Courseiva

CCNA AI Risk Program Management Questions

75 of 87 questions · Page 1/2 · AI Risk Program Management · Answers revealed

Practice these questionsDomain overviewAll questions
1
MCQmedium

You are the AI risk lead at a mid-sized insurer. The Chief Risk Officer asks you to establish a formal AI risk taxonomy that will be used consistently across all business units for identifying, assessing, and reporting AI risks. Which action best ensures the taxonomy will be adopted and remain useful over time?

A.Delegate taxonomy design entirely to the data science team, since they understand AI models best and can define the risks most accurately.
B.Map the taxonomy to the enterprise risk management framework and existing risk register categories, then pilot it with two business units before enterprise rollout.
C.Draft the taxonomy with only legal and compliance input, then publish it as a mandatory standard to all business units to ensure regulatory alignment.
D.Adopt the risk categories directly from a leading industry publication without modification, since external benchmarks carry more credibility than internal design.
AnswerB

Aligning the new AI risk taxonomy to the existing ERM framework and risk register categories ensures that AI risks are not treated as a separate silo, enabling consistent aggregation and reporting. Piloting with two business units surfaces practical gaps and builds internal advocates before full rollout, increasing adoption and long-term usefulness.

Why this answer

A durable AI risk taxonomy must integrate with existing ERM structures so risks can be aggregated and compared across the enterprise. Piloting with a subset of business units validates the categories against real AI use cases and generates feedback before broad rollout. This combination of alignment and iterative validation is what drives sustained adoption and keeps the taxonomy relevant as AI use evolves.

Exam trap

The trap here is assuming that adopting an authoritative external taxonomy or delegating design to a single expert team guarantees quality, when adoption actually depends on integration with existing ERM structures and input from multiple stakeholders.

Practice this question →
2
MCQhard

A firm is using the NIST AI Risk Management Framework to document its AI risk program. Which approach best ensures that AI risk metrics are dynamic?

A.Conducting annual risk assessments
B.Setting static thresholds for model accuracy
C.Limiting AI deployment to offline systems
D.Integrating model performance metrics into operational dashboards
AnswerD

Feeding model performance metrics into operational dashboards keeps AI risk measurement continuous rather than point-in-time, satisfying the stem's demand for dynamic metrics. Live telemetry surfaces drift, degradation and emerging harms as they occur, enabling the Govern and Measure functions of the NIST AI Risk Management Framework to trigger timely response.

Why this answer

Integrating model performance metrics into operational dashboards ensures that AI risk metrics are dynamic, as they are continuously updated and monitored in real time. This allows for timely detection of drift, bias, or degradation. Annual assessments and static thresholds are not dynamic.

Exam trap

AAIR often tests the concept of dynamic risk metrics, and candidates may incorrectly choose periodic assessments or static thresholds, confusing thoroughness with dynamism.

How to eliminate wrong answers

Option A is wrong because annual risk assessments are periodic and static, not dynamic; they do not provide continuous monitoring. Option B is wrong because setting static thresholds for model accuracy is a fixed, non-adaptive approach that does not reflect changing conditions. Option C is wrong because limiting AI deployment to offline systems does not make risk metrics dynamic; it merely restricts deployment scope.

Practice this question →
3
Multi-Selectmedium

Which TWO documents are essential to include in the AI Risk Project 'Review Pack'?

Select 2 answers
A.A summary of the team's lunch schedule.
B.A detailed risk mitigation and action plan.
C.A list of all software installed on company laptops.
D.A copy of the company's lease agreement.
E.A comprehensive AI Risk Assessment report.
AnswersB, E

A detailed risk mitigation and action plan is essential because the Review Pack must evidence how identified AI risks will be treated, not merely list them. It satisfies the stem's requirement for documents supporting governance review, showing owners, controls and timelines that demonstrate active risk management to approvers.

Why this answer

Option B, a detailed risk mitigation and action plan, is essential because the Review Pack must show how identified AI risks will be treated, including specific controls, owners, timelines, and residual-risk decisions that reviewers can evaluate. Option E, a comprehensive AI Risk Assessment report, is essential because it provides the core evidence of risk identification, analysis, and evaluation, such as model purpose, data sources, affected stakeholders, likelihood/impact ratings, and inherent risk levels. Together, B and E give the Review Pack both the assessment basis and the remediation roadmap needed for governance sign-off.

The unmarked options do not belong: A (team lunch schedule) and D (company lease agreement) are unrelated administrative documents, and C (list of all software installed on company laptops) is an IT asset inventory that, while potentially useful elsewhere, is not one of the two essential AI risk review documents in this scenario.

Exam trap

AAIR often tests whether candidates can distinguish governance/risk artifacts from generic IT or administrative documents, so the trap is selecting plausible-sounding but irrelevant operational documents instead of the two core risk deliverables.

Practice this question →
4
Multi-Selectmedium

Which TWO factors should be included in an AI risk appetite statement?

Select 2 answers
A.The intended impact on company revenue
B.The specific programming language allowed
C.The preferred office software
D.Financial thresholds for model-related incidents
E.Maximum tolerable level of model bias
AnswersD, E

Quantified financial thresholds translate AI risk appetite into measurable tolerance for model-related incidents, such as maximum acceptable loss per event. This gives governance bodies an objective limit for escalation and remediation decisions rather than vague qualitative statements.

Why this answer

Option D is correct because a risk appetite statement must quantify how much financial loss from model-related incidents (e.g., fraud, erroneous decisions, remediation costs) the organization is willing to tolerate, expressed as concrete monetary thresholds or limits. Option E is correct because AI-specific risk appetite must define the maximum acceptable level of model bias (e.g., disparate impact ratios or fairness metric tolerances), since bias is a core AI risk affecting ethics, compliance, and legal exposure. Options A, B, and C are not appropriate: intended revenue impact is a business outcome rather than a risk tolerance limit, programming language is an implementation/technical standard, and preferred office software is an unrelated productivity choice — none of these express acceptable risk levels for AI systems.

Exam trap

AAIR often tests the confusion between business objectives (revenue impact) and risk tolerance metrics (financial thresholds, bias limits), leading candidates to select revenue as a risk appetite factor.

Practice this question →
5
MCQeasy

Which document is essential for defining the roles and responsibilities within an AI Risk Program?

A.AI Governance RACI Matrix.
B.Data Privacy Impact Assessment (DPIA).
C.Model Training Log.
D.AI Incident Response Plan.
AnswerA

The AI Governance RACI Matrix directly satisfies the stem's requirement to define roles and responsibilities, assigning Responsible, Accountable, Consulted and Informed parties across AI risk activities. Unlike broader policy or charter documents, it specifies who owns each task, making accountability explicit within the AI Risk Program.

Why this answer

The AI Governance RACI Matrix is the document that explicitly defines who is Responsible, Accountable, Consulted, and Informed for AI risk activities across the organization. It is the standard governance artifact for assigning roles and responsibilities, ensuring clear ownership and avoiding gaps or overlaps in the AI Risk Program.

Exam trap

AAIR often tests whether candidates can distinguish governance/roles documents from risk-assessment, technical-log, or incident-response artifacts, so the trap is selecting a document that mentions roles (like an IR Plan) instead of the one specifically designed to define program-wide responsibilities.

How to eliminate wrong answers

Option B is wrong because a Data Privacy Impact Assessment (DPIA) assesses privacy risks of a specific processing activity — it documents risk analysis, not role assignments. Option C is wrong because a Model Training Log records training runs, hyperparameters, and datasets — it is a technical reproducibility artifact, not a governance roles document. Option D is wrong because an AI Incident Response Plan defines how to detect, respond to, and recover from AI incidents; it assigns incident-specific roles but does not define the overall program's roles and responsibilities.

Practice this question →
6
MCQhard

When integrating AI risk into the broader ERM (Enterprise Risk Management) framework, which approach is most effective?

A.Only report AI risks if they result in a financial loss
B.Keep AI risks in a separate, isolated tracking system
C.Map AI risks to existing risk categories (e.g., operational, compliance)
D.Automate the removal of AI risks from the main risk register
AnswerC

Mapping AI risks onto established categories such as operational and compliance lets organisations reuse existing ERM governance, appetite statements, and reporting lines. This integrates AI into current processes rather than creating a parallel framework, satisfying the goal of embedding AI risk within broader enterprise risk management.

Why this answer

Mapping AI risks to existing risk categories such as operational, compliance, and strategic risks integrates AI into the broader ERM framework. This allows the organization to leverage established risk management processes, reporting lines, and mitigation strategies. It ensures AI risks are not siloed and receive appropriate visibility and resourcing.

Exam trap

The trap is thinking AI risks are so unique they must be managed separately, leading candidates to choose isolation over integration into ERM.

How to eliminate wrong answers

Option A is wrong because reporting AI risks only after financial loss is reactive and ignores non-financial impacts like reputational harm, regulatory penalties, and ethical violations. Option B is wrong because keeping AI risks in a separate, isolated system prevents holistic risk view and may lead to inconsistent treatment and duplication of efforts. Option D is wrong because automating removal of AI risks from the main risk register would eliminate oversight and is contrary to the goal of integration.

Practice this question →
7
MCQmedium

When documenting an AI Risk Program, what should be included in the 'AI Asset Register'?

A.The raw hardware serial numbers of the servers.
B.The model purpose, data lineage, stakeholders, and risk classification.
C.The exact lines of code in the model.
D.The home addresses of all developers.
AnswerB

The AI Asset Register inventories each AI system, so it must capture model purpose, data lineage, stakeholders, and risk classification. These attributes let the organisation track ownership, provenance, and risk tiering across its AI estate.

Why this answer

An AI Asset Register is an inventory of AI systems and models that captures governance-relevant metadata: the model's purpose, the data sources and lineage used to train it, the stakeholders accountable for it, and its risk classification. This information enables risk management, regulatory reporting, and lifecycle oversight across the AI portfolio.

Exam trap

AAIR often tests whether candidates distinguish governance-level metadata from low-level technical or personal details; the trap is selecting code or hardware specifics instead of purpose, lineage, stakeholders, and risk classification.

How to eliminate wrong answers

Option A is wrong because raw hardware serial numbers are infrastructure asset management details, not AI governance metadata; they do not describe the model's purpose, risk, or accountability. Option C is wrong because exact lines of code are implementation artifacts managed in version control, not appropriate for an asset register, which should remain at a governance level. Option D is wrong because developers' home addresses are personal data with no relevance to AI asset governance and would themselves create a privacy risk.

Practice this question →
8
MCQeasy

In the context of AI risk management, what does the 'Human-in-the-Loop' (HITL) concept primarily aim to achieve?

A.To reduce the cost of model development.
B.To maintain accountability and oversight for AI-driven decisions.
C.To increase the speed of model inference.
D.To automate the labeling of training data.
AnswerB

Human-in-the-Loop inserts human review at decision points, ensuring a person remains accountable for AI outputs rather than delegating responsibility to the model. This oversight mechanism satisfies governance requirements by enabling intervention before consequential actions are taken.

Why this answer

Human-in-the-Loop (HITL) primarily ensures that a human reviews, approves, or can override AI-driven decisions, preserving accountability and meaningful oversight. It addresses the governance need that a responsible person remains answerable for outcomes, especially in high-risk or regulated contexts. This maps directly to accountability principles in the NIST AI RMF and OECD AI Principles.

Exam trap

AAIR often tests whether candidates understand HITL as a governance/accountability control rather than a performance or cost optimization, so the trap is selecting efficiency-oriented answers that invert HITL's actual trade-off (it adds human effort to preserve oversight).

How to eliminate wrong answers

Option A is wrong because reducing model development cost is a financial/engineering outcome, not the purpose of HITL — HITL often increases cost by adding human review. Option C is wrong because increasing inference speed is a performance goal; HITL typically slows the pipeline because a human must intervene. Option D is wrong because automating training-data labeling is a data-annotation workflow (often called human-in-the-loop labeling, but that is a narrow ML-ops use case, not the risk-management purpose of accountability and oversight).

Practice this question →
9
Multi-Selectmedium

Which TWO stakeholders are most important to engage when establishing an AI risk appetite?

Select 2 answers
A.The building security personnel.
B.The Board of Directors or Executive Committee.
C.The office cleaning staff.
D.Legal and Compliance officers.
E.The company's social media followers.
AnswersB, D

The Board or Executive Committee owns organisational risk appetite and holds accountability for accepting residual AI risk. Their engagement satisfies the stem because appetite set without executive mandate lacks authority, budget and enforcement across business units.

Why this answer

The Board of Directors or Executive Committee (B) is essential because setting AI risk appetite is a governance responsibility — this body defines the organization's overall tolerance for risk, approves strategic direction, and holds ultimate accountability for AI-related decisions, so their engagement ensures the appetite aligns with corporate strategy and fiduciary duties. Legal and Compliance officers (D) are equally critical because they translate regulatory obligations (e.g., GDPR, EU AI Act, sector-specific rules), contractual duties, and ethical/legal constraints into concrete risk thresholds and controls, ensuring the stated appetite is lawful and enforceable. The building security personnel (A) focus on physical premises protection, not enterprise AI risk governance, so they are not key stakeholders here.

The office cleaning staff (C) have no role in defining strategic risk tolerance. The company's social media followers (E) are external parties whose opinions may inform reputation considerations but who hold no governance authority over risk appetite.

Exam trap

AAIR often tests the misconception that AI risk appetite is set by technical teams or external parties, when governance frameworks require Board-level ownership supported by Legal/Compliance, not facilities staff or social media audiences.

Practice this question →
10
MCQmedium

Which role is primarily responsible for ensuring that AI-generated content adheres to intellectual property risk policies?

