CCNA AI Governance And Risk Questions

MCQhard

During an audit of Google Cloud Vertex AI, you discover that sensitive PII is being logged during model inference. You need to implement a control that enforces privacy at the model serving layer. Which configuration should you verify?

A.Vertex AI Model privacy and data masking controls

B.Vertex AI Model Monitoring for data drift

C.Vertex AI Feature Store access logs

D.Cloud IAM role binding for Vertex AI

AnswerA

These controls are specifically designed to scrub or mask sensitive data during the model serving process.

Why this answer

Vertex AI supports data masking and privacy controls during inference to ensure PII is not stored in logs, which is a key component of AI governance.

Practice this question →

MCQhard

You are auditing a model's 'Robustness' against adversarial attacks. Which test is most appropriate?

A.Checking if the server is plugged in

B.Performing adversarial perturbation testing

C.Checking the model's training accuracy

D.Asking the team to describe their favorite movies

AnswerB

This directly tests the model's resilience to inputs designed to deceive it.

Why this answer

Adversarial testing involves introducing perturbations to inputs to see if the model's output changes unexpectedly.

Practice this question →

Multi-Selecthard

Which THREE risks should be explicitly managed in an 'AI Governance' program?

Select 3 answers

A.Operational performance degradation

B.The choice of font for the final report

C.Data security and privacy vulnerabilities

D.Algorithmic bias

E.The color of the server room lights

AnswersA, C, D

Performance reliability is a risk to business operations.

Why this answer

Governance must manage bias, security, and performance risks.

Practice this question →

MCQmedium

A company's AI governance policy requires 'Model explainability'. Which tool or technique best satisfies this requirement for complex deep learning models?

A.Asking the model's developer to write a summary of their feelings about the model

B.Using SHAP (SHapley Additive exPlanations) to interpret model features

C.Printing the model's architecture as a JPEG file

D.Reducing the number of parameters in the model to one

AnswerB

SHAP provides model-agnostic feature importance, improving transparency.

Why this answer

SHAP (SHapley Additive exPlanations) or LIME are industry-standard techniques for explaining deep learning decisions.

Practice this question →

Multi-Selecthard

Which THREE components are critical for a robust 'AI Governance' framework?

Select 3 answers

A.Established AI ethics and compliance policies

B.Increasing the size of the marketing team

C.Defined roles and responsibilities for oversight

D.Regular monitoring and auditing of model performance

E.Choosing the most expensive cloud platform

AnswersA, C, D

Policies set the ground rules.

Why this answer

Effective governance requires policy, accountability, and continuous monitoring.

Practice this question →

MCQmedium

You are auditing a model's 'Data Pre-processing' step. Which practice is a major concern regarding data privacy?

A.Documenting the transformations applied to the data

B.Storing training data that can be re-identified without proper access controls

C.Compressing the data to save storage costs

D.Using open-source data transformation libraries

AnswerB

If data can be re-identified, it is a privacy risk that requires strict governance.

Why this answer

Re-identification of anonymized data is a significant risk that must be mitigated in data handling.

Practice this question →

MCQmedium

You are auditing an organization's AI deployment in Microsoft Azure. The Chief Risk Officer requires a central dashboard to monitor AI model performance drift and data quality metrics across all deployed services. Which tool should you confirm is configured to provide these insights?

A.Microsoft Purview AI Compliance Manager

B.Azure Policy for AI

C.Azure AI Content Safety

D.Azure Machine Learning Model Monitor

AnswerD

Model Monitor is the specific feature for tracking performance drift and data quality metrics.

Why this answer

Azure Machine Learning Model Monitor provides the specific functionality to track performance drift, data quality, and model health, which is essential for AI governance compliance.

Practice this question →

MCQmedium

An organization uses AWS SageMaker. As an auditor, you need to verify that model lineage and versioning are being captured to satisfy the AI risk assessment requirement for reproducibility. Which feature ensures that every model training job is recorded with its data sources?

A.SageMaker Lineage Tracking

B.AWS CloudTrail

C.SageMaker Clarify

D.SageMaker Model Registry

AnswerA

This feature allows auditors to trace the exact lineage of a model back to its training source.

