CCNA Aio Ai Governance Ethics Questions

The Govern function in the NIST AI RMF is specifically designed to establish organizational structures, policies, and accountability mechanisms for AI risk management. This includes defining roles and responsibilities, setting risk management processes, and ensuring oversight across the AI lifecycle. The other functions (Map, Measure, Manage) focus on different aspects such as understanding context, assessing risks, and treating risks, respectively.

LIME (Local Interpretable Model-agnostic Explanations) is the correct technique because it generates local explanations by fitting a simple, interpretable surrogate model (e.g., linear regression or decision tree) around a specific prediction. It is model-agnostic, meaning it works with any black-box classifier, and it perturbs the input data near the instance of interest to understand which features most influenced the prediction.

Using energy-efficient hardware (A) and selecting efficient model architectures (E) directly reduce energy consumption. Cloud optimization (B) may help but is less direct; training on weekends (C) does not affect total energy; using larger datasets (D) increases energy use.

Understanding the model's license is critical because open-source licenses can have restrictions on commercial use, attribution requirements, or copyleft provisions that affect how the model can be used and distributed. The other options are less directly relevant to the open vs proprietary decision.

The EU AI Act requires that high-risk AI systems allow for human oversight, including the ability to override or reverse the system's decisions. A mandatory human review before final approval ensures that the human can intervene. The other options either do not provide effective oversight or allow for rubber-stamping.

An AI ethics board is essential because it provides independent oversight to ensure AI systems align with ethical principles, legal requirements, and corporate values. This board reviews high-risk AI use cases, approves ethical impact assessments, and enforces accountability, which is a core requirement of AI governance frameworks like the NIST AI Risk Management Framework.

An AI ethics board should define fairness criteria, review models for bias, and establish a human oversight process. Designing the algorithm is a technical task for engineers. Marketing the system is a business function, not an ethics board duty.

Under the EU AI Act, credit scoring systems are classified as high risk because they determine access to financial resources and can significantly impact individuals' lives. This classification is based on the system's use in evaluating creditworthiness, which falls under Annex III's list of high-risk AI applications. Therefore, Option D is correct.

Federated learning is the correct technique because it trains a shared model across decentralized edge devices holding local data, without transferring raw customer data to a central server. Only model updates (gradients) are sent to the aggregation server, preserving data locality and reducing exposure. This directly addresses the requirement of avoiding raw data transfer while still enabling collaborative model training.

Federated learning trains model copies across multiple sites and aggregates only model updates (gradients) to a central server, keeping patient data local. Differential privacy adds noise to data but does not inherently prevent data sharing. Anonymisation and pseudonymisation still require sharing data, albeit de-identified.

An AI ethics board should oversee AI projects for ethical compliance and approve high-risk AI initiatives. Implementing technical models and auditing data privacy are operational tasks not typically under the board's direct purview.

Human-in-the-loop (HITL) is the correct mechanism because it requires a human to review and approve or reject the AI's decision before it is executed. This ensures that for high-stakes decisions, such as allocating limited social services, a human can intervene to prevent unfair or erroneous outcomes, directly addressing the fairness requirement.

Model pruning reduces the number of parameters in the model, and knowledge distillation trains a smaller student model to mimic a larger teacher model. Both techniques directly reduce the computational operations (FLOPs) required during training and inference, leading to significant energy savings. In contrast, using FP32 or increasing epochs increases energy consumption, and adding more GPUs increases total power draw even if wall-clock time decreases.

Option B is correct because using energy-efficient hardware such as Tensor Processing Units (TPUs) or specialized AI accelerators reduces the power consumption per floating-point operation, directly lowering the carbon footprint of training large language models. This aligns with green AI principles by optimizing the energy-to-performance ratio.

Historical bias occurs when the training data reflects past societal inequalities, leading the model to learn and perpetuate those patterns. In this case, if historical loan data shows higher denial rates for a demographic group due to past discriminatory practices, the model will replicate that bias in its predictions. This is the most likely cause because the model is not inherently biased but inherits bias from the data it was trained on.