A.Chief Legal Officer
B.System Administrator
C.Product Manager
D.Data Engineer
AnswerA

The Chief Legal Officer owns intellectual property risk policy, defining how AI-generated content must respect copyright, licensing and IP ownership. This role sets the compliance boundaries that AI governance and content teams then operationalise through controls and review.

Why this answer

The Chief Legal Officer is primarily responsible for ensuring that AI-generated content adheres to intellectual property risk policies, as they oversee legal compliance and IP strategy. This role ensures that AI outputs do not infringe on copyrights, trademarks, or other IP rights. Other roles lack the legal expertise and authority.

Exam trap

AAIR often tests the assignment of IP risk responsibility, and candidates may incorrectly choose technical roles like Data Engineer or Product Manager, overlooking the legal expertise required.

How to eliminate wrong answers

Option B is wrong because a System Administrator manages IT infrastructure and has no responsibility for IP policy compliance. Option C is wrong because a Product Manager focuses on product development and may not have the legal expertise to enforce IP policies. Option D is wrong because a Data Engineer builds data pipelines and is not accountable for legal IP risk.

Practice this question →
11
MCQmedium

An enterprise is establishing an AI Governance Committee. Which organizational structure best ensures that risk management is integrated into the AI development lifecycle?

A.Centralized control under the Chief Data Officer
B.External advisory board oversight
C.Cross-functional membership including Legal, Security, and Engineering
D.Automated AI risk assessment tools alone
AnswerC

Including Legal, Security, and Engineering gives the committee authority over compliance, threat, and build decisions simultaneously, embedding risk review into each development stage. This satisfies the stem's integration requirement, which a single-function or purely executive body cannot achieve.

Why this answer

A cross-functional AI Governance Committee including Legal, Security, and Engineering ensures that legal/regulatory, security/privacy, and technical feasibility perspectives are all represented in AI risk decisions. This integration embeds risk management into the development lifecycle because engineering is at the table alongside the functions that define constraints and obligations, enabling risks to be identified and mitigated during design rather than after deployment.

Exam trap

AAIR often tests whether candidates equate governance with either a single executive owner or a purely external/automated mechanism — the trap is missing that effective AI governance requires cross-functional, lifecycle-embedded membership.

How to eliminate wrong answers

Option A is wrong because centralized control under the Chief Data Officer concentrates authority in one function, which can silo risk management and exclude legal, security, and engineering perspectives needed for lifecycle integration. Option B is wrong because an external advisory board provides independent oversight but is not embedded in the development lifecycle — it lacks the day-to-day integration needed to influence design decisions. Option D is wrong because automated AI risk assessment tools alone cannot replace human governance; tools detect issues but do not establish accountability, policy, or cross-functional decision-making.

Practice this question →
12
MCQhard

An organization discovers that their AI model exhibits bias toward a specific demographic. What is the most important step in the Incident Response process?

A.Suspend the model's production use until the issue is investigated and remediated.
B.Retrain the model immediately.
C.Delete all training data related to the demographic.
D.Issue a public press release.
AnswerA

Suspending production use immediately halts further biased decisions and affected users while root cause is investigated, containing harm before remediation. This satisfies the incident response priority of containment, which precedes analysis and correction in the lifecycle.

Why this answer

When an AI model is found to exhibit harmful bias, the immediate priority in incident response is containment — suspending production use prevents ongoing discriminatory decisions, legal exposure, and harm to affected individuals while the root cause is investigated. This mirrors the 'containment before eradication' principle in standard IR frameworks (NIST SP 800-61). Retraining or deleting data without first stopping the model leaves the biased system live and compounding harm.

Exam trap

AAIR often tests the instinct to 'fix it fast' — candidates pick retraining or data deletion because those feel proactive, but IR doctrine requires containment and evidence preservation before remediation.

How to eliminate wrong answers

Option B is wrong because retraining immediately skips containment and root-cause analysis; without understanding why the bias arose (data, labels, features, or objective function), retraining may reproduce or worsen the bias. Option C is wrong because deleting training data destroys forensic evidence needed for the investigation and may itself violate data retention or legal hold obligations. Option D is wrong because a public press release is a communications action, not an incident response step, and issuing one before containment and facts are established can amplify reputational and legal damage.

Practice this question →
13
MCQhard

A retail bank's AI risk committee is defining how third-party foundation model providers should be governed across 40 planned use cases. Legal notes that several providers reserve the right to change model versions with limited notice, and business units want to avoid re-approval delays for every update. Which approach BEST balances risk oversight with delivery speed?

A.Delegate all provider oversight to procurement and rely on contractual terms as the primary risk control.
B.Tier use cases by risk and data sensitivity, define pre-approved model versions and change classes per tier, and require impact assessment plus escalation only when a change crosses defined thresholds.
C.Standardize on a single foundation model provider to reduce the number of version-change events the committee must review.
D.Require full AI risk committee re-approval for every provider model version change before any production use.
AnswerB

Risk-based tiering lets the bank pre-authorize low-risk use cases and minor change classes, such as non-behavioral performance updates, while reserving committee escalation for changes that cross thresholds like new modalities, altered data retention, or use in credit decisions. It directly addresses the vendor's limited-notice practice by defining in advance which changes are acceptable and which trigger reassessment, preserving both oversight and delivery speed.

Why this answer

The bank needs governance that is proportionate and fast. Tiering use cases by risk and data sensitivity, pre-approving specific model versions and classes of change, and escalating only when a change crosses defined thresholds gives the committee control over material risk while letting low-impact updates proceed. This answers the vendor's limited-notice practice with pre-defined acceptance criteria, rather than serial re-approval or reliance on contracts alone.

Exam trap

The trap here is treating every model version update as equally risky and demanding identical re-approval, or conversely treating contracts as sufficient oversight.

Practice this question →
14
Multi-Selecthard

A fintech company is preparing its annual AI risk report for the board. The Chief Risk Officer wants the report to demonstrate that the AI risk program is operating effectively, not merely listing AI use cases. Which two elements most directly provide evidence of an effective operating AI risk program? (Choose two.)

Select 2 answers
A.The total number of employees who have completed general security awareness training.
B.A summary of the AI risk team's organizational chart and reporting lines.
C.A list of AI vendor logos and product names used across the organization.
D.Documented remediation actions and closure rates for issues raised by AI risk assessments and incident reviews.
E.A current inventory of AI systems with assigned risk tiers, accountable owners, and last assessment dates.
AnswersD, E

Tracking remediation actions and their closure rates shows that identified risks lead to concrete corrective work and that the program follows through. Closure rates over time give the board a measurable indicator of program responsiveness and discipline, distinguishing an operating program from one that only produces assessment documents.

Why this answer

Evidence of an operating program comes from artifacts that change over time in response to activity. A live AI inventory with tiers, owners, and assessment dates proves continuous identification and accountability, while remediation tracking with closure rates proves that findings translate into corrective action. Together they show the program detects, assigns, and resolves AI risk, which is what the board needs to judge effectiveness.

Exam trap

The trap here is mistaking structural or activity-count artifacts, such as org charts and generic training completion, for evidence that the AI risk program is actually operating and producing outcomes.

Practice this question →
15
MCQeasy

What is 'Shadow AI'?

A.A marketing term for new AI tools
B.A feature in a programming language
C.AI used without formal approval or oversight
D.An AI model that only works in the dark
AnswerC

Shadow AI covers any AI tool, model or service deployed by staff outside sanctioned procurement and governance channels, so it escapes security review, data-handling controls and monitoring. The defining constraint is absence of formal approval or oversight, which is exactly what this option states.

Why this answer

'Shadow AI' refers to AI systems, tools, or models that are used within an organization without formal approval, oversight, or governance. This includes employees using public generative AI tools, deploying unvetted models, or integrating AI into workflows outside the sanctioned IT/security review process. It mirrors the concept of 'Shadow IT' but applied specifically to AI, and it represents a significant governance and compliance risk.

Exam trap

AAIR often tests... the confusion between 'Shadow AI' and legitimate emerging AI terminology, or candidates overthinking the term and selecting a technical-sounding but incorrect definition.

How to eliminate wrong answers

Option A is wrong because 'Shadow AI' is not a marketing term — it is a recognized governance and security risk category. Option B is wrong because it is not a programming language feature; it describes an organizational behavior, not a technical capability. Option D is wrong because it is a literal misinterpretation of the word 'shadow' — the term has nothing to do with lighting conditions or model operation in darkness.

Practice this question →
16
Multi-Selecthard

Which TWO aspects of 'Data Governance' are critical for AI risk management?

Select 2 answers
A.Data access control and security
B.The number of pens in the supply closet
C.The speed of the local internet
D.The interior design of the office
E.Data quality and consistency
AnswersA, E

Data access control and security govern who and what may read or modify training and inference data, directly constraining unauthorised exposure, poisoning and leakage. Enforcing identity-based permissions and encryption underpins every other AI risk control, making it a foundational governance requirement.

Why this answer

Data governance for AI risk management hinges on controlling who can access data and ensuring that data is trustworthy. Option A, data access control and security, is correct because AI systems depend on sensitive datasets, and governance must enforce authentication, authorization, encryption, and audit logging to prevent unauthorized access, data leakage, and tampering that could corrupt model behavior or violate privacy regulations. Option E, data quality and consistency, is correct because AI models learn directly from data; inaccurate, incomplete, duplicated, or inconsistent data leads to biased predictions, poor generalization, and unreliable outputs, so governance must define data standards, validation rules, and stewardship processes.

The remaining options are irrelevant to AI risk management: the number of pens in the supply closet (B), the speed of the local internet (C), and the interior design of the office (D) are office logistics or aesthetics and have no bearing on data governance or AI risk controls.

Exam trap

AAIR often tests whether candidates can distinguish genuine data governance dimensions (access, quality, lineage, retention) from irrelevant operational or facilities items — the trap is over-selecting plausible-sounding but non-governance options.

Practice this question →
17
MCQhard

In a cross-functional AI governance meeting, the Data Science team wants to deploy a new model, but the Legal team is concerned about data privacy. How should the AI Risk Manager resolve this?

A.Order the Data Science team to stop work immediately
B.Ask the CEO to decide
C.Conduct a joint risk assessment to identify potential mitigations
D.Ignore the Legal team's concerns
AnswerC

A joint risk assessment brings Data Science and Legal together to document the privacy concerns, evaluate likelihood and impact, and agree proportionate mitigations before deployment. This satisfies governance requirements for documented, cross-functional oversight rather than unilateral sign-off by either team.

Why this answer

The AI Risk Manager should facilitate a joint risk assessment that brings together Data Science and Legal to identify privacy risks and potential mitigations. This collaborative approach balances innovation with compliance, rather than unilaterally halting work or escalating to the CEO prematurely. It ensures both technical and legal perspectives inform the decision.

Exam trap

The trap is the false dichotomy between stopping work and ignoring concerns, which leads candidates to choose an extreme option instead of the collaborative risk assessment.

How to eliminate wrong answers

Option A is wrong because ordering an immediate stop to work is an extreme, unilateral action that ignores potential mitigations and may unnecessarily delay innovation. Option B is wrong because escalating to the CEO before attempting cross-functional resolution bypasses the AI Risk Manager's role and wastes executive time. Option D is wrong because ignoring Legal's concerns exposes the organization to regulatory and reputational harm and undermines the governance process.

Practice this question →
18
MCQhard

When defining KPIs for an AI Governance program, which metric is most predictive of long-term model robustness?

A.Number of users accessing the AI interface.
B.The frequency of model retraining triggered by performance drift alerts.
C.Total number of AI models currently in production.
D.The budget spent on GPU cloud computing resources.
AnswerB

Frequent drift-triggered retraining directly sustains robustness by refreshing the model against evolving data distributions, satisfying the long-term reliability constraint. Unlike static accuracy snapshots, this metric captures ongoing adaptation, revealing whether governance processes detect and correct degradation before it compounds.

Why this answer

The frequency of model retraining triggered by performance drift alerts is the most predictive metric of long-term robustness because it reflects the organization's ability to detect degradation and respond with corrective action. A governance program that tracks this metric demonstrates closed-loop monitoring and remediation, which sustains model performance over time as data distributions shift. This aligns with MLOps best practices for drift detection and continuous improvement.

Exam trap

AAIR often tests the confusion between vanity metrics (user counts, model counts, budget) and robustness indicators (drift-triggered retraining), so candidates must identify the metric that reflects closed-loop model health management.

How to eliminate wrong answers

Option A is wrong because the number of users accessing the AI interface measures adoption or popularity, not model robustness — a widely used model can still be fragile. Option C is wrong because the total number of models in production measures scale or portfolio size, not the health or robustness of any individual model. Option D is wrong because GPU cloud spend measures infrastructure cost, not model quality — high spend can indicate inefficiency rather than robustness.

Practice this question →
19
Multi-Selecthard

When considering the 'Risk of Bias' in an AI system, which THREE components should be audited?

Select 3 answers
A.The physical location of the cloud data center.
B.The post-processing decisions made on the model outputs.
C.The composition and representativeness of the training dataset.
D.The number of coffee breaks the data science team takes.
E.The objective function or loss function used for model training.
AnswersB, C, E

Post-processing decisions directly shape how model outputs translate into outcomes, so auditing them exposes bias introduced by thresholds, filtering or business rules applied after inference. This satisfies the stem's requirement to audit bias risk across the system, since mitigation at the output stage is a distinct component from data and model training.