Why this answer

SageMaker Lineage Tracking automatically captures the relationship between data, models, and training jobs to ensure full auditability.

Practice this question →

MCQmedium

During an audit, you find that the AI training data includes personally identifiable information (PII) that was not anonymized. Which regulation does this most likely violate?

A.GDPR (General Data Protection Regulation)

B.The Model Building Standards Act

C.The Sarbanes-Oxley Act

D.The Internal Server Maintenance Code

AnswerA

GDPR mandates strict control over the processing of personal data, including requirements for anonymization.

Why this answer

Handling PII without proper anonymization violates privacy regulations like GDPR or CCPA.

Practice this question →

Multi-Selecteasy

Which TWO of the following are core components of an AI incident response strategy?

Select 2 answers

A.Marketing campaigns for AI product launches

B.Defined communication protocols for internal and external stakeholders

C.Software license management for all developers

D.Procedures for rolling back or disabling the model

E.Automated email server maintenance

AnswersB, D

Clear communication is essential when an AI system fails.

Why this answer

Incident response requires both technical preparation and clear communication channels to handle potential AI failures.

Practice this question →

MCQmedium

When auditing an 'AI Model Lifecycle', which phase occurs immediately after the 'Model Training' phase?

A.Writing the initial requirements

B.Marketing the model to customers

C.Decommissioning

D.Model Validation

AnswerD

Validation confirms the model meets quality and safety standards before deployment.

Why this answer

After training, the model must be validated before it is deployed to production.

Practice this question →

Multi-Selectmedium

Which TWO of the following are typical 'Model Risk Management' (MRM) pillars?

Select 2 answers

A.Independent model validation

B.Ongoing monitoring of model performance

C.Designing office holiday parties

D.Negotiating salaries for the data scientists

E.Public relations management

AnswersA, B

Validation ensures models are fit for purpose.

Why this answer

MRM is structured around independent validation and continuous monitoring.

Practice this question →

Multi-Selecthard

Which TWO of the following are examples of 'Model Risk Management' (MRM) controls that must be validated during an audit?

Select 2 answers

A.Automated deployment pipeline triggers

B.Post-deployment performance and drift monitoring

C.Standardized IDE choice for developers

D.Increasing training dataset size by 50%

E.Independent model validation post-development

AnswersB, E

Ensures the model continues to perform as expected over time.

Why this answer

Model validation and ongoing performance monitoring are the standard controls used to manage model risk after deployment.

Practice this question →

MCQeasy

What is the goal of a 'Human-in-the-loop' (HITL) control in an AI system?

A.To provide human oversight for automated decisions to mitigate risk and error

B.To reduce the time spent on manual data entry

C.To replace all human employees with automated systems

D.To increase the speed of model training

AnswerA

The primary goal is risk mitigation by ensuring a human reviews AI-recommended actions.

Why this answer

HITL ensures that a human makes final decisions for high-stakes AI outputs, reducing the risk of automation error.

Practice this question →

Multi-Selectmedium

Which TWO of the following are primary components of an AI model risk management inventory?

Select 2 answers

A.Employee performance review scores

B.Training data provenance and lineage information

C.List of office furniture used by the team

D.Model purpose and business application description

E.Marketing budget for the model launch

AnswersB, D

Essential for data quality and bias assessment.

Why this answer

An inventory must track metadata and lifecycle status for accountability.

Practice this question →

MCQhard

In the context of 'AI Compliance', what is a 'Model Card'?

A.A physical access card for the data center

B.A credit card used for paying cloud compute bills

C.A document providing transparency regarding model features, limitations, and training data

D.A list of all users authorized to access the AI

AnswerC

Model cards are standard documentation for transparency and accountability in AI.

Why this answer

A model card provides transparency by documenting the model's intended use, limitations, and performance metrics.

Practice this question →

MCQhard

An organization is using 'Federated Learning' to maintain data privacy while training models. What is the primary audit risk associated with this architecture?

A.Increased training latency

B.Model inversion attacks targeting the central aggregator

C.Lack of access to training hardware

D.Centralized data breaches

AnswerB

The aggregation of gradients can be exploited to reconstruct private training data.

