpected downtime. An investigation reveals that the sensor data from one plant has been corrupted due to a sensor malfunction. The corrupted data was used in retraining. The company needs to restore system accuracy quickly. The data science team can access the training logs. What is the best course of action?

Which TWO of the following are common methods for mitigating bias in AI models?

Which THREE of the following are key components of an AI governance framework?

A financial institution uses an AI model to approve small business loans. The model has a high approval rate for women-owned businesses but low for minority-owned businesses. The compliance officer is concerned about disparate impact. Which governance process should be implemented first?

A company's AI governance board requires each model to have a model card documenting intended use, performance metrics, and limitations. What is the primary purpose of a model card?

A large e-commerce company uses a recommendation engine trained on millions of user interactions. Recently, the marketing team noticed a sharp increase in click-through rates for a particular product category. Upon investigation, an engineer found that a competitor had injected fake user profiles that consistently clicked on their products, skewing the training data. The company needs to remediate the attack and prevent future occurrences. The team has limited time and budget. Which course of action should the company take first?

Refer to the exhibit. A security auditor identifies a critical vulnerability that could allow an attacker to manipulate model inputs to cause misclassification. Which configuration setting is most directly responsible for this vulnerability?

An AI development team is building a system to detect fraudulent transactions. They want to ensure the model complies with regulations requiring that individuals can question automated decisions. Which governance element is most relevant?

A multinational bank operates AI models in several countries with different privacy laws. The governance team wants a single control that demonstrates accountability across all jurisdictions. Which approach is most effective?

A financial institution is implementing an AI-based fraud detection system. The compliance officer is concerned about potential bias in the model that could lead to unfair treatment of certain customer groups. Which governance practice should be prioritized to address this concern?

A government agency uses an AI system to prioritize emergency response calls. An auditor finds that the model's decisions cannot be explained to citizens. Which governance mechanism is most appropriate to address this?

A retail company wants to ensure its AI-driven pricing algorithm does not discriminate against customers in protected groups. Which governance practice should be implemented first?

A security researcher demonstrates that by adding small perturbations to an image of a stop sign, an autonomous vehicle's AI misclassifies it as a speed limit sign. This is an example of which type of attack?

Which principle ensures that AI decisions can be traced back and understood by humans?

Which TWO of the following are effective techniques for detecting bias in an AI model?

A bank deploys an AI system to approve loan applications. During testing, the model denies a disproportionate number of applicants from a particular demographic group, even after controlling for credit history. Which ethical principle is being violated?

A hospital deploys an AI model to predict patient readmission risk. The compliance team asks which TWO technical controls help comply with data minimization principles under AI governance frameworks. (Choose two.)

A financial services firm uses an AI model to detect fraudulent transactions. The model's decisions must be explainable to regulators. The data science team proposes using a complex deep neural network with high accuracy. Which of the following approaches best balances accuracy and explainability?

A hospital wants to deploy an AI triage model that recommends which emergency department patients should be seen first. The clinical governance committee is defining controls to ensure the system remains accountable and safe after go-live. Which TWO controls BEST support ongoing accountability for this AI system? (Choose two.)

A retail bank's fraud model was trained on customer transaction data that included account holders in the EU. An internal audit finds the training pipeline copied raw transaction records, including names and card numbers, into an unencrypted research bucket for model retraining. Which action best aligns the remediation with data-protection obligations for that pipeline?

Which TWO of the following are common techniques to improve the transparency and interpretability of an AI model?

A healthcare startup deploys an AI model to predict patient readmission rates. An internal audit reveals that the model consistently underestimates readmission risk for non-native English speakers. According to AI ethics principles, what is the most appropriate course of action?

A security analyst is reviewing logs from an AI-powered recommendation system and notices an unusually high number of requests for products from a specific vendor. The analyst suspects data poisoning. Which mitigation strategy should be implemented first?

A large hospital system deploys an AI triage system for emergency rooms. The system uses patient vitals and symptoms to recommend treatment priority. Six months after deployment, complaints arise that the system frequently underestimates the severity of symptoms for patients from certain ethnic backgrounds. A data scientist runs a bias audit and finds that the model's false negative rate is 20% higher for the minority group. The hospital's AI governance board requires immediate corrective action. The data science team has limited resources and cannot retrain the entire model from scratch. They have access to the training data, which is imbalanced. The model is a gradient boosted tree. Which course of action best addresses the bias while minimizing operational impact?

An AI model's performance drops significantly in production compared to testing. The data shows distribution shift. What is the best first step?

A healthcare analytics company has trained an AI model to predict patient readmission risk using a dataset that includes ZIP code, race, and historical healthcare costs. Before deployment, the compliance team runs a fairness audit and finds that the model's predictions correlate strongly with race even though race was not used as a direct input feature. Which of the following BEST describes this phenomenon?

A research lab trains a language model using DP-SGD. What primary privacy risk does this technique mitigate?

You are an AI governance officer at a bank that uses a machine learning model to predict credit risk. The model was developed by an external vendor and uses a proprietary algorithm. The bank's compliance team has determined that the model must be explainable to meet regulatory requirements. However, the vendor claims the model is a 'black box' and cannot provide explanations. You need to ensure compliance while maintaining the model's performance. What is the best course of action?

Which AI governance framework is specifically designed by the U.S. National Institute of Standards and Technology (NIST) to help organizations manage AI risks?

Which TWO of the following are effective defenses against adversarial examples in AI systems?

A retail company uses an AI system to detect shoplifting from surveillance footage. The system has been criticized for disproportionately flagging customers from certain ethnic groups. The company wants to address this ethical concern. Which of the following should be the first step?