Why this answer

Option B is correct because bias can be introduced or amplified after the model produces its raw outputs, so auditing post-processing decisions (such as thresholding, ranking, filtering, or business rules applied to scores) is essential to detect and mitigate discriminatory outcomes. Option C is correct because the composition and representativeness of the training dataset directly determine whether the model learns patterns that generalize fairly; auditing for sampling bias, label bias, and underrepresentation of protected groups is a core part of a Risk of Bias assessment. Option E is correct because the objective or loss function encodes what the model optimizes for, and a poorly chosen loss (for example, optimizing overall accuracy on imbalanced data) can systematically disadvantage certain groups, so it must be audited.

Option A is not correct because the physical location of a cloud data center relates to data residency, sovereignty, or latency concerns, not to bias in model behavior. Option D is not correct because team break schedules have no bearing on algorithmic bias and are irrelevant to a Risk of Bias audit.

Exam trap

AAIR often tests whether candidates recognize that bias can be introduced at multiple stages, and a common mistake is to focus only on training data while ignoring the objective function and post-processing steps.

Practice this question →
20
MCQmedium

When addressing 'Explainability' as an AI risk, which approach is most effective for a non-technical stakeholder?

A.Presenting the feature weights of a neural network.
B.Explaining the gradient descent optimization process.
C.Showing the mathematical formula used for loss reduction.
D.Providing counterfactual explanations like 'If your income had been $5k higher, the loan would have been approved'.
AnswerD

Counterfactual explanations state the minimal input change that would flip the outcome, expressing model behaviour in concrete, relatable terms without requiring mathematical or technical knowledge. This satisfies the need to make decisions intelligible to a non-technical stakeholder.

Why this answer

Counterfactual explanations are the most effective for non-technical stakeholders because they describe what would need to change in the input for a different outcome, using plain language and concrete scenarios. For example, 'If your income had been $5k higher, the loan would have been approved' is immediately understandable without any mathematical background. This approach aligns with GDPR Article 22 and the right to meaningful information about automated decisions.

Exam trap

AAIR often tests the difference between global and local explainability, and candidates frequently pick feature weights or SHAP values without considering the non-technical audience's need for actionable, plain-language reasoning.

How to eliminate wrong answers

Option A is wrong because feature weights of a neural network are abstract numerical values that non-technical stakeholders cannot interpret or act upon, and they do not convey decision rationale. Option B is wrong because gradient descent is an internal optimization algorithm, not an explanation of why a specific decision was made for a given individual. Option C is wrong because a loss reduction formula is a training-time mathematical construct that has no direct meaning for a stakeholder seeking to understand a single prediction.

Practice this question →
21
MCQhard

When drafting a vendor management policy for AI, what is the most important clause to include?

A.Requirement for vendor to provide coffee
B.Requirement to use a specific font
C.Vendor must provide free hardware
D.Right-to-audit the vendor's AI training practices
AnswerD

A right-to-audit clause lets the organisation inspect the vendor's AI training data, model provenance and practices, providing enforceable oversight of risks such as bias, data misuse and regulatory non-compliance that other contractual terms cannot verify.

Why this answer

The most important clause in an AI vendor management policy is the right-to-audit the vendor's AI training practices, as it ensures transparency and accountability for the vendor's data handling, model development, and compliance with ethical standards. This clause allows the organization to verify that the vendor's AI systems meet regulatory and contractual requirements. Without it, the organization has limited visibility into potential risks.

Exam trap

AAIR often tests the importance of substantive clauses like right-to-audit versus trivial or irrelevant options, to see if candidates understand AI governance priorities.

How to eliminate wrong answers

Option A is wrong because requiring the vendor to provide coffee is trivial and irrelevant to AI risk management. Option B is wrong because mandating a specific font is a branding or formatting concern, not a substantive policy clause. Option C is wrong because free hardware is a commercial term, not a risk management control.

Practice this question →
22
MCQhard

When assessing the risk of AI-generated content, which factor is the most important for calculating 'Impact'?

A.The potential for reputational and legal consequences
B.The speed at which the content is generated
C.The color of the font used for the output
D.The number of GPUs used to create the content
AnswerA

Impact quantifies the severity of harm should the risk materialise. For AI-generated content, reputational damage and legal exposure — defamation, copyright infringement, regulatory breach — represent the most consequential outcomes, so they drive the Impact rating.

Why this answer

Impact in risk assessment is defined as the magnitude of consequences if a risk materializes; for AI-generated content, the most significant consequences are reputational damage and legal liability (defamation, copyright infringement, regulatory penalties, discrimination claims). These are the factors that determine severity in a risk matrix, whereas generation speed, font color, and GPU count are technical or cosmetic attributes with no bearing on harm magnitude.

Exam trap

AAIR often tests whether candidates correctly identify impact as consequence severity (reputational, legal) rather than confusing it with technical performance metrics like speed or resource usage.

How to eliminate wrong answers

Option B is wrong because generation speed is a performance metric, not an impact dimension — faster output does not increase the harm caused by inaccurate or harmful content. Option C is wrong because font color is a purely cosmetic attribute with no risk relevance whatsoever. Option D is wrong because the number of GPUs is a compute resource metric that affects cost and throughput, not the severity of consequences from the content itself.

Practice this question →
23
MCQeasy

Which of the following is an example of an 'AI Risk Metric'?

A.Budget spent on office supplies
B.Rate of false negatives in model output
C.Employee headcount in AI department
D.Number of coffee machines in the breakroom
AnswerB

A risk metric quantifies potential harm from AI system behaviour, and false-negative rate directly measures missed detections that could cause harm. It is a measurable, ongoing indicator of model reliability, satisfying the stem's requirement for an AI risk metric rather than a performance or business metric.

Why this answer

A risk metric quantifies the potential for harm or error in an AI system. The rate of false negatives directly measures how often the model misses positive cases, which is a core performance and risk indicator—especially in safety-critical applications like medical diagnosis or fraud detection. This metric helps assess the model's reliability and the risk of costly or dangerous omissions.

Exam trap

The trap here is confusing general business or operational metrics with AI-specific risk metrics; candidates might pick headcount or budget because they seem related to AI initiatives, but the question specifically asks for a metric that measures AI risk.

How to eliminate wrong answers

Option A is wrong because budget spent on office supplies is a financial accounting metric unrelated to AI model performance or risk. Option C is wrong because employee headcount in an AI department is a resource or staffing metric, not a measure of AI system risk. Option D is wrong because the number of coffee machines is a facility or workplace amenity metric, completely irrelevant to AI risk assessment.

Practice this question →
24
MCQmedium

What is the primary responsibility of a 'Model Owner' in an AI risk framework?

A.Writing all the Python code for the model
B.Approving company-wide bonuses
C.Fixing broken office furniture
D.Maintaining the risk profile and performance of the model
AnswerD

Model Owners own the model's risk profile and ongoing performance, satisfying the accountability requirement that someone continuously monitors accuracy, drift and risk exposure. This differs from governance bodies, which set policy, and from users, who consume outputs. The role therefore covers lifecycle monitoring and risk reporting rather than framework design or deployment engineering.

Why this answer

The Model Owner is accountable for the model's risk profile and performance throughout its lifecycle, including ensuring it operates within approved risk tolerances, monitoring for drift or degradation, and maintaining documentation for governance and audit. This role bridges technical teams and governance bodies, ensuring the model continues to meet business, ethical, and regulatory requirements. It is an accountability role, not necessarily a hands-on coding role.

Exam trap

AAIR often tests role confusion — candidates may equate 'Model Owner' with 'Model Developer' and pick the coding answer, missing that ownership is about risk accountability and lifecycle oversight, not hands-on implementation.

How to eliminate wrong answers

Option A is wrong because writing Python code is the responsibility of data scientists or ML engineers, not the Model Owner, whose role is oversight and accountability rather than implementation. Option B is wrong because approving company-wide bonuses is a finance or executive function entirely unrelated to AI risk management. Option C is wrong because fixing office furniture is a facilities task with no connection to model governance or risk frameworks.

Practice this question →
25
MCQhard

A company is scaling its AI initiatives across five business units. What is the most effective way to ensure consistent risk measurement?

A.Using different platforms for each business unit
B.Implementing a centralized AI risk taxonomy
C.Allowing each business unit to define its own risk metrics
D.Focusing only on the highest-risk model
AnswerB

A centralised AI risk taxonomy gives all five business units shared definitions, scoring scales and thresholds, so risk measurements remain comparable across initiatives. This satisfies the stem's consistency constraint when scaling governance beyond a single unit.

Why this answer

A centralized AI risk taxonomy provides a common language, scoring scale, and category structure that all five business units can apply consistently, enabling comparable risk measurement across the enterprise. Without a shared taxonomy, each unit's risk ratings become incommensurable, defeating the purpose of enterprise-wide AI risk oversight. This aligns with AAIR guidance that risk measurement must be standardized before it can be aggregated or governed.

Exam trap

AAIR often tests the misconception that decentralization or per-unit customization improves risk management, when in fact consistent measurement requires a shared, centralized taxonomy.

How to eliminate wrong answers

Option A is wrong because using different platforms per business unit fragments data and prevents aggregation or cross-unit comparison of risk metrics. Option C is wrong because letting each unit define its own metrics produces inconsistent scales and definitions, making enterprise-level risk reporting meaningless. Option D is wrong because focusing only on the highest-risk model ignores the portfolio view and leaves systemic or cumulative risks unmeasured across the other models.

Practice this question →
26
MCQhard

You are analyzing the risk of a generative AI implementation. Which metric most effectively measures 'model transparency' for a risk dashboard?

A.The number of unique contributors to the codebase.
B.The average latency of model inference.
C.Percentage of models deployed with a completed Model Card covering data provenance, limitations, and intended use.
D.The number of parameters in the neural network.
AnswerC

Model Cards document data provenance, limitations and intended use, giving the dashboard a measurable transparency metric. Tracking the percentage of deployed models with completed cards directly quantifies governance coverage, satisfying the requirement to measure model transparency as a risk indicator.

Why this answer

Model transparency is best measured by the percentage of deployed models that have a completed Model Card documenting data provenance, limitations, and intended use. Model Cards (Mitchell et al., 2019) are the industry-standard artifact for transparency, and a coverage metric directly quantifies how transparent the model portfolio is. This gives risk dashboards an actionable, auditable indicator tied to governance requirements.

Exam trap

AAIR often tests whether candidates can separate transparency metrics from performance, scale, or activity metrics, so the trap is picking a technical-sounding metric (parameters, latency) that measures capability rather than documented transparency.

How to eliminate wrong answers

Option A is wrong because the number of code contributors measures development activity or collaboration, not transparency of the model's behavior, data, or limitations. Option B is wrong because inference latency is a performance/operational metric (SLO), not a transparency indicator. Option D is wrong because parameter count is a measure of model size/capacity, not transparency — a model with billions of parameters can still be a complete black box.

Practice this question →
27
Multi-Selecthard

When implementing an AI Risk Management program, which THREE components are necessary for effective monitoring?

Select 3 answers
A.A requirement that all staff undergo coding training.
B.A mechanism for logging and auditing model outputs.
C.A daily newsletter for employees about AI advancements.
D.A process for human intervention or override.
E.Automated real-time monitoring of model performance and drift.
AnswersB, D, E

Logging and auditing model outputs creates the traceable record that monitoring depends on, capturing inputs, decisions and timestamps for later review. This satisfies the need to detect drift, investigate incidents and evidence compliance through continuous oversight.

Why this answer

Option B is correct because effective AI risk monitoring requires a mechanism for logging and auditing model outputs, which provides traceability, supports incident investigation, and enables detection of anomalies or policy violations over time. Option D is correct because a process for human intervention or override ensures that when a model behaves unexpectedly or produces harmful outputs, a human can step in to halt, correct, or escalate the issue, which is a core control in AI risk frameworks. Option E is correct because automated real-time monitoring of model performance and drift detects degradation, data drift, and concept drift as they occur, allowing timely remediation before risks materialize.

Option A does not belong because requiring all staff to undergo coding training is not a monitoring control and is irrelevant to observing model behavior. Option C does not belong because a daily newsletter about AI advancements is informational only and does not provide any monitoring, logging, or intervention capability.

Exam trap

AAIR often tests the difference between monitoring components and general awareness activities, tricking candidates into selecting training or communication options that feel like best practices but do not actually monitor AI risk.

Practice this question →
28
Multi-Selecthard

The AI Risk Governance Committee is defining the risk appetite for a new generative AI chatbot. Which THREE factors must be considered to align with organizational risk tolerance?

Select 3 answers
A.The speed of the development team's sprint cycles
B.Data privacy and residency requirements for training sets
C.The likelihood of model drift impacting output accuracy
D.The impact of potential hallucination on brand reputation
E.The total cost of GPU infrastructure
AnswersB, C, D

Data privacy and residency requirements constrain which training data may lawfully be used and where it resides. For a generative chatbot, these legal and contractual limits directly shape acceptable risk exposure, so the committee must weigh them against organisational risk tolerance.

Why this answer

Option B is correct because data privacy and residency requirements directly shape risk appetite: regulations like GDPR, HIPAA, or data-localization laws determine what training data may be used and where it can be stored, which bounds the acceptable risk for the chatbot. Option C is correct because model drift is a core AI risk factor — as data distributions shift, output accuracy degrades, so the committee must weigh the likelihood of drift against the organization's tolerance for degraded performance. Option D is correct because hallucination is a generative-AI-specific risk whose potential impact on brand reputation and customer trust must be assessed against the organization's risk tolerance.

Option A is not a risk-appetite factor; sprint cadence is a delivery-process metric, not a measure of AI risk exposure. Option E is also not a risk-tolerance factor; GPU infrastructure cost is a budgeting concern, not a determinant of acceptable risk.

Exam trap

AAIR often tests the confusion between operational cost/velocity metrics (GPU cost, sprint speed) and genuine risk appetite dimensions (privacy, drift, hallucination impact).