Why this answer

In Federated Learning, local model updates (gradients) can potentially reveal information about the underlying training data, necessitating 'Differential Privacy' as a control.

Practice this question →

MCQhard

During an AI risk assessment, you notice that the 'Model Risk Management' (MRM) framework does not mandate independent validation for models categorized as 'High Impact'. What is the most significant consequence?

A.Inability to detect model drift in production environments

B.Non-compliance with internal cybersecurity patching cycles

C.Operational silos between the AI team and the IT department

D.Increased probability of undetected systemic model bias or failure

AnswerD

Independent validation acts as a control to identify errors that the developer may have missed.

Why this answer

Independent validation is a core pillar of model risk governance, especially for high-impact systems.

Practice this question →

MCQhard

You are auditing a firm using LLMs (Large Language Models). Which risk is most specific to generative AI compared to traditional predictive models?

A.Database login credentials being shared

B.Server power consumption

C.Hallucinations and generation of misinformation

D.Missing documentation for the training code

AnswerC

Hallucination is a direct risk of the probabilistic nature of generative models.

Why this answer

Hallucination is a unique risk of generative models where they output plausible but factually incorrect information.

Practice this question →

MCQeasy

What is the purpose of an 'AI Policy' within an organization?

A.To provide a structured set of guidelines for the responsible development and use of AI

B.To list the office coffee machine settings

C.To define the company's dress code policy

D.To describe the history of computer hardware

AnswerA

Policies harmonize AI activities with organizational risk appetite and ethical values.

Why this answer

An AI policy sets the standard for responsible, secure, and compliant AI usage across the enterprise.

Practice this question →

MCQeasy

Which component of an AI policy is most important for establishing organizational accountability?

A.Describing the history of artificial intelligence research

B.Listing the hardware specifications of the training clusters

C.Providing the contact information for the company's PR department

D.Defining the roles and responsibilities of the AI Governance Committee and model owners

AnswerD

Clear ownership ensures that someone is responsible for the performance and risk management of the AI system.

Why this answer

Accountability requires clearly defined roles and responsibilities for AI system oversight.

Practice this question →

MCQeasy

What is the key difference between 'AI Ethics' and 'AI Compliance'?

A.There is no difference between the two

B.Ethics is only for AI, while compliance is for all departments

C.Compliance is only for technical roles, while ethics is for executives

D.Ethics focuses on societal values, while compliance focuses on legal and regulatory requirements

AnswerD

Compliance is rule-bound; ethics is value-bound.

Why this answer

Ethics concerns what *should* be done based on values, while compliance concerns what *must* be done based on rules.

Practice this question →

MCQeasy

A board of directors asks you to define the 'AI Risk Appetite'. Which approach best satisfies the governance requirement?

A.Creating a repository of all AI ethical guidelines published by NGOs

B.Providing the board with a list of all AI vendors used in the organization

C.Restricting all AI development to on-premises environments

D.Defining quantitative thresholds for acceptable model performance and ethical impact

AnswerD

Quantifiable metrics are the hallmark of effective, board-level risk appetite communication.

Why this answer

Risk appetite must align with the organization's business objectives and ethical standards.

Practice this question →

MCQmedium

During an audit of AI procurement, you find that the 'Vendor AI Assessment' questionnaire is missing. What is the correct next step?

A.Immediately halt the use of the vendor until a formal risk assessment is completed

B.None of the above

C.Update the office building safety guidelines

D.Ask the vendor for their marketing presentation

E.Ignore the missing document if the vendor is well-known

AnswerA

Using a vendor without a risk assessment leaves the firm vulnerable to unmanaged risks.

Why this answer

An auditor must ensure that third-party AI risks are evaluated using a formal, documented process.

Practice this question →

Multi-Selectmedium

Which THREE of the following are potential risks associated with AI model 'Drift' that an auditor must account for?

Select 3 answers

A.Bias against specific demographic groups that emerged post-deployment

B.Increased electricity consumption of servers

C.Regulatory non-compliance due to divergence from approved model behavior

D.Inability to access the source code of the model

E.Decreased model accuracy over time

AnswersA, C, E

Drift can cause a model to become unfair over time.