A company uses a machine learning model to recommend products to customers. The marketing team notices that the model is recommending high-profit items more frequently than low-profit items, even when customers are likely to prefer the latter. This behavior is causing customer dissatisfaction. Which approach would best align the model with customer preferences while maintaining profitability?

An AI system in a self-driving car misinterprets a stop sign due to a small sticker placed on it. This is an example of which security vulnerability?

Which TWO are common attack vectors against AI systems? (Choose two.)

A company deployed an AI chatbot that started generating offensive responses after a data update. The security team needs to quickly mitigate the issue. What should they do first?

A multinational corporation is developing an AI system that will be deployed in multiple countries with varying data protection laws. The legal team wants to ensure compliance with regulations such as the GDPR. Which of the following is the most appropriate action to take during the design phase?

A healthcare AI system used for diagnosis shows a significant accuracy difference between demographic groups. Which technique should be applied to directly reduce this bias during model training?

An organization wants to ensure its AI systems comply with new regulations requiring explanations for automated decisions. Which governance practice is most directly relevant?

A logistics company is preparing an AI governance program for a route-optimization model that influences driver schedules. The compliance team must demonstrate accountability to regulators. Which two practices best establish documented accountability for this system? (Choose two.)

An organization uses an AI-based hiring tool. To prevent bias, they want to ensure the model's decisions are explainable. Which approach is most suitable?

Which THREE of the following are key principles of AI ethics as defined by major frameworks?

Which practice best ensures AI systems comply with regulations like GDPR?

An AI team is developing a model that will make hiring recommendations. Which ethical principle requires that candidates be informed about how their data is used and have a way to challenge decisions?

A social media company uses an AI content moderation system to filter hate speech. The system uses a natural language processing model trained on user reports. Recently, the model's false positive rate has increased, blocking legitimate posts. An internal audit reveals that a coordinated group of users has been falsely reporting harmless posts, causing the model to learn incorrect patterns. The company needs to address the attack and restore accuracy. The engineering team can modify the training pipeline. What is the most effective first step?

Which TWO of the following are common threats to AI model security?

A cybersecurity analyst monitors an AI chatbot that frequently produces offensive responses when given specific prompts. The development team suspects an adversarial attack. Which mitigation strategy is most effective against such prompt injection attacks?

A financial services firm deploys an AI system to screen loan applications. The model was trained on historical data that reflected biased lending practices. After deployment, a regulatory body investigates and finds that the model denies loans at a disproportionately higher rate to a protected demographic group. The firm must address this issue while maintaining compliance with fair lending laws. The Chief AI Officer proposes four possible actions. Which action is the most appropriate first step?

An AI system used for resume screening is found to consistently rank male candidates higher than female candidates with similar qualifications. The HR director wants to remediate this bias without significantly reducing model accuracy. Which technique should be applied?

A startup develops an AI recruiting tool that screens resumes. After deployment, they receive a complaint from a candidate who claims the system rejected them due to age discrimination. The startup has no formal AI governance process. They want to quickly assess and remediate the issue. The dataset includes age as a feature. What should they do first?

During a penetration test, a security engineer discovers that an AI-powered chatbot can be tricked into revealing sensitive customer data by using specially crafted prompts. What type of attack is this, and what is the best mitigation?

A global bank deploys a generative AI assistant that summarizes internal policy documents for loan officers across the European Union and the United States. The compliance team must ensure the system respects regional AI regulations. Which of the following actions is MOST appropriate for aligning the deployment with these requirements?

A data scientist trains a sentiment analysis model on user reviews. To ensure transparency, they want to explain why the model classified a particular review as negative. Which explainability technique should they use?

A media company uses a generative AI service to draft marketing copy. Legal asks the AI governance team to reduce the risk that outputs reproduce copyrighted passages from the training corpus. Which control most directly addresses that specific risk?

Which THREE of the following are key principles of trustworthy AI as defined by major regulatory bodies?

An organization implements AI governance following the NIST AI Risk Management Framework. They need to ensure that all model decisions are logged with sufficient detail for later audit. Which logging requirement is most critical for traceability?

A company implements an AI-based chatbot for customer service. After deployment, customers report that the chatbot sometimes uses offensive language. The development team reviews the training data and finds no explicit offensive content. What is the most likely explanation?

A hospital's AI triage model was trained on five years of historical admissions. A governance review finds that patients over 75 are systematically assigned lower acuity scores than clinically equivalent younger patients, even though age is not an input feature. Which governance control most directly addresses this finding?

Which TWO of the following are essential components of a responsible AI governance framework?

A healthcare organization uses an AI model to predict patient readmission risk. To comply with patient privacy regulations, they apply differential privacy during training. What is the primary trade-off of using differential privacy?

A national security agency uses AI to analyze surveillance data for threat detection. The system is deployed in a high-stakes environment where false negatives could lead to missed threats, and false positives waste analyst time. Recently, a known hacker group attempted to evade detection by subtly modifying their communication patterns over time, a form of adversarial evasion. The agency wants to harden the system while maintaining performance. The system uses a deep neural network. Which mitigation strategy is most appropriate?

During a red-team exercise on an AI model, testers successfully extracted training data. Which vulnerability is this?

Which TWO of the following are best practices for securing an AI model against adversarial attacks?

An organization wants to implement an AI ethics board. Which composition best ensures independence and expertise?

A city agency deploys an AI system that scores permit applications. The vendor refuses to disclose model weights or feature importance, citing trade secrets. The agency's oversight board must still meet its obligation to explain adverse decisions to applicants. Which approach best satisfies that obligation?

A company is deploying an AI-based resume screening tool. The security team is concerned about adversarial attacks that could manipulate the tool's rankings. Which TWO of the following are effective defenses against such attacks? (Choose two.)