Practice this question →
29
Multi-Selecthard

Which THREE factors should be considered when assessing the 'Risk Level' of an AI application?

Select 3 answers
A.The sensitivity of the input data.
B.The criticality of the decision-making process being automated.
C.The complexity of the neural network architecture.
D.The potential impact on human rights and individual safety.
E.The color scheme of the user interface.
AnswersA, B, D

Input data sensitivity directly determines risk, because personal, special-category, or confidential data raises the consequences of breach, misuse, or model leakage. Higher sensitivity demands stricter controls and pushes the application toward a higher risk level under data protection frameworks.

Why this answer

Option A is correct because the sensitivity of the input data directly determines the potential harm if that data is exposed or misused, so higher-sensitivity data (e.g., PII, health, biometric data) raises the assessed Risk Level. Option B is correct because the criticality of the automated decision-making process reflects how consequential errors or failures would be, and automating high-stakes decisions (e.g., credit, medical triage) elevates risk. Option D is correct because potential impact on human rights and individual safety is a core risk dimension in AI risk frameworks, capturing harms such as discrimination, loss of liberty, or physical injury.

Option C does not belong because neural network architectural complexity is an implementation detail that does not by itself determine risk level. Option E does not belong because user interface color scheme is a cosmetic design choice with no bearing on AI risk assessment.

Exam trap

AAIR often tests whether candidates confuse technical complexity with risk level, leading them to select architecture-related options that sound sophisticated but are irrelevant to risk assessment.

Practice this question →
30
Multi-Selectmedium

Which THREE roles should have oversight authority in the AI Risk Program?

Select 3 answers
A.The company's social media influencer
B.Chief Technology Officer
C.Chief Risk Officer
D.The office receptionist
E.Head of Business Unit (where AI is used)
AnswersB, C, E

The CTO owns technology strategy and architecture, so they hold oversight authority over the technical controls, tooling and infrastructure underpinning the AI Risk Program. Their remit covers how AI systems are built and operated, satisfying the requirement for technology-level governance accountability.

Why this answer

The Chief Technology Officer (B) is correct because the CTO owns the technology strategy and AI systems architecture, so they must ensure AI risk controls are technically feasible, implemented, and aligned with the organization's engineering standards. The Chief Risk Officer (C) is correct because the CRO leads enterprise risk management, owns the risk framework and reporting to the board, and must ensure AI risks are identified, assessed, and mitigated consistently with other enterprise risks. The Head of Business Unit where AI is used (E) is correct because that leader is accountable for the business outcomes, operational use, and day-to-day risk decisions of the AI system, and must own residual risk within their unit.

The company's social media influencer (A) and the office receptionist (D) do not belong because neither role has the governance mandate, decision rights, or accountability for AI risk oversight in the organization.

Exam trap

AAIR often tests the roles that constitute oversight, and candidates may include irrelevant roles like influencers or receptionists, or omit business unit leaders, misunderstanding the need for business accountability.

Practice this question →
31
MCQmedium

Your organization is implementing an AI Risk Register. Which approach provides the most effective cross-functional coordination for identifying bias in a new HR recruitment AI?

A.Perform a technical audit on the training dataset distribution.
B.Automate all bias detection using internal library scripts without human review.
C.Update the AI policy to forbid the use of demographic attributes in training data.
D.Conduct a mandatory tabletop exercise involving HR, legal, and data science teams to simulate potential discriminatory outcomes.
AnswerD

A tabletop exercise forces HR, legal and data science to jointly simulate discriminatory outcomes, satisfying the stem's cross-functional coordination requirement. Unlike siloed reviews, it surfaces bias through shared scenario analysis, aligning risk identification across the disciplines that own recruitment decisions.

Why this answer

A tabletop exercise brings together HR, legal, and data science teams to simulate discriminatory outcomes, which is the most effective cross-functional coordination method because it surfaces bias risks that no single discipline can identify alone. HR understands job role requirements and historical hiring patterns, legal understands anti-discrimination law and liability, and data science understands model mechanics and data distributions. This collaborative simulation aligns with NIST AI RMF and ISO/IEC 42001 expectations for stakeholder engagement in AI risk identification.

Exam trap

AAIR often tests the misconception that bias identification is purely a technical/data-science task, when the exam expects recognition that cross-functional coordination (HR, legal, data science) is required for effective risk identification.

How to eliminate wrong answers

Option A is wrong because a technical audit on dataset distribution is a single-discipline (data science) activity that misses legal, ethical, and business context — it is necessary but not sufficient for cross-functional coordination. Option B is wrong because automating bias detection without human review removes the cross-functional judgment needed to interpret context-dependent bias and violates human-oversight principles. Option C is wrong because updating policy to forbid demographic attributes is a governance action, not a coordination mechanism — it also fails because proxy variables (e.g., zip code) can reintroduce bias even when protected attributes are removed.

Practice this question →
32
Multi-Selecthard

Which THREE components are necessary for effective cross-functional AI risk coordination?

Select 3 answers
A.Clearly defined RACI matrix for AI initiatives
B.Weekly team lunches
C.Standardized AI risk taxonomy
D.A centralized AI risk register
E.Unrestricted access to all production servers for all staff
AnswersA, C, D

A clearly defined RACI matrix assigns who is responsible, accountable, consulted and informed for each AI initiative, removing ambiguity over ownership. This satisfies the coordination requirement by ensuring every risk decision has a named owner across functions.

Why this answer

A clearly defined RACI matrix for AI initiatives (A) is necessary because it assigns explicit Responsible, Accountable, Consulted, and Informed roles across functions, eliminating ambiguity about who owns each AI risk decision and escalation path. A standardized AI risk taxonomy (C) is required so that legal, security, data science, and business teams classify and compare risks using the same categories, severity scales, and terminology, enabling consistent cross-functional assessment. A centralized AI risk register (D) is essential as the single source of truth that aggregates identified risks, owners, mitigations, and status, giving all functions shared visibility and traceability.

Weekly team lunches (B) are a social nicety that may improve rapport but are not a structural mechanism for risk coordination, and unrestricted access to all production servers for all staff (E) violates least-privilege and actually increases risk rather than enabling effective coordination.

Exam trap

AAIR often tests whether candidates can distinguish governance structure (RACI, taxonomy, register) from cultural or operational gestures (lunches, open access) — the trap is selecting options that sound collaborative or 'agile' but provide no accountability or traceability.

Practice this question →
33
MCQhard

A company is utilizing a third-party LLM service. Which risk is specifically heightened by this arrangement?

A.Data leakage and privacy violations
B.Server downtime
C.Model training cost inflation
D.Lack of software updates
AnswerA

With a third-party LLM service, prompts and embedded data leave the organisation's trust boundary and are processed on external infrastructure, so confidential information may be retained, logged or reused. This external processing arrangement is precisely what heightens data leakage and privacy violations compared with a self-hosted model.

Why this answer

Using a third-party LLM service means prompts, context, and potentially sensitive data are transmitted to and processed by an external provider, heightening data leakage and privacy violation risk. The organization loses direct control over data handling, retention, and secondary use, and may face regulatory exposure under GDPR, HIPAA, or similar regimes. This is the risk specifically amplified by the third-party arrangement.

Exam trap

AAIR often tests the misconception that operational concerns like downtime or updates are the main third-party LLM risk, when the specifically heightened risk is data leakage and privacy exposure.

How to eliminate wrong answers

Option B is wrong because server downtime is a general availability risk that applies to any hosted service and is not specifically heightened by using a third-party LLM versus self-hosting. Option C is wrong because training cost inflation is largely the provider's concern under a service model; the customer pays inference/API costs, not training costs, so this is not the heightened risk. Option D is wrong because lack of software updates is the opposite concern—third-party providers typically push updates continuously, and the real risk is uncontrolled model changes, not absence of updates.

Practice this question →
34
MCQeasy

Why is 'Data Lineage' important in an AI risk management program?

A.It helps ensure data quality and integrity
B.It makes user interfaces more attractive
C.It improves server load times
D.It reduces the amount of storage needed
AnswerA

Data lineage records the origin, movement and transformation of each dataset through the pipeline. This traceability underpins data quality and integrity by exposing errors, unauthorised changes and gaps, letting risk teams verify that AI training and inference data remains accurate and trustworthy.

Why this answer

Data lineage documents the origin, movement, transformation, and usage of data throughout its lifecycle, which is foundational to AI risk management because it enables traceability of data quality issues, bias sources, and compliance violations back to their root. Without lineage, an organization cannot verify that training data was lawfully obtained, representative, or free of contamination — making it impossible to assess or remediate data-related AI risks.

Exam trap

AAIR often tests whether candidates confuse data lineage (provenance and traceability) with unrelated concerns like UI design, performance, or storage optimization.

How to eliminate wrong answers

Option B is wrong because data lineage has no relationship to user interface aesthetics — UI design is a front-end concern unrelated to data provenance tracking. Option C is wrong because server load times are determined by infrastructure, caching, and query optimization, not by lineage metadata; lineage tracking may actually add minor overhead rather than improve performance. Option D is wrong because lineage metadata increases storage requirements (it records provenance information), not reduces them — the benefit is governance and traceability, not storage efficiency.

Practice this question →
35
MCQmedium

You are defining KPIs for an AI project in a regulated industry. Which metric best captures model reliability over time?

A.Model drift (data drift/concept drift)
B.Frequency of model retraining
C.Number of training iterations
D.Total cost of compute resources
AnswerA

Model drift measures divergence between training and live data distributions (data drift) or between learned relationships and outcomes (concept drift). Tracking it over time detects silent degradation in predictive reliability, which accuracy snapshots alone miss — essential for sustained oversight in regulated settings.

Why this answer

Model drift — encompassing data drift and concept drift — directly measures whether a model's predictive behavior remains aligned with the real-world distribution it was trained on. It is the canonical reliability KPI because it captures degradation over time before it manifests as business harm. Retraining frequency, iteration counts, and compute cost are operational metrics, not reliability indicators.

Exam trap

AAIR often tests the difference between reliability metrics (drift, performance degradation) and operational metrics (retraining frequency, iterations, cost) — candidates pick retraining frequency because it sounds like a proxy for reliability, but it measures activity, not outcome.

How to eliminate wrong answers

Option B is wrong because retraining frequency is an operational cadence metric — a model can be retrained often and still drift, or rarely and remain stable. Option C is wrong because the number of training iterations is a hyperparameter/tuning detail with no direct relationship to production reliability. Option D is wrong because total compute cost is a financial efficiency metric, not a measure of whether the model still performs correctly.

Practice this question →
36
MCQmedium

What is the primary reason for maintaining an 'AI Model Inventory'?

A.To share model code with competitors
B.To make the database easier to back up
C.To identify and mitigate shadow AI risks
D.To increase the size of the IT department
AnswerC

An AI model inventory exposes every model in use, including unsanctioned ones deployed outside governance, directly satisfying the need to identify and mitigate shadow AI risks. By recording ownership, purpose and deployment status, it surfaces unapproved models that Microsoft Entra ID controls and monitoring would otherwise miss, enabling remediation.

Why this answer

The primary reason for maintaining an AI Model Inventory is to identify and mitigate shadow AI risks by providing a centralized record of all models in use. This visibility helps ensure compliance, track model lifecycle, and manage risks such as unauthorized deployments. It is not for sharing code or backing up databases.

Exam trap

The trap is choosing a trivial or self-serving option like easier backups or department growth, missing the core governance purpose of identifying shadow AI.

How to eliminate wrong answers

Option A is wrong because sharing model code with competitors is not a goal of an inventory and would be a security breach. Option B is wrong because making the database easier to back up is an operational side benefit at best, not the primary reason for an inventory. Option D is wrong because increasing the size of the IT department is unrelated to the purpose of an AI model inventory.

Practice this question →
37
Multi-Selecteasy

Which TWO items are considered 'AI Infrastructure' risks?

Select 2 answers
A.The color of the server room walls
B.The type of desk chair in the office
C.The number of windows in the office
D.Unauthorized access to the model environment
E.System uptime/availability
AnswersD, E

Unauthorised access to the model environment is an infrastructure risk because it targets the hosting, credentials and network perimeter rather than the model's logic. Compromise enables tampering, data exfiltration or denial of service, satisfying the stem's infrastructure category.

Why this answer

Option D (Unauthorized access to the model environment) is a correct AI Infrastructure risk because the model environment—training pipelines, inference endpoints, model registries, and the underlying compute/storage—must be protected by identity and access controls; a breach there can lead to model theft, data exfiltration, tampering with weights, or poisoned outputs, making it a core infrastructure security concern. Option E (System uptime/availability) is also a correct AI Infrastructure risk because AI workloads depend on continuous availability of GPUs/TPUs, orchestration (e.g., Kubernetes), and serving infrastructure; downtime directly degrades or halts training and inference, so availability is a fundamental infrastructure risk. The remaining options—A (wall color), B (desk chair type), and C (number of windows)—are workplace ergonomics or facilities aesthetics and have no bearing on AI infrastructure security, performance, or reliability, so they are not AI Infrastructure risks.

Exam trap

The trap here is that candidates may overthink 'infrastructure' as only physical hardware, missing that access control and availability are core infrastructure risks in AI systems.

Practice this question →
38
MCQmedium

Which metric is useful for measuring the 'Efficiency' of an AI risk program?

A.Number of emails sent
B.Total weight of the hardware
C.Number of meetings held
D.Time to complete a risk assessment for new models
AnswerD

Time to complete a risk assessment for new models directly quantifies process throughput, the core of efficiency. It measures how quickly the risk function handles each new model, exposing bottlenecks and manual effort, unlike coverage or accuracy metrics that gauge effectiveness rather than speed of delivery.