Why this answer

Drift impacts operational accuracy, fairness, and compliance, making it a critical governance risk.

Practice this question →

MCQeasy

As part of an AI audit, you are checking the 'AI Transparency' requirement. Which documentation artifact is essential to provide to external regulators to explain the model's design, intended use, and limitations?

A.Unit testing suite

B.API Swagger documentation

C.Infrastructure-as-Code (IaC) templates

D.Model Card

AnswerD

A Model Card provides the documentation required for transparency and accountability.

Why this answer

The Model Card is a standardized, transparent document that summarizes a model's characteristics, intended use, and limitations, as recommended by AI ethics standards.

Practice this question →

MCQmedium

You are assessing the risk of 'Data Poisoning' in a retail AI model. Which control should you implement during the data ingestion pipeline to mitigate this risk?

A.Input data validation and sanitization

B.Model version control

C.Increasing the GPU compute capacity

D.Enabling Multi-Factor Authentication (MFA) on the model registry

AnswerA

This prevents poisoned data samples from entering the model training pipeline.

Why this answer

Data validation and sanitization during the ingestion pipeline ensure that malicious or corrupted data samples are blocked before entering the training set.

Practice this question →

MCQeasy

When drafting an AI policy, you need to define the 'Human-in-the-Loop' (HITL) requirement. Which of the following represents a best-practice control for HITL?

A.Logging all model interactions for post-mortem analysis

B.Setting all model confidence thresholds to 100%

C.Manual review of high-risk model outputs prior to execution

D.Automated approval for all decisions

AnswerC

This ensures a human validates the model's output before it impacts the business.

Why this answer

A requirement for human intervention in high-risk decisions ensures oversight and accountability.

Practice this question →

MCQmedium

Which 'AI Risk Mitigation' strategy is most effective for reducing 'Data Leakage' in training sets?

A.Using more colorful charts in the report

B.Implementing strict data partitioning and feature selection protocols

C.Increasing the number of servers

D.Changing the office seating arrangement

AnswerB

Ensuring the training set does not contain information from the future or target reduces leakage.

Why this answer

Data leakage occurs when information from the target variable leaks into the training features; strict separation and testing prevent this.

Practice this question →

Multi-Selectmedium

Which TWO of the following are examples of AI governance 'Inputs'?

Select 2 answers

A.A photograph of the company founder

B.Internal AI Policy and guidelines

C.External regulatory frameworks (e.g., EU AI Act)

D.The company's social media password

E.The office printer manual

AnswersB, C

Internal policies shape the governance framework.

Why this answer

Inputs include regulatory requirements and internal policy documents.

Practice this question →

MCQeasy

What is the primary function of an 'AI Ethics Board'?

A.Managing the HR payroll systems

B.Fixing bugs in the server infrastructure

C.Reviewing AI projects for alignment with corporate values and societal norms

D.Writing the code for all production models

AnswerC

The ethics board acts as a moral compass to ensure the company's AI initiatives are responsible.

Why this answer

The ethics board ensures that AI projects align with corporate values and societal standards.

Practice this question →

Multi-Selectmedium

Which THREE of the following are core components of a robust AI Governance and Risk Assessment Framework?

Select 3 answers

A.Network bandwidth optimization plans

B.Standardized model risk assessment templates

C.Automated model training hyperparameter tuning

D.Defined AI risk appetite and threshold levels

E.Roles and responsibilities for model ownership and accountability

AnswersB, D, E

Required for consistent, reproducible risk evaluation.

Why this answer

These three options represent the strategic, operational, and accountability pillars of a comprehensive AI governance program.

Practice this question →

MCQeasy

What is the primary function of an 'AI Audit Log'?

A.To automatically order pizza for the team

B.To track and document all interactions and changes made to the AI system

C.To store the personal contact information of the IT staff

D.To provide entertainment for employees during breaks

AnswerB

An audit log provides a record for investigations and compliance verification.

Why this answer

An audit log records all actions performed by or on the AI system, ensuring accountability and traceability.