Option A is correct because transparency about AI-generated content is a core principle of AI governance and ethics. Labeling AI-generated outputs as such allows users to make informed decisions about the content they consume, aligning with responsible AI practices.

Human-in-the-loop oversight with an override mechanism allows a qualified human to review and override automated decisions, satisfying the EU AI Act's requirement for high-risk systems.

Option A is correct because Article 22 of the GDPR grants data subjects the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significant effects. For healthcare AI systems, this means patients have the right to obtain an explanation of the decision reached by the algorithm, such as how a diagnosis or treatment recommendation was derived. This requirement ensures transparency and accountability in high-stakes automated decisions.

LIME (Local Interpretable Model-agnostic Explanations) is the correct technique because it generates local feature importance values by fitting a simpler, interpretable model (e.g., linear regression or decision tree) around the prediction of the black-box model. This allows the data scientist to explain why a specific loan application was denied by identifying which features (e.g., income, credit score) most influenced that particular decision. Unlike global methods, LIME focuses on the local neighborhood of the instance, making it ideal for explaining individual predictions.

Option D is correct because accountability for AI-driven decisions requires clear assignment of human roles with oversight and decision authority. This ensures that there is a responsible party who can review, override, or be held liable for the AI's outputs, which is a core principle of AI governance frameworks such as the NIST AI Risk Management Framework.

HIPAA (Health Insurance Portability and Accountability Act) is the correct regulatory framework because the scenario involves a healthcare AI startup using protected health information (PHI) to predict patient readmission risk. HIPAA governs the use, disclosure, and safeguarding of PHI by covered entities and their business associates, which includes AI models processing patient data for post-discharge resource allocation.

Option C is correct because Article 13 of the EU AI Act requires deployers of high-risk AI systems to provide clear and meaningful transparency information to affected individuals, including the system's capabilities, limitations, and the logic behind decisions. This obligation ensures that individuals subject to automated credit scoring understand how their data is being used and can exercise their rights under the regulation.

Federated learning is the correct technique because it enables multiple hospitals to collaboratively train a shared diagnostic AI model without exchanging raw patient data. Instead, each hospital trains a local model on its own data, and only encrypted model updates (e.g., gradients or weights) are sent to a central server for aggregation. This keeps all sensitive patient information local, directly addressing the requirement of data locality while still benefiting from collective learning.

LIME (Local Interpretable Model-agnostic Explanations) is the correct choice because it is specifically designed to provide local explanations for individual predictions by approximating the complex model with a simpler, interpretable surrogate model around that specific instance. For a tree-based model that is not inherently interpretable, LIME can explain why a single loan application was rejected by perturbing the input and observing the changes in predictions, making it ideal for this use case.

The correct answer is D, historical bias, because the model's lower scoring of female candidates stems directly from training data that reflects past hiring decisions where the company historically hired more men. This bias is embedded in the data itself, not introduced by the algorithm or data collection method. Historical bias occurs when the training data encodes societal or organizational prejudices from the past, which the model then perpetuates.

The EU AI Act for high-risk systems requires risk management, human oversight, and transparency documentation. Open-sourcing the model is not required; obtaining consent is not a specific requirement for high-risk systems.

Differential privacy (Option C) is the correct technique because it adds calibrated noise to the training data or model outputs, providing a mathematical guarantee against re-identification even if an attacker has auxiliary information. This directly addresses HIPAA's requirement to protect patient privacy while preserving statistical utility for disease risk prediction.

The EU AI Act requires human-in-the-loop (HITL) oversight for high-risk AI systems like loan approval, meaning a human must be able to intervene and override the system's decisions during operation. This ensures that automated decisions can be reviewed and corrected in real-time, preventing fully autonomous outcomes in critical areas such as credit scoring.