Why this answer

Time to complete a risk assessment for new models is a direct efficiency metric because it measures the throughput and speed of the risk program's core process — how quickly it can evaluate and onboard AI models. Efficiency metrics compare outputs to inputs (time, cost, effort), and assessment cycle time captures how productively the program converts review effort into completed assessments. Shorter cycle times with consistent quality indicate a more efficient program.

Exam trap

AAIR often tests the difference between activity metrics (emails, meetings) and true efficiency metrics (cycle time, cost per unit), luring candidates toward easily counted but meaningless activity measures.

How to eliminate wrong answers

Option A is wrong because the number of emails sent is an activity volume metric with no relationship to program efficiency or outcomes; more emails could indicate inefficiency or poor communication. Option B is wrong because total weight of hardware is an irrelevant physical measure that has no bearing on AI risk program performance. Option C is wrong because number of meetings held is an activity metric that measures effort expended, not efficiency — more meetings often signal inefficiency rather than productivity.

Practice this question →
39
MCQmedium

A hospital network deploys a clinical decision support model that recommends sepsis protocols. During a risk assessment, the AI risk manager identifies that clinicians frequently override the model's recommendations when they conflict with bedside judgment. Which risk treatment strategy is most appropriate for this situation?

A.Accept the risk because clinician overrides demonstrate that human oversight is functioning as designed.
B.Mitigate the risk by analyzing override patterns to determine whether they reflect model performance gaps, then recalibrate the model and refine alert thresholds.
C.Avoid the risk by disabling the model entirely and reverting to manual sepsis screening protocols.
D.Transfer the risk by purchasing additional medical malpractice insurance coverage for AI-assisted decisions.
AnswerB

Override data is a valuable feedback signal. Systematically analyzing when and why clinicians deviate from recommendations can reveal miscalibrated thresholds, subgroup performance gaps, or workflow mismatches. Recalibrating the model and tuning alert thresholds addresses the root cause while preserving clinician discretion, which is the appropriate mitigation for a decision support tool.

Why this answer

Frequent overrides are diagnostic evidence, not an end state. Investigating override patterns can distinguish legitimate clinical judgment from model miscalibration, subgroup bias, or alert fatigue. Recalibrating the model and refining thresholds addresses the root cause directly, improving alignment between recommendations and clinical practice while retaining the safety net of clinician discretion that the hospital already relies on.

Exam trap

The trap here is interpreting high override rates as proof that human oversight is working, when they may instead signal model miscalibration or alert fatigue that requires investigation and mitigation.

Practice this question →
40
Multi-Selecthard

Which TWO items are considered 'AI Model Artifacts' that should be kept for audit purposes?

Select 2 answers
A.The training dataset version
B.The lunch menu for the developers
C.Model hyperparameters and architecture configuration
D.The name of the company's favorite mascot
E.The local weather report from last week
AnswersA, C

Recording the training dataset version ties the model to the precise data it learned from, enabling auditors to trace bias, provenance and reproducibility. Without it, the model's behaviour cannot be reconstructed or defended during an audit review.

Why this answer

Option A, the training dataset version, is a correct AI model artifact for audit purposes because it documents the exact data lineage and inputs used to train the model, which is essential for reproducibility, bias investigation, and compliance reviews. Option C, model hyperparameters and architecture configuration, is also correct because these settings define how the model was built and trained, and auditors need them to reproduce, validate, or explain model behavior. The unmarked options do not belong: the lunch menu (B), company mascot name (D), and local weather report (E) are unrelated to model development, training, or governance and have no audit value for AI artifacts.

Exam trap

AAIR often tests the definition of model artifacts, and candidates may include irrelevant items like team preferences or environmental data, confusing them with technical artifacts.

Practice this question →
41
Multi-Selectmedium

When designing an AI Risk Committee, which TWO of the following roles are essential for ensuring a holistic view of risk?

Select 2 answers
A.Chief Legal Counsel.
B.Office Assistant.
C.Lead Data Scientist.
D.Social Media Manager.
E.Facilities Manager.
AnswersA, C

Chief Legal Counsel supplies legal and regulatory expertise on AI liability, privacy and compliance obligations, which no purely technical or business role covers. This ensures the committee's holistic risk view demanded by the stem, spanning legal exposure alongside operational and ethical concerns.

Why this answer

Option A, Chief Legal Counsel, is essential because this role supplies the legal and regulatory perspective on AI risk, covering compliance obligations, liability exposure, intellectual property, and data-protection statutes that a holistic risk view must incorporate. Option C, Lead Data Scientist, is essential because this role provides the technical perspective on model behavior, including data quality, bias, explainability, validation, and performance limitations that determine actual AI risk. Together these two roles balance legal/compliance governance with technical/algorithmic insight, which is exactly what a holistic AI Risk Committee requires.

The unmarked options do not belong: the Office Assistant, Social Media Manager, and Facilities Manager address administrative, marketing, and physical-building concerns respectively, none of which provide the legal or technical risk expertise needed for AI risk oversight.

Exam trap

The trap here is assuming that any leadership role can provide a holistic risk view, but the exam expects recognition that only roles with direct legal and technical AI expertise are essential.

Practice this question →
42
MCQhard

You are auditing an AI project. Which finding suggests a failure in AI risk management governance?

A.The model was trained on historical data.
B.No individual is designated as the accountable owner for the model's production outcomes.
C.The team uses a cloud-based GPU provider.
D.The model has a 2% prediction error rate.
AnswerB

Effective AI risk governance requires clearly assigned accountability for model outcomes. Having no designated owner for production results means no one is answerable for monitoring, escalation or remediation, which is a direct governance failure rather than a technical or data-quality issue.

Why this answer

The absence of a designated accountable owner for the model's production outcomes is a clear governance failure. AI risk management frameworks (NIST AI RMF, ISO/IEC 42001) require clear accountability structures so that someone is responsible for model performance, incident response, and compliance. Without an accountable owner, risks go unmanaged, issues go unreported, and remediation stalls.

Exam trap

AAIR often tests... the difference between technical performance issues (error rates, data sources) and governance failures (accountability, oversight), tempting candidates to pick a metric-based answer.

How to eliminate wrong answers

Option A is wrong because training on historical data is standard practice and not inherently a governance failure — the issue would only arise if the data were biased or used inappropriately. Option C is wrong because using a cloud-based GPU provider is a normal infrastructure choice, not a governance deficiency. Option D is wrong because a 2% prediction error rate is a performance metric that may be perfectly acceptable depending on the use case; it does not indicate a governance failure.

Practice this question →
43
Multi-Selecteasy

Which TWO tasks are part of the 'AI Risk Assessment' process?

Select 2 answers
A.Evaluating the likelihood and impact of identified risks
B.Choosing the font color for the dashboard
C.Writing marketing copy for the AI product
D.Identifying potential AI-related threats
E.Hiring new office staff
AnswersA, D

Evaluating likelihood and impact quantifies each identified threat, producing the risk score that drives prioritisation. This analytical step is core to AI risk assessment, satisfying the scenario's requirement for a task within that process rather than threat identification or control implementation.

Why this answer

Option A is correct because a core step of AI Risk Assessment is risk analysis, where each identified risk is evaluated for its likelihood (probability of occurrence) and impact (severity of consequences) so risks can be prioritized and mitigated. Option D is correct because AI Risk Assessment begins with risk identification, systematically uncovering potential AI-related threats such as bias, data poisoning, model drift, privacy leakage, and adversarial attacks. Together, identifying threats (D) and evaluating their likelihood and impact (A) form the analytical backbone of the risk assessment process.

The remaining options do not belong: B (choosing dashboard font color) is a UI/design decision, C (writing marketing copy) is a marketing activity, and E (hiring office staff) is an HR/administrative task, none of which involve identifying or analyzing AI risks.

Exam trap

AAIR often tests the confusion between core risk assessment steps (identification, evaluation) and unrelated tasks like marketing or HR, to ensure candidates understand the scope of risk assessment.

Practice this question →
44
MCQmedium

Which document is the most appropriate starting point for an AI Risk assessment for a new machine learning project?

A.The marketing slide deck for the AI feature.
B.The technical API documentation.
C.An AI Risk Assessment Protocol/Template.
D.The project budget spreadsheet.
AnswerC

An AI Risk Assessment Protocol or template provides the structured methodology, scoring criteria, and documentation fields needed to begin assessing the machine learning project consistently. It establishes the repeatable process before any project-specific analysis is performed.

Why this answer

An AI Risk Assessment Protocol/Template provides a standardized framework for identifying, evaluating, and mitigating risks specific to AI systems, such as bias, privacy, and model drift. It ensures the assessment is systematic, repeatable, and aligned with governance requirements. Starting with a template guarantees that all critical risk dimensions are considered from the outset, rather than ad-hoc or incomplete analysis.

Exam trap

AAIR often tests the misconception that technical documentation or business materials suffice for risk assessment, but the exam expects recognition that a structured protocol/template is the formal starting point.

How to eliminate wrong answers

Option A is wrong because a marketing slide deck focuses on promotional messaging and benefits, not on risk identification or mitigation; it lacks the structured criteria needed for a formal assessment. Option B is wrong because technical API documentation describes how to integrate and use the system, not how to evaluate its risks; it may inform risk analysis but is not a starting point for the assessment process itself. Option D is wrong because a budget spreadsheet addresses financial planning, not AI-specific risks like ethical, regulatory, or performance concerns; it is irrelevant to the risk assessment framework.

Practice this question →
45
MCQmedium

Which action should be taken if a model's performance consistently falls outside the 'Risk Appetite' threshold?

A.Only inform the IT team
B.Take the model offline for remediation
C.Ignore the result as it is just a statistical outlier
D.Increase the threshold to match current performance
AnswerB

Removing the model from production service halts the harmful outputs that breach the Risk Appetite threshold, satisfying the requirement to stop ongoing risk exposure. Remediation then addresses the underlying drift or data issue before redeployment, rather than merely alerting or adjusting the threshold.

Why this answer

When a model's performance consistently falls outside the defined Risk Appetite threshold, the organization has exceeded its tolerance for risk, so the model should be taken offline for remediation to prevent potential harm or compliance violations. This action aligns with governance principles that require corrective action when risk limits are breached. Simply ignoring or adjusting the threshold would undermine the risk management framework.

Exam trap

AAIR often tests the misconception that risk appetite thresholds can be adjusted to match performance, confusing risk tolerance with risk acceptance.

How to eliminate wrong answers

Option A is wrong because merely informing the IT team does not address the risk or stop the model from causing harm; it lacks a remediation step. Option C is wrong because consistently falling outside the threshold is not a statistical outlier but a systemic issue requiring action. Option D is wrong because increasing the threshold to match performance is a form of risk acceptance without proper justification and violates the purpose of having a risk appetite.

Practice this question →
46
MCQeasy

Which activity is a foundational requirement for building a sustainable AI risk program?

A.Creating an enterprise AI inventory
B.Signing contracts with AI vendors
C.Automating all model retraining cycles
D.Purchasing third-party AI auditing tools
AnswerA

An enterprise AI inventory catalogues every deployed model, dataset, and owner, giving the visibility needed to assess, prioritise, and monitor risk continuously. Without this baseline, governance controls, impact assessments, and mitigation tracking cannot be scoped or sustained across the organisation.

Why this answer

A sustainable AI risk program requires knowing what AI exists across the enterprise — an AI inventory is the foundational artifact that every other activity (policy, monitoring, audit, vendor review) depends on. Without it, risk assessments are incomplete and controls cannot be scoped. This is why inventory creation is consistently the first and most cited foundational requirement.

Exam trap

AAIR often tests the 'shiny object' trap — candidates gravitate toward tools, contracts, or automation over the unglamorous foundational artifact (the inventory) that everything else is built on.

How to eliminate wrong answers

Option B is wrong because vendor contracts are a procurement/legal activity that only covers externally sourced AI and says nothing about internally built models or shadow AI — it's a component, not the foundation. Option C is wrong because automating retraining cycles is an MLOps operational practice that assumes you already know which models exist and their risk profiles; automating retraining without governance can actually amplify risk. Option D is wrong because third-party auditing tools are enablers that require an inventory and defined risk criteria to be deployed effectively — buying tools before knowing your AI estate is premature.

Practice this question →
47
MCQeasy

When drafting an AI risk policy, which element must be defined to provide clear guidance on acceptable AI outcomes?

A.AI model training data source list
B.Vendor procurement list
C.Technical architecture diagram
D.Risk appetite statement
AnswerD

A risk appetite statement defines the amount and type of AI risk the organisation is willing to accept, giving decision-makers explicit boundaries for judging whether outcomes are acceptable. It directly satisfies the requirement for clear guidance on acceptable AI outcomes within the policy.

Why this answer

A risk appetite statement defines the level and types of risk an organization is willing to accept in pursuit of its objectives, providing clear guidance on acceptable AI outcomes. It translates abstract risk tolerance into concrete boundaries that AI teams can apply when designing, deploying, and operating models. Without it, decision-makers lack a consistent benchmark for what constitutes acceptable versus unacceptable AI risk.

Exam trap

AAIR often tests... the difference between governance documents that define acceptable boundaries (risk appetite) and technical or operational artifacts (data lists, architecture diagrams), tempting candidates toward concrete-sounding but incorrect options.

How to eliminate wrong answers

Option A is wrong because a training data source list is a documentation artifact, not a statement of acceptable outcomes. Option B is wrong because a vendor procurement list is an operational record and does not define risk tolerance. Option C is wrong because a technical architecture diagram describes system design, not the organization's risk appetite or acceptable outcome boundaries.