Practice this question →

MCQeasy

A board of directors requests a quarterly report on AI risk exposure. Which component of the NIST AI Risk Management Framework should you prioritize to demonstrate that the board's AI policy is being operationally enforced?

A.Measure

B.Manage

C.Map

D.Govern

AnswerD

The Govern function establishes the culture, policies, and oversight mechanisms necessary for AI risk management.

Why this answer

The 'Govern' function of the NIST AI RMF is the primary domain for board-level oversight and organizational policy enforcement.

Practice this question →

Multi-Selectmedium

Which TWO of the following are essential when performing an 'AI Risk Assessment'?

Select 2 answers

A.Listing the names of the team members' families

B.Assessing the likelihood and severity of identified risks

C.Identifying potential harms to stakeholders

D.Choosing the best coffee brand for the office

E.Selecting the color scheme for the model's dashboard

AnswersB, C

Risk quantification requires understanding likelihood and severity.

Why this answer

An assessment must identify both technical risks and potential impacts on stakeholders.

Practice this question →

MCQhard

You are auditing a 'Model Lifecycle' and find that the decommissioning process is not defined. What is the impact?

A.The office wifi will stop working

B.The company's stock price will drop immediately

C.Increased risk of using outdated or insecure models in production

D.The data scientists will leave the company

AnswerC

Leaving unused models active is a significant security and compliance vulnerability.

Why this answer

Without a decommissioning process, deprecated or risky models may remain in production, posing security and performance risks.

Practice this question →

MCQhard

Which AI risk is best mitigated by conducting a 'bias audit' on the training dataset?

A.Hardware overheating

B.System latency

C.Unfairness and discrimination in model outputs

D.Server cost overruns

AnswerC

Data bias is the primary cause of output unfairness; detecting it early is key.

Why this answer

Bias audits analyze datasets for underrepresented groups or historical prejudices that would lead to discriminatory outputs.

Practice this question →

Multi-Selecthard

Which THREE factors must be evaluated when assessing the 'Fairness' of an AI model?

Select 3 answers

A.The programming language used to build the model

B.Disparities in model error rates across protected groups

C.Historical bias present in the training datasets

D.Demographic parity metrics for the model's predictions

E.The number of CPU cores allocated for training

AnswersB, C, D

Differential error rates indicate bias.

Why this answer

Fairness assessment requires looking at demographic parity, historical bias, and error rate disparities.

Practice this question →

MCQhard

You are assessing 'Model Security'. Which attack vector specifically exploits the AI training phase?

A.Man-in-the-middle attack

B.Data poisoning

C.Denial-of-service attack

D.Phishing attack

AnswerB

This attack directly compromises the integrity of the training data during the development phase.

Why this answer

Data poisoning involves injecting malicious data into the training set to influence the model's behavior.

Practice this question →

MCQhard

You are auditing a 'Model Monitoring' dashboard. Which metric is most indicative of a potential degradation in the model's reliability over time?

A.Statistical drift between the production input data and training baseline

B.The physical location of the cloud server hosting the model

C.The number of lines of code in the model deployment script

D.The number of users accessing the model API

AnswerA

If production data drifts significantly from training data, the model's assumptions are no longer valid.

Why this answer

Data drift and concept drift are primary indicators that a model's performance may be degrading in a production environment.

Practice this question →

MCQhard

When auditing model fairness in a production environment using IBM Watson OpenScale, which metric would you specifically validate to ensure the model is not violating protected class regulations?

A.Precision-Recall AUC

B.Model Latency

C.Root Mean Square Error

D.Disparate Impact

AnswerD

Disparate Impact measures the difference in outcomes for protected versus non-protected groups.

Why this answer

Disparate Impact is the standard statistical metric used in OpenScale to identify bias against protected groups during inference.

Practice this question →

MCQmedium

An organization is scaling its AI governance program. You need to automate the identification of 'Shadow AI' in the corporate network. Which tool would be the most effective to gain visibility into unauthorized AI model API usage?