Option A is correct because analyzing the model for disparate impact using statistical tests (e.g., the 80% rule or chi-square test) directly measures whether the model produces systematically different outcomes for protected groups. This is a foundational step in fairness auditing, as it quantifies bias before any mitigation is applied, aligning with regulatory expectations like the Equal Credit Opportunity Act (ECOA).

The AI system's output (incorrectly flagging legitimate posts as hate speech) is a direct result of the model's design, training data, or deployment choices, which is the definition of algorithmic bias. This bias disproportionately affects minority groups because the algorithm's decision-making process systematically produces unfair outcomes for those groups, even if the training data itself was not historically biased.

Equalised odds requires that a model's false positive rates and true positive rates are equal across all demographic groups. Since the vendor's system has significantly different false positive rates across groups, it violates the equalised odds fairness criterion, even if demographic parity (equal selection rates) is satisfied. This is a core fairness metric in AI governance, as it ensures that errors are distributed equitably.

Green AI advocates for resource-efficient AI, including using smaller models, pruning, and efficient architectures to reduce carbon footprint. Training larger models with more data increases environmental impact, not reduces it.

Option D is correct because setting a privacy budget (epsilon) is a core mechanism in differential privacy that quantifies and limits the amount of information leaked about any individual in the dataset. By controlling epsilon, the data scientist can formally bound the privacy loss, ensuring that the model's outputs do not reveal whether any specific individual's data was included in training.

Historical bias occurs when the training data reflects past societal biases, such as underrepresentation of certain groups in hiring. The model learns these patterns, perpetuating unfairness. Selection bias arises from non-random sampling, confirmation bias from favoring information that confirms preexisting beliefs, and algorithmic bias from model design choices.

The NIST AI RMF's Govern function focuses on establishing governance structures, policies, and accountability mechanisms. Map, Measure, and Manage are other functions in the framework.

The Safe Harbor method of de-identification, as defined by the HIPAA Privacy Rule, removes 18 specific identifiers (e.g., names, dates, geographic subdivisions smaller than a state) from the training data. This ensures the data no longer qualifies as Protected Health Information (PHI), allowing it to be used for AI model training without violating HIPAA. Unlike other techniques, Safe Harbor provides a clear, legally safe harbor from privacy breach notification requirements when properly applied.

Watermarking AI-generated content with visible or invisible markers is a direct way to disclose AI origin. Using metadata alone can be stripped; disclaimers in terms of service are not visible to users; relying on human detection is unreliable.

Watermarking AI-generated content (Option A) is correct because it embeds an imperceptible, machine-detectable signal into the output, enabling provenance verification. This directly addresses transparency obligations by allowing downstream systems to identify synthetic text, which is a key requirement in emerging AI regulations such as the EU AI Act.

Historical bias occurs when the training data reflects past societal inequities. Selection bias would occur if the sample is not representative; confirmation bias stems from the model's own predictions; algorithmic bias arises from the model design.

Calibration is the correct metric because it directly measures whether the predicted probabilities of skin cancer match the actual outcomes across different skin tones. A model can have high overall accuracy but be miscalibrated for a subgroup if its confidence scores are systematically over- or under-confident for that group. In this scenario, the team needs to check if the model's risk scores are equally reliable for dark skin tones as for light skin tones, which is exactly what calibration assesses.

The GDPR's right to explanation is not explicitly named in the regulation but is widely referred to as such in the context of automated decision-making under Article 22. The other options are other data subject rights under GDPR but do not specifically address explanation of decisions.

The NIST AI RMF follows a sequence of functions: Govern, Map, Measure, and Manage. When a disparate impact is discovered, the first step is to Map the context, which involves understanding the specific use case, the AI system's operational design, and the potential sources of bias. Without this foundational understanding, any subsequent governance, measurement, or mitigation efforts would be misdirected or ineffective.