Practice this question →
48
MCQmedium

An enterprise is establishing its AI Governance Committee. Which stakeholder is most critical to include to ensure alignment between AI technical capabilities and the organization's enterprise risk appetite?

A.Head of Legal
B.Chief Information Security Officer
C.Chief Risk Officer
D.Lead Data Scientist
AnswerC

The Chief Risk Officer owns the enterprise risk appetite and translates it into tolerances. Including them ensures AI initiatives are governed against that appetite, aligning technical capability with organisational risk limits rather than leaving risk oversight to engineering alone.

Why this answer

The Chief Risk Officer (CRO) owns the enterprise risk appetite and framework, so including the CRO ensures AI risks are calibrated to the organization's overall risk tolerance rather than treated as a standalone technical concern. The CRO can translate AI-specific risks (bias, model drift, regulatory exposure) into the enterprise risk taxonomy and ensure governance decisions align with board-approved risk limits. This alignment is the committee's core purpose, making the CRO the most critical stakeholder.

Exam trap

AAIR often tests the distinction between functional risk owners (CISO for security, Legal for compliance) and the enterprise risk owner (CRO), tricking candidates into selecting the most visible technical or legal role instead of the one accountable for risk appetite.

How to eliminate wrong answers

Option A is wrong because the Head of Legal focuses on legal compliance and contractual exposure, which is necessary but narrower than enterprise risk appetite alignment. Option B is wrong because the CISO addresses security risk (confidentiality, integrity, availability) but does not own the broader enterprise risk appetite that encompasses strategic, operational, financial, and reputational risk. Option D is wrong because the Lead Data Scientist provides technical model expertise but is not accountable for enterprise risk tolerance and may have a bias toward enabling AI use cases.

Practice this question →
49
MCQeasy

Which phase of the AI lifecycle is most critical for initial risk mitigation?

A.Deployment.
B.Decommissioning.
C.Model Monitoring.
D.Design and Problem Formulation.
AnswerD

Design and problem formulation defines intended use, affected stakeholders, and constraints before any data or model exists. Embedding risk controls here prevents harm that later phases can only mitigate. This satisfies the stem's requirement for initial risk mitigation, since downstream phases inherit these foundational decisions.

Why this answer

The Design and Problem Formulation phase is most critical for initial risk mitigation because this is where the problem is scoped, objectives are defined, and potential risks are identified before any model is built. Decisions made here — such as choosing the use case, defining success metrics, identifying affected stakeholders, and assessing ethical/legal constraints — determine the risk profile of the entire project. Once a model is trained and deployed, many risks are already baked in and far more costly to remediate.

Exam trap

AAIR often tests... the tendency to associate 'risk mitigation' with monitoring or deployment controls, when the exam expects candidates to recognize that upstream design decisions carry the most leverage.

How to eliminate wrong answers

Option A is wrong because deployment is too late — by then the model architecture, training data, and objectives are fixed, and mitigation is limited to guardrails rather than fundamental risk reduction. Option B is wrong because decommissioning is the end-of-life phase and has minimal impact on initial risk mitigation. Option C is wrong because model monitoring is an ongoing operational control that detects drift and issues after deployment, not a phase for initial risk mitigation.

Practice this question →
50
MCQeasy

An organization is integrating AI risk into its enterprise risk management (ERM) framework. What is the first step in this integration process?

A.Assign a Chief AI Officer.
B.Identify and classify all AI applications by criticality and risk level.
C.Install automated model monitoring tools.
D.Create an AI acceptable use policy.
AnswerB

Integrating AI risk into ERM must begin with an inventory: identifying and classifying every AI application by criticality and risk level. Without this baseline, subsequent assessment, treatment and monitoring cannot be scoped or prioritised, so it is the foundational first step.

Why this answer

Integrating AI risk into ERM begins with discovery and classification — you cannot govern, monitor, or write policy for AI applications you haven't identified. Identifying and classifying all AI applications by criticality and risk level establishes the risk register baseline that every subsequent control (monitoring, policy, ownership) depends on. This mirrors the standard ERM sequence: identify, assess, treat, monitor.

Exam trap

AAIR often tests the sequencing trap — candidates pick a visible, concrete action (hiring a Chief AI Officer, buying monitoring tools) over the unglamorous but logically first step of inventory and classification.

How to eliminate wrong answers

Option A is wrong because assigning a Chief AI Officer is an organizational/governance decision that presupposes you already know what AI exists and how risky it is — it's a downstream accountability step, not the first step. Option C is wrong because installing automated model monitoring tools is a technical control that requires an inventory of models and defined risk thresholds to configure meaningfully. Option D is wrong because an acceptable use policy is a governance artifact that must be scoped to the AI applications and risk tiers already identified — writing policy before inventory produces generic, unenforceable rules.

Practice this question →
51
MCQmedium

You are the AI risk lead at a health insurer. A vendor-supplied claims-triage model that scores prior-authorization requests is scheduled to go live in 30 days. Internal audit asks how the organization will detect silent performance drift once the model is operating, given that the vendor will not expose training data or model weights. Which control is MOST appropriate to establish before go-live?

A.Obtain a SOC 2 Type II report from the vendor and rely on it as evidence that model behavior remains stable.
B.Implement ongoing monitoring of input feature distributions and output score distributions against validated baselines, with alert thresholds and periodic outcomes reconciliation.
C.Require the vendor to retrain the model monthly on the insurer's own claims data.
D.Add a human reviewer to approve every model score before the prior-authorization decision is issued.
AnswerB

When model internals are unavailable, behavioral monitoring is the workable control. Tracking input feature drift and output score distributions against the baselines captured during validation provides an early signal of degradation, while periodic reconciliation against actual prior-authorization outcomes confirms whether scores still correspond to real-world results. This satisfies the audit request without requiring weights or training data from the vendor.

Why this answer

Because the vendor withholds training data and model weights, the insurer cannot rely on internal inspection or retraining. The practical control is behavioral: capture validation baselines for input features and output scores, monitor live distributions against those baselines with defined alert thresholds, and periodically reconcile scores against actual prior-authorization outcomes. This detects degradation early and produces auditable evidence, while the other choices address security assurance, manual decision review, or model development rather than drift detection.

Exam trap

The trap here is assuming that a vendor security attestation or added human review substitutes for statistical monitoring of model behavior.

Practice this question →
52
MCQhard

A project lead argues that AI model performance metrics alone are sufficient for risk management. Why is this incorrect?

A.They change too quickly to report
B.They are too difficult to calculate for small models
C.They are too subjective
D.They do not capture social and compliance risk dimensions
AnswerD

Performance metrics such as accuracy or latency quantify only technical behaviour. They cannot capture social harm, fairness, privacy or regulatory compliance obligations, so relying on them alone leaves those risk dimensions unmanaged. Risk management therefore requires broader assessment beyond model metrics.

Why this answer

Model performance metrics (accuracy, precision, recall, latency) measure technical behavior but say nothing about whether the model complies with regulations, treats protected groups fairly, respects privacy, or aligns with organizational values. Risk management must span social, ethical, legal, and compliance dimensions that performance metrics cannot capture. Relying on performance alone leaves material risk unmanaged.

Exam trap

AAIR often tests the scope trap — candidates see 'performance metrics' and assume they cover risk, missing that risk management requires social, compliance, and ethical dimensions that performance data cannot address.

How to eliminate wrong answers

Option A is wrong because the issue isn't reporting velocity — performance metrics can be reported frequently; the problem is their scope, not their speed. Option B is wrong because calculating performance metrics for small models is generally easier, not harder, and difficulty of calculation isn't the reason they're insufficient. Option C is wrong because accuracy, latency, and error rates are objective and quantitative, not subjective — subjectivity is not the deficiency being described.

Practice this question →
53
Multi-Selecthard

Which THREE actions should be taken when integrating AI risk into the broader ERM (Enterprise Risk Management) framework?

Select 3 answers
A.Outsource all AI risk management to a third-party consultant.
B.Establish aligned risk scoring criteria across all business functions.
C.Prohibit all AI initiatives that carry any inherent risk.
D.Define a common risk taxonomy that includes AI-specific concepts like bias and drift.
E.Ensure that AI risk owners report into the same governance channels as other risk owners.
AnswersB, D, E

Aligning scoring criteria lets AI risks be rated on the same likelihood and impact scales as other enterprise risks, so they aggregate into existing heat maps and reporting rather than sitting in a separate silo. This directly satisfies the stem's requirement to integrate AI risk into the broader ERM framework.

Why this answer

Option B is correct because integrating AI risk into ERM requires a consistent, enterprise-wide risk scoring methodology so AI risks can be compared, aggregated, and prioritized alongside operational, financial, and compliance risks in the same register. Option D is correct because a shared risk taxonomy must be extended to capture AI-specific concepts such as model bias, data drift, hallucination, and model opacity; without common definitions, AI risks cannot be consistently identified, classified, or reported across functions. Option E is correct because AI risk owners must sit within the same governance and escalation channels (e.g., the same risk committee and reporting lines) as other risk owners, ensuring AI risk is not siloed and receives the same oversight, accountability, and board visibility as traditional risks.

Option A does not belong because outsourcing all AI risk management removes internal ownership and accountability, which contradicts ERM principles of retained responsibility and integrated oversight. Option C does not belong because prohibiting every AI initiative with any inherent risk is an avoid-or-eliminate approach rather than risk-based management, and it would block innovation instead of treating, transferring, or accepting AI risk within defined tolerances.

Exam trap

AAIR often tests the balance between risk management and risk avoidance, and candidates may incorrectly select extreme options like outsourcing or prohibiting AI, which contradict ERM principles of integrated, owned risk management.

Practice this question →
54
MCQmedium

You are establishing an AI risk appetite framework using the NIST AI RMF. Which action best ensures alignment between AI innovation velocity and organizational risk tolerance?

A.Set a static threshold for model accuracy at 95% across all AI projects.
B.Define risk tolerance levels based on potential impact to human rights and safety, differentiated by model deployment context.
C.Require all AI teams to use exclusively open-source models to mitigate vendor-related risks.
D.Delegate all AI risk acceptance decisions to the lead data scientist.
AnswerB

Anchoring tolerance thresholds to human-rights and safety impact, varied by deployment context, ties acceptable risk directly to the NIST AI RMF's harm-based framing. This lets teams move quickly in low-stakes contexts while constraining high-impact deployments, aligning velocity with organisational risk tolerance.

Why this answer

Defining risk tolerance levels based on potential impact to human rights and safety, differentiated by deployment context, aligns with the NIST AI RMF's risk-based approach. It allows the organization to calibrate innovation velocity according to the severity of consequences in each use case, rather than applying a one-size-fits-all threshold. This ensures that high-risk applications receive stricter scrutiny while lower-risk projects can proceed more rapidly.

Exam trap

The trap is selecting a uniform, quantitative threshold like 95% accuracy, which seems rigorous but ignores the NIST AI RMF's principle of context-based risk tolerance.

How to eliminate wrong answers

Option A is wrong because a static 95% accuracy threshold across all projects ignores context; a 95% accurate model in a medical diagnosis context may be unacceptable, while in a movie recommendation it may be fine. Option C is wrong because mandating open-source models does not inherently mitigate vendor risk and may introduce other risks like lack of support or security vulnerabilities. Option D is wrong because delegating all risk acceptance to a lead data scientist concentrates decision-making without appropriate oversight and ignores organizational risk appetite.

Practice this question →
55
MCQhard

When setting up an AI risk monitoring dashboard, what is the most important consideration for ensuring executive buy-in?

A.Map AI performance metrics to business impact indicators like customer churn or operational downtime.
B.Include the number of GPU hours utilized.
C.Display the raw training error rates.
D.Show a comparison of the organization's AI progress against competitors.
AnswerA

Mapping AI metrics to business impact indicators directly satisfies the executive buy-in constraint, because leadership allocates budget against revenue, churn and downtime rather than model-centric scores such as precision or latency. Framing risk monitoring in those financial and operational terms makes the dashboard's value legible to decision-makers who lack technical AI backgrounds.

Why this answer

Executive buy-in depends on demonstrating business value, not technical detail. Mapping AI performance metrics to business impact indicators such as customer churn, revenue, or operational downtime translates model behavior into outcomes executives already care about and are measured on. This makes the dashboard a decision-support tool rather than an engineering report.

Exam trap

The trap is choosing a technically impressive metric (GPU hours, error rates) over a business-relevant one — exam questions about executive buy-in almost always reward business impact framing.

How to eliminate wrong answers

Option B is wrong because GPU hours are an infrastructure cost metric, not a business outcome — executives cannot easily act on or prioritize based on GPU utilization alone. Option C is wrong because raw training error rates are technical diagnostics that lack business context and can mislead non-technical stakeholders. Option D is wrong because competitor comparisons are external benchmarks that do not show the organization's own risk exposure or business impact.

Practice this question →
56
MCQeasy

Which stage of the AI lifecycle should risk management activities begin?

A.When the budget is exhausted
B.After the model is fully deployed
C.During the design and requirements phase
D.Only when a bug is reported
AnswerC

Risk management begins during design and requirements, where intended purpose, affected stakeholders and potential harms are identified before development. Addressing risk here shapes architecture and data decisions, rather than reacting after deployment when remediation is costlier.

Why this answer

Risk management activities should begin during the design and requirements phase of the AI lifecycle to proactively identify and mitigate potential risks before they materialize. This early integration ensures that ethical, legal, and operational risks are considered from the outset, reducing costly rework and harm. Waiting until later stages increases the likelihood of unintended consequences.

Exam trap

AAIR often tests the misconception that risk management is a post-deployment or reactive activity, rather than a proactive process starting at design.