A.Azure AI Content Safety

B.Microsoft Defender for Cloud Apps

C.GitHub Copilot Business logs

D.Azure Policy

AnswerB

CASB functionality allows for the discovery and control of unauthorized AI services (Shadow AI).

Why this answer

Cloud Access Security Brokers (CASBs) like Microsoft Defender for Cloud Apps provide visibility into unsanctioned SaaS and API usage, including AI platforms.

Practice this question →

MCQmedium

During an audit of an AI system, you notice that 'Model validation' is performed by the same team that developed the model. Why is this a concern?

A.The team might be too friendly with each other

B.Lack of independence compromises the integrity of the validation process

C.The validation team might work too slowly

D.It is not a concern

E.The model will be too accurate

AnswerB

Conflict of interest prevents the team from objectively reviewing their own work.

Why this answer

Self-validation lacks the independence required to identify errors, bias, or lack of robustness effectively.

Practice this question →

MCQhard

Which action is required when a model is found to be 'Non-compliant' with the internal AI Governance policy?

A.Writing a blog post about the failure

B.Ignoring the finding if the model is profitable

C.Immediate remediation or removal from the production environment

D.Giving the model a new name

AnswerC

Risk management dictates that non-compliant systems must be controlled immediately.

Why this answer

Non-compliant models must be removed from production or restricted until remediated to prevent risk.

Practice this question →

MCQeasy

Which role is primarily responsible for ensuring that the AI governance framework is followed in daily operations?

A.The Model Manager or Product Owner

B.The company's external auditor

C.The office manager

D.The chief financial officer

AnswerA

They own the system and are responsible for its lifecycle and compliance.

Why this answer

The AI Product Owner or Model Manager is responsible for the operational compliance of their specific AI systems.

Practice this question →

MCQmedium

A firm uses a third-party AI service. Which control is most critical to ensure compliance with the firm's own AI governance policy?

A.Including AI-specific compliance requirements in the vendor service-level agreement (SLA)

B.Conducting weekly penetration tests on the vendor's office premises

C.Requesting the vendor's employee turnover rates for the last fiscal year

D.Requiring the vendor to submit copies of all their marketing brochures

AnswerA

Contractual obligations are the primary mechanism for enforcing internal standards on external partners.

Why this answer

Supply chain risk management requires mapping vendor controls to internal governance requirements.

Practice this question →

MCQhard

In a financial services firm, you are auditing the 'Explainability' of a credit scoring model. The model uses complex non-linear features. Which technique should you verify is being used to provide local explanations for individual credit decisions?

A.Feature Importance Permutation

B.SHAP values

C.Model pruning

D.Data normalization

AnswerB

SHAP provides specific, mathematically sound local explanations for individual model outputs.

Why this answer

SHAP (SHapley Additive exPlanations) is a widely accepted, model-agnostic technique for providing local explanations of individual predictions.

Practice this question →

MCQeasy

What is the main role of the 'AI Risk Assessment' document in a project lifecycle?

A.To provide a history of the company's annual profits

B.To record the names of all HR staff

C.To identify and evaluate potential risks before the model is deployed

D.To list the office parking spaces

AnswerC

Proactive identification of risk allows for mitigation before harmful deployment.

Why this answer

The risk assessment identifies potential hazards and guides the implementation of controls before the project proceeds.

Practice this question →

MCQmedium

A firm uses a 'Federated Learning' approach. Which governance benefit does this provide?

A.Reduced usage of electricity

B.Faster model training times

C.Improved model interpretability

D.Enhanced data privacy by keeping raw data locally on devices

AnswerD

Because raw data is not centralized, the privacy risk is significantly reduced.

Why this answer

Federated learning allows training on decentralized data, keeping raw data on local devices, which enhances privacy.

Practice this question →

MCQeasy

Which document is the primary source for establishing the scope of an AI audit?

A.A list of all employees who have taken an AI training course

B.The internal AI Policy and the organization's Risk Management Framework

C.The company's social media posting guidelines

D.The employee handbook for the engineering department

AnswerB

These documents define what is permitted, what is tracked, and how risks are managed.

Why this answer

The AI Policy and the AI Risk Management Framework (RMF) define the boundaries and expectations for the audit.