Option B is correct because data handling and privacy practices are a core component of AI governance, ensuring that the vendor's use of customer data complies with regulations like GDPR or CCPA and aligns with the company's own data protection policies. During a vendor AI assessment, evaluating how the vendor collects, stores, processes, and secures data is critical to mitigate risks of data breaches, unauthorized use, or non-compliance, which directly impacts trust and legal liability.

AI watermarking directly addresses the transparency obligation by embedding a detectable signal into AI-generated content, enabling clear disclosure that the content was produced or significantly modified by AI. This practice aligns with regulatory requirements for provenance and traceability, as watermarks can be verified by automated systems or human inspection to confirm AI origin.

The model learned from historical hiring data that already contained a gender imbalance, where most successful hires were male. This is a classic case of historical bias, where the training data reflects past societal or organizational biases, and the AI system perpetuates those biases in its predictions. The bias originates in the data, not in the model's algorithm or the sampling method.

Demographic parity requires equal selection rates across groups, and equalized odds ensures equal true positive and false positive rates, both relevant for medical triage.

Glass-box models like logistic regression or decision trees are inherently interpretable and can provide clear, auditable reasons for each prediction. Black-box models require post-hoc explainability methods, which may not be sufficient for regulatory scrutiny.

An AI ethics board is essential for a responsible AI governance framework because it provides human oversight, ethical review, and accountability for AI decisions. This board ensures that AI initiatives align with corporate values, legal requirements, and ethical principles, such as fairness, transparency, and non-discrimination. Without an ethics board, there is no formal mechanism to challenge biased models or approve high-risk AI use cases.

Option A is correct because model compression techniques like pruning and quantization directly reduce the computational requirements of training and inference. Pruning removes redundant weights, and quantization reduces the precision of weights (e.g., from 32-bit to 8-bit), which lowers the number of operations and memory bandwidth needed, thereby decreasing energy consumption and carbon emissions.

Differential privacy is the correct choice because it provides a formal mathematical guarantee that the output of a model does not reveal whether any individual's data was included in the training set. This is essential for HIPAA compliance as it prevents re-identification attacks even when an adversary has auxiliary information. Unlike anonymization or pseudonymization, differential privacy adds calibrated noise to the training process or query results, ensuring strong privacy protection while preserving model utility.

The EU AI Act requires risk management, data governance, transparency, human oversight, accuracy, and robustness for high-risk AI. However, it does not require publishing the full source code; only documentation and model cards may be required.

Model cards are standardized documentation sheets that describe a model's intended use, performance, limitations, and other details. SHAP and LIME are explainability tools. Data cards describe datasets.

The EU AI Act requires human oversight for high-risk AI systems to allow operators to override or stop the system's decisions when necessary. The other options are not mandated by the Act for high-risk systems.

Watermarking embeds a persistent digital identifier directly into the pixel data of an image, using techniques like spread-spectrum or discrete wavelet transform to survive common transformations such as JPEG compression and cropping. This makes it the correct technique for ensuring AI-generated content remains identifiable even after editing or distribution.

A SHAP force plot is specifically designed to visualize the contribution of each feature to a single prediction, showing how features push the prediction from the base value (average model output) to the final prediction. This makes it the ideal choice for explaining an individual prediction to a business stakeholder, as it provides a clear, localized explanation of feature impacts.

Demographic parity requires the probability of a positive prediction (loan approval) to be equal across groups. This directly addresses the concern of perpetuating historical denial rates. Equalised odds measures error rates, not positive prediction rates.

Transparency obligations under AI governance frameworks (e.g., EU AI Act) require clear disclosure when content is AI-generated. A visible or invisible watermark directly informs viewers that the video is synthetic, fulfilling this requirement without over-blocking legitimate content. Option B is correct because it provides a verifiable, non-disruptive method of labeling AI-generated media.

High-risk AI systems under the EU AI Act must implement human oversight mechanisms and maintain a technical documentation and risk management system. Transparency disclosure is required, but not necessarily to users in all cases (it depends on context). The other options are not mandatory for all high-risk systems.