How to eliminate wrong answers

Option A is wrong because waiting until the budget is exhausted is reactive and too late to manage risks effectively. Option B is wrong because after deployment is post-hoc and risks may have already caused harm. Option D is wrong because only when a bug is reported is incident-driven, not proactive risk management.

Practice this question →
57
MCQmedium

An organization is updating its risk appetite statement for AI. Which specific element should be addressed to manage the 'hallucination' risk of LLMs?

A.Set a performance goal to reduce the model parameter count.
B.Require human-in-the-loop for any AI-generated output used in customer-facing content.
C.Increase the frequency of periodic penetration testing.
D.Limit the training dataset to under 10GB.
AnswerB

Hallucination risk means LLMs can generate fluent but fabricated content, so mandating human-in-the-loop review for customer-facing output ensures a person verifies accuracy before publication. This directly addresses the risk appetite element of acceptable AI error tolerance in externally visible content.

Why this answer

Hallucination risk in LLMs — where the model generates plausible but factually incorrect output — is best managed by requiring human-in-the-loop review for any AI-generated content used in customer-facing communications. This ensures a human validates factual accuracy before the output reaches customers, directly mitigating the reputational, legal, and financial harm of hallucinations. This control aligns with the risk appetite principle of defining acceptable risk thresholds and the corresponding controls.

Exam trap

AAIR often tests the confusion between security controls (pen testing) and accuracy controls (human-in-the-loop), so candidates must map 'hallucination' specifically to factual-accuracy mitigation, not cybersecurity.

How to eliminate wrong answers

Option A is wrong because reducing model parameter count does not address hallucination — smaller models can hallucinate just as much or more, and parameter count is an architecture/cost decision, not a factual-accuracy control. Option C is wrong because penetration testing addresses security vulnerabilities (e.g., prompt injection, data exfiltration), not factual hallucination risk. Option D is wrong because limiting training data to under 10GB is arbitrary and would degrade model capability without addressing hallucination — in fact, less data can worsen factual grounding.

Practice this question →
58
MCQmedium

When coordinating AI risk across a global organization, why is it critical to include local legal counsel in the AI steering committee?

A.To audit the training datasets for copyright infringement.
B.To handle administrative tasks for the committee.
C.To interpret the varied regulatory landscapes in different operational regions.
D.To approve the technical architecture of the AI models.
AnswerC

AI regulations differ by jurisdiction, so local counsel translates region-specific rules into actionable committee guidance. Their legal interpretation satisfies the global coordination constraint, ensuring the steering committee accounts for each operational territory's distinct compliance obligations rather than applying one uniform standard.

Why this answer

Local legal counsel is essential on a global AI steering committee because AI regulations vary significantly by jurisdiction — the EU AI Act, US state laws, China's algorithm rules, Brazil's LGPD, etc. — and local counsel interprets how these apply to the organization's operations in each region. This ensures the committee's risk decisions are legally grounded and regionally compliant rather than assuming a single global standard.

Exam trap

AAIR often tests the difference between legal/regulatory advisory roles and technical/operational roles, so the trap is assigning hands-on technical or audit tasks to legal counsel instead of their core function of interpreting varied regulations.

How to eliminate wrong answers

Option A is wrong because auditing training datasets for copyright infringement is a specialized legal/technical audit task, not the steering committee's coordination role, and is typically performed by IP counsel or data governance teams. Option B is wrong because administrative tasks are handled by program management or secretariat staff, not legal counsel. Option D is wrong because approving technical architecture is the responsibility of engineering/architecture review boards, not legal counsel, whose role is regulatory interpretation and risk advice.

Practice this question →
59
MCQmedium

What is the primary purpose of an 'AI Risk Dashboard' for executive leadership?

A.To replace the need for an AI ethics committee
B.To provide raw model logs to the public
C.To monitor individual developer productivity
D.To provide high-level visibility into AI risk posture and trends
AnswerD

An AI Risk Dashboard aggregates governance metrics into executive-level views, surfacing overall risk posture and emerging trends across AI systems. This satisfies the stem's requirement for leadership oversight: directors need consolidated, strategic visibility rather than operational detail, enabling informed decisions on risk appetite, resourcing and regulatory exposure without inspecting individual model logs.

Why this answer

An AI Risk Dashboard aggregates key risk indicators, model performance metrics, and compliance status into a concise executive view. Its primary purpose is to give leadership high-level visibility into the organization's AI risk posture and emerging trends so they can make informed strategic decisions. It does not replace governance bodies or expose raw technical logs.

Exam trap

The trap here is confusing an executive reporting tool with governance decision-making bodies, leading candidates to select the option that says it replaces the ethics committee.

How to eliminate wrong answers

Option A is wrong because a dashboard is a reporting tool, not a substitute for the deliberative and oversight functions of an AI ethics committee. Option B is wrong because raw model logs are too granular and may contain sensitive data; dashboards present summarized, role-appropriate metrics rather than public raw logs. Option C is wrong because monitoring individual developer productivity is an HR/engineering concern, not the purpose of an executive AI risk dashboard.

Practice this question →
60
MCQmedium

Which documentation is necessary to provide to auditors for an AI system?

A.A list of all employees who attended a conference
B.The login credentials for the production environment
C.The model card or model documentation
D.The complete source code without comments
AnswerC

A model card documents intended use, training data, evaluation metrics, limitations and ethical considerations. Auditors rely on it as the authoritative record of how the AI system was designed, validated and governed, satisfying the evidence requirement for an AI audit.

Why this answer

Model cards (and related model documentation such as datasheets for datasets) are the standard artifacts auditors expect for AI systems because they disclose a model's intended use, training data, performance metrics, limitations, ethical considerations, and evaluation results. They provide the transparency and traceability auditors need to assess whether the AI system is being used appropriately and whether its risks are understood and documented. This aligns with NIST AI RMF transparency and accountability principles.

Exam trap

AAIR often tests whether candidates confuse operational/security artifacts (credentials, raw code) with governance/transparency artifacts (model cards, risk registers) — the trap is selecting something that sounds technical but is not the correct audit documentation.

How to eliminate wrong answers

Option A is wrong because a conference attendance list has no bearing on AI system documentation, risk posture, or auditability — it is irrelevant administrative data. Option B is wrong because sharing production login credentials with auditors is a severe security violation and is never an audit requirement; auditors review documentation and controls, not live credentials. Option D is wrong because raw source code without comments is not the primary audit artifact for an AI system — auditors focus on model documentation, governance records, and risk assessments, not undocumented code dumps.

Practice this question →
61
MCQmedium

An organization is establishing an AI governance framework. Which approach is most effective for aligning AI risk appetite with enterprise-wide risk management (ERM)?

A.Map AI-specific risk metrics to existing enterprise risk categories like operational, financial, and reputational risk.
B.Establish a top-down mandate that ignores business unit input to ensure uniformity.
C.Focus solely on technical model performance metrics to define the organizational risk appetite.
D.Create a separate AI-specific risk register that operates independently of the corporate risk register.
AnswerA

Mapping AI risk metrics onto existing enterprise risk categories lets AI appetite be expressed in the same taxonomy ERM already aggregates and reports. This satisfies the alignment requirement by integrating AI exposure into established operational, financial, and reputational reporting rather than running a parallel framework.

Why this answer

Mapping AI-specific risk metrics to existing enterprise risk categories (operational, financial, reputational) integrates AI risk into ERM rather than treating it as a silo. This lets the organization express AI risk appetite in the same language and scales used for other risks, enabling consistent aggregation, reporting, and board-level oversight. It is the approach most aligned with COSO ERM and ISO 31000 integration principles.

Exam trap

AAIR often tests the misconception that AI risk is so unique it needs a separate, independent register, when the correct governance answer is integration with ERM.

How to eliminate wrong answers

Option B is wrong because a top-down mandate that ignores business unit input produces unrealistic risk thresholds and poor adoption; ERM requires bidirectional calibration with risk owners. Option C is wrong because technical performance metrics (accuracy, latency) do not capture business, ethical, legal, or reputational risk and cannot define organizational risk appetite on their own. Option D is wrong because a standalone AI risk register disconnected from the corporate register prevents aggregation, duplicates effort, and hides AI risk from enterprise-level governance.

Practice this question →
62
MCQhard

You are managing AI supply chain risk. Which control is most critical for third-party AI models?

A.Requiring a documented 'AI Bill of Materials' to understand data lineage and model provenance.
B.Conducting a manual audit of the vendor's source code.
C.Requiring the vendor to submit a monthly performance report.
D.Setting a limit on the number of third-party vendors allowed.
AnswerA

An AI Bill of Materials documents training data lineage, model provenance and dependencies, giving visibility into inherited third-party risks. This control satisfies the supply chain constraint by enabling traceability and vulnerability assessment of externally sourced models, which contractual clauses alone cannot provide.

Why this answer

The most critical control for third-party AI models is requiring a documented 'AI Bill of Materials' (AI BOM) to understand data lineage and model provenance. This provides transparency into the components, data sources, and training methods used in the model, enabling effective risk assessment and mitigation. Without this visibility, organizations cannot verify compliance, detect biases, or manage supply chain risks.

Exam trap

AAIR often tests the importance of transparency and documentation in AI supply chains. Candidates may choose operational controls like performance reports or vendor limits, but the most critical is understanding the model's composition through an AI BOM.

How to eliminate wrong answers

Option B is wrong because a manual audit of the vendor's source code is often impractical, may not be permitted, and does not address data lineage or model provenance. Option C is wrong because a monthly performance report focuses on operational metrics, not on the underlying data and model risks. Option D is wrong because limiting the number of vendors is a general risk management tactic but does not provide the necessary transparency for each model.

Practice this question →
63
MCQmedium

To ensure cross-functional coordination, you are designing a workflow for AI incident reporting. Which group should be the first point of contact upon detecting an AI model bias issue?

A.AI Governance/Ethics Committee
B.IT Help Desk
C.Customer Support
D.External Regulators
AnswerA

An AI Governance/Ethics Committee provides the cross-functional coordination the stem demands, uniting legal, data science, compliance and business stakeholders to triage bias incidents. Bias issues span model, data and policy domains, so routing first to this committee satisfies the requirement for coordinated oversight rather than single-team remediation.

Why this answer

An AI Governance/Ethics Committee is the designated cross-functional body responsible for overseeing AI risk, including bias, fairness, and ethical concerns. When a bias issue is detected, this committee is the appropriate first point of contact because it has the authority, expertise, and mandate to assess the issue, coordinate response across legal, data science, and business teams, and determine remediation or escalation. Routing bias incidents here ensures consistent, accountable handling aligned with the organization's AI risk framework.

Exam trap

AAIR often tests the distinction between operational support channels (help desk, customer support) and governance bodies — candidates may pick the help desk because it's the familiar 'first contact' for IT issues, but AI bias requires governance-level triage.

How to eliminate wrong answers

Option B is wrong because the IT Help Desk handles technical support and infrastructure issues, not AI ethics or bias assessment — it lacks the governance authority and domain expertise. Option C is wrong because Customer Support manages customer-facing inquiries and complaints; while they may receive bias reports from users, they are not the coordinating body for internal AI incident response. Option D is wrong because external regulators are notified only after internal assessment and, where required, by legal/compliance — they are not a first point of contact for detecting and triaging an internal bias issue.

Practice this question →
64
Multi-Selecthard

Which TWO strategies are recommended for 'Mitigating' AI model bias?

Select 2 answers
A.Removing all data from the database
B.Asking the user to manually fix the bias
C.Applying fairness constraints during model training
D.Ignoring the bias and hoping it goes away
E.Training on more diverse and representative datasets
AnswersC, E

Fairness constraints embedded in the training objective directly penalise biased outcomes during optimisation, so the model learns equitable decision boundaries rather than having bias patched afterwards. This satisfies the mitigation requirement by reducing disparate impact at its source, before deployment.

Why this answer

Option C is correct because applying fairness constraints during model training directly mitigates bias by incorporating fairness metrics (such as demographic parity or equalized odds) into the objective function or as regularization terms, forcing the model to reduce disparate impact across protected groups. Option E is correct because training on more diverse and representative datasets addresses bias at its source—the data—by ensuring the model learns patterns from a broader population, reducing sampling bias and underrepresentation that lead to skewed predictions. Options A, B, and D are not recommended mitigation strategies: deleting all data destroys the training set and makes learning impossible, asking users to manually fix bias shifts responsibility away from systematic model design and is not scalable or reliable, and ignoring bias allows it to persist and potentially worsen in production.

Exam trap

AAIR often tests the misconception that bias can be 'fixed' by a single action or by end users, when the exam expects you to recognize that mitigation requires layered, data-and-algorithm interventions.

Practice this question →
65
MCQhard

If an AI model relies on an open-source library that is found to have a security vulnerability, who is responsible for managing this risk?

A.The government regulators
B.The AI Risk Manager and Security team
C.The library's author
D.The public at large
AnswerB

Third-party library vulnerabilities in an AI model fall under the AI Risk Manager and Security team, who own risk identification, assessment and mitigation across the AI supply chain. This satisfies the stem's accountability question by assigning ownership to those governing AI risk rather than developers alone.

Why this answer

When an AI system depends on a vulnerable open-source library, the organization deploying the model owns the residual risk. The AI Risk Manager and Security team are responsible for identifying, assessing, and mitigating that risk through patching, compensating controls, or replacing the dependency. Responsibility cannot be outsourced to the library author or regulators simply because the code was third-party.

Exam trap

The trap is assuming that because the vulnerability originated in someone else's code, someone else owns the risk — in AI risk management, the deploying organization always retains accountability for third-party components.

How to eliminate wrong answers

Option A is wrong because government regulators set rules and standards but do not manage an individual organization's operational risk. Option C is wrong because the library's author may fix the vulnerability, but they have no responsibility for how downstream organizations deploy and govern their AI systems. Option D is wrong because the public at large has no role or authority in an organization's internal risk management.