Practice this question →

Multi-Selectmedium

Which THREE of the following should be included in an AI Policy document to ensure compliance and ethical alignment?

Select 3 answers

A.Requirements for bias assessment and mitigation

B.Transparency and disclosure requirements for automated decisions

C.Instructions for renaming local variables

D.Specific hardware purchase limits

E.Requirements for data privacy and security protections

AnswersA, B, E

Essential for ethical AI alignment.

Why this answer

These items cover accountability, ethical guidelines, and legal compliance, which are central to AI policy.

Practice this question →

MCQmedium

A data scientist proposes using a 'black-box' model for a high-stakes loan approval process. Which action does your AI audit framework require?

A.Mandating the use of XAI (Explainable AI) tools to interpret model decisions

B.Requiring the data scientist to publish the code on an internal repository

C.Allowing the model if it achieves 99% accuracy on the test set

D.Asking the marketing team to verify the model's fairness

AnswerA

For high-stakes decisions, auditability and transparency require that decisions be explainable.

Why this answer

Explainability is a prerequisite for models that have significant impact on individuals, as per most AI governance frameworks.

Practice this question →

MCQmedium

You are reviewing a model risk management (MRM) framework for an AI system using NVIDIA NeMo Guardrails. What is the primary purpose of this tool in a risk mitigation strategy?

A.To automate model retraining

B.To improve model training speed

C.To enforce safety boundaries on LLM inputs and outputs

D.To encrypt training datasets

AnswerC

NeMo Guardrails provides a programmatic way to constrain model behavior to compliant, safe interactions.

Why this answer

NeMo Guardrails allows developers to define programmatic boundaries for LLM behavior, effectively serving as an automated control for AI governance.

Practice this question →

MCQmedium

You are reviewing the 'AI Incident Response Plan'. Which element is essential for compliance?

A.The history of the company's founding

B.Defined escalation paths for ethical or performance incidents

C.A log of all office supply purchases

D.A list of all cafeteria menus in the building

AnswerB

An AI incident requires a specific response team to handle potential ethical or safety impacts.

Why this answer

Incident response must include specific triggers for escalation and communication regarding AI failures.

Practice this question →

MCQhard

When auditing an AI system for regulatory compliance, you find that data lineage is broken between the feature store and the training pipeline. Which control is most likely deficient?

A.Access control lists for the model production environment

B.Encryption of data at rest in the data warehouse

C.Load balancing configuration for the inference API

D.Metadata logging and transformation documentation

AnswerD

Metadata is the key to maintaining lineage; without it, the link between features and training data is obscured.

Why this answer

Feature stores must maintain end-to-end traceability to ensure that data provenance is clear and auditable.

Practice this question →

MCQmedium

You are auditing a firm's AI policy and find that the 'Model Inventory' in the enterprise risk management platform lacks versioning metadata. Which specific control gap should be prioritized to align with NIST AI RMF?

A.Absence of automated model deployment pipelines

B.Failure to define the RPO for the primary database

C.Lack of immutable audit logs for model architecture changes

D.Insufficient budget for cloud storage of historical data

AnswerC

Without versioning metadata, the lineage of model iterations is lost, violating traceability requirements.

Why this answer

Traceability and version control are essential to establish accountability and reproducibility in AI risk management.

Practice this question →

MCQhard

Which technique is most appropriate for mitigating 'Concept Drift' in a production model?

A.Increasing the number of neurons in the hidden layers

B.Moving the model to a larger GPU cluster

C.Implementing an automated re-training pipeline based on performance threshold triggers

D.Restricting access to the training dataset

AnswerC

Automated re-training using recent, representative data corrects the drift in the model's concept.

Why this answer

Continuous re-training or fine-tuning based on recent data is the standard mitigation for concept drift.

Practice this question →

Multi-Selecthard

Which TWO of the following are legitimate 'AI Governance' concerns regarding third-party AI service providers (SaaS)?

Select 2 answers

A.The programming language used by the vendor

B.Data residency and compliance with local regulations

C.Third-party audit rights and transparency of the vendor's model development

D.Vendor's model update and retraining frequency

E.The physical location of the vendor's corporate office

AnswersB, C

Ensuring the provider processes data in compliant regions is a major risk.

Why this answer

Auditors must ensure that third-party AI tools comply with internal data handling standards and that the vendor's own governance is adequate.

Practice this question →

MCQeasy

An auditor is asked to review the AI model inventory. What information must be present in the inventory for every model to satisfy basic regulatory requirements?

A.Model owner, business purpose, and status

B.The complete list of all training algorithms used

C.The total number of GPUs used during training

D.All hyperparameter values

AnswerA

These are the fundamental requirements for maintaining an accurate and auditable AI inventory.

Why this answer

An inventory must track model ownership, purpose, and lifecycle stage to ensure accountability and oversight.

Practice this question →

MCQhard

You find that the 'Inference API' for a model allows 'Prompt Injection' attacks. Which governance failure is most likely?

A.Inadequate input validation controls and adversarial testing

B.Lack of a social media presence for the company

C.Using a low-cost cloud provider

D.Failure to update the company logo

AnswerA

Testing for and preventing adversarial inputs is a core requirement of secure AI development.

Why this answer

Prompt injection is a failure of input validation and security design within the model governance framework.

Practice this question →

Multi-Selecthard

Which THREE criteria are necessary for an AI system to be deemed 'Trustworthy' under most governance frameworks?

Select 3 answers

A.Reliability and consistent performance over time

B.Transparency of the decision-making process

C.The ability to generate high revenue for the firm

D.Robustness and security against adversarial attacks

E.The use of the latest marketing buzzwords

AnswersA, B, D

Consistent performance is a requirement for trust.

Why this answer

Trustworthiness is derived from transparency, reliability, and security.

Practice this question →

MCQeasy

What is the purpose of 'Model Versioning' in an AI audit context?

A.To automatically delete old models to save space

B.To allow for reproducibility and auditability of past model versions

C.To hide the model code from competitors

D.To reduce the number of files on the server

AnswerB

If a decision is challenged, you must be able to reproduce it using the exact model version used at that time.

Why this answer

Versioning ensures that the specific state of a model used for a specific decision can be retrieved and audited.

Practice this question →

MCQeasy

What is the primary objective of 'Board-level AI Governance'?

A.To ensure AI aligns with the organization's business strategy and risk appetite

B.To decide which programming language is used

C.To fix bugs in the model code

D.To organize the annual team lunch

AnswerA

The board's duty is strategic oversight and protecting shareholder value.

Why this answer

The board ensures that AI aligns with the firm's strategic risk appetite and legal obligations.

Practice this question →

MCQmedium

You are assessing a company's 'AI Governance Committee'. Which action best demonstrates effective board-level oversight?

A.Managing the day-to-day procurement of data labeling services

B.Reviewing individual code commits for AI model training

C.Selecting the machine learning framework used by data scientists

D.Approving the annual AI strategy and corresponding risk mitigation plans

AnswerD

The board's role is to ensure that AI risk is integrated into the overall enterprise risk strategy.

Why this answer

Board oversight must focus on strategic alignment and the establishment of high-level accountability frameworks.

Practice this question →

MCQmedium

Which artifact should an auditor request to verify 'Model Governance' during the model life cycle?

A.The personal notes of the lead developer

B.A photograph of the development team

C.Independent model validation reports

D.A list of office keys issued to employees

AnswerC

These reports prove that the model underwent required governance checks before production deployment.

Why this answer

Model validation reports provide evidence that the model was checked against performance and safety standards.

Practice this question →

MCQmedium

You are reviewing the AI Incident Response Plan. Which scenario constitutes a 'High' severity AI incident that requires immediate board notification under most enterprise risk frameworks?

A.A 200ms latency increase during inference

B.Systemic bias detected in a core automated lending model

C.A minor change in the training dataset size

D.A 2% drop in model prediction accuracy

AnswerB

Systemic bias in high-impact models poses critical regulatory and compliance risk.

Why this answer

An incident where a model makes a biased decision impacting a protected class carries significant regulatory and reputational risk, requiring board visibility.

Practice this question →