Practice this question →
66
MCQeasy

Which of the following is a key component of 'AI Risk Governance'?

A.The choice of programming language
B.The definition of roles and responsibilities
C.The vendor of the cloud hosting platform
D.The speed of model deployment
AnswerB

Defining roles and responsibilities establishes accountability for AI risk decisions, satisfying governance's requirement for clear ownership across the AI lifecycle. Unlike purely technical controls, this assigns who assesses, approves, and monitors AI risks within Microsoft Entra ID-governed environments, ensuring oversight is enforceable rather than implicit.

Why this answer

A key component of AI Risk Governance is the definition of roles and responsibilities, which establishes accountability for risk management across the organization. This includes specifying who owns AI risks, who approves deployments, and who monitors ongoing performance. Without clear roles, governance breaks down and risks go unmanaged.

Exam trap

The trap is confusing technical implementation choices (programming language, cloud vendor) with governance components, causing candidates to overlook the organizational nature of roles and responsibilities.

How to eliminate wrong answers

Option A is wrong because the choice of programming language is an implementation detail that does not define governance structures or accountability. Option C is wrong because the cloud hosting vendor is a procurement and technical decision, not a core governance component, though it may be subject to governance oversight. Option D is wrong because the speed of model deployment is an operational metric, not a governance component; governance may influence speed through controls, but speed itself is not a component.

Practice this question →
67
MCQmedium

When establishing KPIs for an AI program, what is the risk of focusing solely on 'Model Accuracy'?

A.The model will be too computationally expensive.
B.The data scientists will take too long to develop the model.
C.The model will not be deployable in production.
D.Other critical risks such as bias, security, and fairness may be overlooked.
AnswerD

Optimising only for Model Accuracy ignores other dimensions of responsible AI. Bias, security and fairness can degrade undetected, so the programme may ship a model that performs well statistically yet causes harm, which is the risk the stem asks about.

Why this answer

Focusing solely on model accuracy creates a narrow optimization target that ignores other critical AI risks such as bias, fairness, security, privacy, and robustness. Accuracy alone does not guarantee that a model is ethical, compliant, or safe in production, so other risk dimensions can be neglected.

Exam trap

AAIR often tests the misconception that accuracy is a sufficient KPI, causing candidates to overlook bias, fairness, and security risks.

How to eliminate wrong answers

Option A is wrong because computational expense is a performance/cost concern, not the primary risk of an accuracy-only KPI. Option B is wrong because development time is a schedule concern, not a governance risk arising from accuracy-centric measurement. Option C is wrong because deployability depends on many factors (latency, integration, monitoring), and accuracy alone does not directly cause non-deployability; the core issue is overlooked risk dimensions.

Practice this question →
68
MCQeasy

What is 'Bias' in the context of AI risk?

A.The model is missing documentation
B.Systematic prejudice in model outputs leading to unfair results
C.The model is too expensive to maintain
D.The model is running too fast
AnswerB

Bias denotes systematic, repeatable skew in model outputs that disadvantages particular groups, rather than random error. This satisfies the stem's AI risk context by naming prejudice embedded in outputs, producing unfair results across protected characteristics. It aligns with AAIR's treatment of bias as a measurable fairness harm requiring mitigation.

Why this answer

In AI risk taxonomy, bias refers to systematic and unfair prejudice in model outputs that disadvantages individuals or groups based on protected attributes like race, gender, or age. It arises from skewed training data, flawed feature selection, or proxy variables, and manifests as disparate impact in decisions such as hiring, lending, or healthcare. It is a fairness risk, not a documentation, cost, or performance issue.

Exam trap

AAIR often tests the misconception that bias is a technical performance or cost issue — the trap is failing to recognize bias as a fairness risk rooted in systematic output prejudice against protected groups.

How to eliminate wrong answers

Option A is wrong because missing documentation is a model governance and explainability deficiency, not bias — it is a documentation risk, not a fairness risk. Option C is wrong because high maintenance cost is a financial/operational risk, unrelated to fairness in model outputs. Option D is wrong because running too fast is a performance characteristic; speed has no bearing on whether outputs are systematically unfair to a protected group.

Practice this question →
69
MCQmedium

When coordinating between Legal and Data Science teams, what is the best way to handle 'Explainability' requirements?

A.Require Data Science to translate technical model output into plain language documentation
B.Restrict Legal from reviewing AI model outputs
C.Let Legal define the technical parameters of the models
D.Only document model logic when a lawsuit occurs
AnswerA

Explainability requires that non-technical stakeholders understand model reasoning, so having Data Science translate technical outputs into plain-language documentation bridges the Legal and Data Science gap. This satisfies the coordination requirement by making model behaviour auditable and comprehensible to Legal reviewers.

Why this answer

Explainability requirements exist so that non-technical stakeholders — Legal, compliance, regulators, and affected individuals — can understand how a model reaches decisions. The Data Science team owns the technical model and is best positioned to translate its behavior into plain-language documentation that Legal can review and rely on. This preserves the division of labor: Data Science explains, Legal interprets and applies.

Exam trap

AAIR often tests role boundaries in AI governance — candidates may pick 'Legal defines technical parameters' or 'restrict Legal access' by confusing who owns explainability versus who consumes it; the correct answer keeps Data Science as translator and Legal as reviewer.

How to eliminate wrong answers

Option B is wrong because restricting Legal from reviewing AI outputs defeats the purpose of explainability and creates regulatory and legal exposure. Option C is wrong because Legal defining technical model parameters inverts the roles — Legal lacks the technical expertise and should not dictate model architecture or hyperparameters. Option D is wrong because documenting model logic only when a lawsuit occurs is reactive and violates proactive governance and regulatory expectations for high-risk AI.

Practice this question →
70
MCQeasy

When setting KPIs for an AI risk program, which metric is a leading indicator of potential model bias?

A.Average model inference latency
B.Percentage of customer complaints regarding AI decisions
C.Number of model updates per quarter
D.Demographic parity ratio in training data samples
AnswerD

Demographic parity ratio measures outcome rates across protected groups in sampled training data, so an imbalanced ratio precedes biased predictions. It is a leading indicator because it flags imbalance before training, unlike lagging production fairness metrics.

Why this answer

Demographic parity ratio in training data samples is a leading indicator because it measures the representation of protected groups before the model is deployed. A skewed ratio (e.g., far from 1.0) signals that the model may learn biased patterns, allowing proactive mitigation. Unlike lagging metrics such as complaints, it provides early warning during data collection and preprocessing.

Exam trap

The trap here is confusing leading indicators (proactive, data-centric metrics) with lagging indicators (reactive, outcome-based metrics like complaints), causing candidates to select option B.

How to eliminate wrong answers

Option A is wrong because average model inference latency is a performance metric unrelated to bias; it measures speed, not fairness. Option B is wrong because the percentage of customer complaints regarding AI decisions is a lagging indicator—it reflects bias after harm has occurred, not a leading signal. Option C is wrong because the number of model updates per quarter indicates development velocity or maintenance frequency, not bias risk.

Practice this question →
71
MCQmedium

When performing an AI risk assessment, which question is most appropriate to ask?

A.How many people are on the development team?
B.What is the potential impact if the model produces biased results?
C.What is the model's highest accuracy score?
D.Does the model use open-source libraries?
AnswerB

Bias is a core AI-specific risk dimension, so asking about the impact of biased model outputs addresses fairness and potential harm to affected individuals. This frames the assessment around a concrete consequence of model behaviour, which is the appropriate focus for AI risk analysis.

Why this answer

The most appropriate risk-assessment question probes potential harm and impact, such as the consequences of biased model outputs. This focuses the assessment on likelihood and severity of adverse outcomes, which is the core of risk analysis. Questions about team size, accuracy scores, or library choices are inputs or metrics, not risk-impact questions.

Exam trap

AAIR often tests the misconception that technical metrics like accuracy equal risk assessment, when the correct focus is potential harm and impact.

How to eliminate wrong answers

Option A is wrong because development team size is a resourcing detail, not a measure of risk likelihood or impact. Option C is wrong because a single accuracy score does not capture harm, fairness, safety, or business impact and can mask severe failure modes on underrepresented data. Option D is wrong because using open-source libraries is a supply-chain consideration, not a direct risk-impact question; it may inform a sub-risk but does not assess the consequence of model behavior.

Practice this question →
72
MCQmedium

In a retail company, which AI risk is most likely to cause direct financial loss?

A.The model documentation is outdated
B.The font size in the UI is too small
C.The pricing model provides incorrect, discounted rates
D.The model's name is not catchy
AnswerC

Discounted pricing directly reduces revenue per transaction, so every affected sale produces immediate, quantifiable margin loss. Other AI risks, such as bias or poor explainability, cause harm indirectly through legal or reputational channels rather than direct financial impact.

Why this answer

The AI risk most likely to cause direct financial loss in a retail company is a pricing model that provides incorrect, discounted rates. This directly impacts revenue and profitability, as customers may be undercharged or the company may lose sales due to pricing errors. Incorrect pricing can also lead to competitive disadvantages and customer distrust.

Exam trap

AAIR often tests the ability to distinguish between direct and indirect financial risks. Candidates may be distracted by governance or usability issues, but the most direct financial loss comes from core business functions like pricing.

How to eliminate wrong answers

Option A is wrong because outdated model documentation is a governance issue that may lead to inefficiencies but does not directly cause financial loss. Option B is wrong because font size in the UI is a usability concern, not a direct financial risk. Option D is wrong because the model's name not being catchy is a marketing issue with no direct financial impact.

Practice this question →
73
Multi-Selecteasy

Which TWO factors should be documented in an AI Model Card?

Select 2 answers
A.The developer's favorite snacks
B.The current stock price of the company
C.The employee handbook for new hires
D.Intended use cases
E.Model limitations and known risks
AnswersD, E

Model Cards record intended use cases, defining the tasks and contexts the model was designed and evaluated for, which guides appropriate deployment. This satisfies the stem's requirement for factors that must be documented in an AI Model Card.

Why this answer

Option D (Intended use cases) is correct because an AI Model Card is designed to document the purpose and appropriate applications of a model, so consumers know what tasks it was built for and where it should be deployed. Option E (Model limitations and known risks) is correct because Model Cards must disclose known biases, failure modes, out-of-scope scenarios, and other risks so users can make informed decisions about deployment. Options A, B, and C are incorrect because favorite snacks, stock prices, and new-hire handbooks are unrelated to model transparency, performance, or governance, and are not part of standard Model Card documentation such as that proposed by Mitchell et al. or required under emerging AI regulations.

Exam trap

AAIR often tests whether candidates confuse Model Card contents with general corporate documents, so distractors like handbooks or stock prices are inserted to see if you know the Model Card is strictly a model-level transparency artifact.

Practice this question →
74
Multi-Selectmedium

Which THREE areas should be covered in an AI risk management program?

Select 3 answers
A.The office floor plan
B.Model performance and accuracy
C.Third-party/Vendor risk management
D.The color of the company logo
E.Legal and regulatory compliance
AnswersB, C, E

Model performance and accuracy must be covered because degraded, drifting or biased outputs create operational and safety risk. Monitoring these metrics ensures the programme detects failures, satisfying the stem's requirement that risk management addresses the model's ongoing behaviour rather than only deployment-time concerns.

Why this answer

Option B (Model performance and accuracy) is correct because an AI risk management program must address model-specific risks such as drift, bias, overfitting, and degraded accuracy that directly affect decision quality and safety. Option C (Third-party/Vendor risk management) is correct because organizations often rely on external model providers, APIs, and training data suppliers, so vendor due diligence, contractual controls, and supply-chain monitoring are essential parts of AI risk governance. Option E (Legal and regulatory compliance) is correct because AI systems must comply with applicable laws and frameworks such as the EU AI Act, GDPR, and sector-specific regulations, making compliance a core risk domain.

Option A (The office floor plan) is incorrect because physical office layout is a facilities concern, not an AI risk management area. Option D (The color of the company logo) is incorrect because branding aesthetics have no bearing on AI risk management.

Exam trap

AAIR often tests whether candidates can distinguish genuine AI risk domains (performance, vendor, compliance) from obvious distractors (office layout, logo color) that have no risk relevance.

Practice this question →
75
MCQeasy

A retail company's AI governance committee is drafting its charter. The committee wants to define clear decision rights so that disputes over AI risk acceptance do not stall deployment decisions. Which element is most essential to include in the charter?

A.The marketing roadmap for AI-powered customer experiences over the next three years.
B.A detailed technical specification of every AI model architecture the company plans to use.
C.A complete list of every AI vendor contract currently under negotiation.
D.A RACI matrix that assigns accountability for AI risk decisions by risk tier and defines the escalation path to the board.
AnswerD

A RACI matrix tied to risk tiers establishes who is accountable, consulted, and informed for AI risk decisions, and the defined escalation path resolves disagreements at the right level. This directly addresses the committee's goal of preventing disputes from stalling deployments by making decision rights explicit and auditable.

Why this answer

A governance charter exists to make authority explicit. A RACI matrix that maps accountability by risk tier, combined with a defined escalation path to the board, ensures that disagreements about AI risk acceptance are resolved by the right decision maker at the right level. This prevents deployment delays caused by ambiguity over who ultimately owns the risk decision.

Exam trap

The trap here is filling a governance charter with operational or strategic content, such as architecture details or roadmaps, when the charter's core purpose is to assign decision rights and escalation authority.

Practice this question →
Page 1 of 2 · 87 questions totalNext →

Ready to test yourself?

Try a timed practice session using only AI Risk Program Management questions.

Start 20-question session