CCNA Ai Risk Program Management Questions — Page 2 of 2

Multi-Selectmedium

Which THREE types of 'Bias' need to be managed in an AI project?

Select 3 answers

A.Measurement bias (data collection)

B.The bias towards free coffee

C.The bias of the local weather

D.Sampling bias (data selection)

E.Algorithmic bias (model logic)

AnswersA, D, E

Measurement bias arises when data collection instruments or sampling methods systematically distort values, so the training set misrepresents the population the model must serve. Recognising it as a distinct bias category satisfies the stem's requirement to identify three manageable bias types, since it can be mitigated through validated collection tools and representative sampling.

Why this answer

Measurement bias (A) must be managed because it arises during data collection when the instruments, sensors, or labeling procedures systematically distort the values recorded, so the training data does not faithfully represent the real-world phenomenon. Sampling bias (D) must be managed because it occurs during data selection when the dataset is drawn from a non-representative subset of the population, causing the model to learn patterns that do not generalize to the intended deployment context. Algorithmic bias (E) must be managed because it emerges from the model's logic, objective function, or optimization process, which can amplify or encode unfair correlations even when the input data is otherwise sound.

The remaining options do not belong: the bias towards free coffee (B) is a humorous personal preference with no bearing on AI data or model behavior, and the bias of the local weather (C) is an environmental condition rather than a systematic distortion in an AI pipeline.

Exam trap

The trap here is that candidates may confuse general 'bias' in everyday language with the specific technical categories of bias tested in AI risk management exams.

Practice this question →

Multi-Selecthard

A cross-functional committee is evaluating the deployment of a high-impact AI model. Which TWO factors are critical to include in the initial AI risk assessment to ensure comprehensive coverage?

Select 2 answers

A.The frequency of software patching for the underlying cloud infrastructure.

B.The socio-technical implications and potential impact on protected groups.

C.The underlying training data lineage, including provenance and potential bias sources.

D.The name of the vendor providing the cloud compute resources.

E.The specific programming language used for the model development.

AnswersB, C

High-impact AI can entrench discrimination, so the assessment must examine socio-technical implications and effects on protected groups. This satisfies the stem's demand for comprehensive coverage by addressing societal harm and fairness, not merely technical performance or narrow accuracy metrics.

Why this answer

Option B is correct because a comprehensive AI risk assessment must evaluate socio-technical implications, including how the model's deployment could disproportionately affect protected groups (e.g., by race, gender, age, or disability), which is central to fairness, equity, and regulatory compliance concerns such as those in the EU AI Act and NIST AI RMF. Option C is correct because understanding training data lineage—provenance, collection methods, and embedded bias sources—is essential to identifying data-driven risks like historical bias, sampling bias, and label bias that propagate into model outputs. Options A, D, and E are not critical initial risk-assessment factors: patching frequency (A) is a general infrastructure hygiene concern, the vendor name (D) is a procurement detail rather than a risk dimension, and the programming language (E) is an implementation choice that does not materially affect AI risk exposure.

Exam trap

AAIR often tests whether candidates confuse IT operational hygiene (patching, vendor names, languages) with genuine AI risk dimensions (data lineage, bias, socio-technical impact) — the distractor options sound plausible but are not AI-specific risks.

Practice this question →

MCQeasy

Which of the following is a key objective of an AI Risk Management Program?

A.To eliminate all AI risks.

B.To maximize the budget spent on AI tools.

C.To enable the ethical and safe adoption of AI technologies.

D.To replace human employees with AI.

AnswerC

The programme governs AI through risk identification, assessment and mitigation across its lifecycle, which directly enables ethical and safe adoption of AI technologies. Other objectives, such as compliance or cost control, are subordinate outcomes rather than the central purpose.

Why this answer

The key objective of an AI Risk Management Program is to enable the ethical and safe adoption of AI technologies by identifying, assessing, mitigating, and monitoring AI-specific risks such as bias, opacity, privacy violations, and safety failures. It supports responsible innovation rather than blocking AI use. This aligns with frameworks like NIST AI RMF and ISO/IEC 42001.

Exam trap

AAIR often tests whether candidates recognize that AI risk management is about enabling safe, ethical adoption rather than eliminating risk or maximizing spend, tempting them to choose absolutist or budget-focused answers.

How to eliminate wrong answers

Option A is wrong because eliminating all AI risks is neither feasible nor desirable — risk management aims to manage risk to acceptable levels, not eliminate it entirely. Option B is wrong because maximizing budget spend on AI tools is a spending goal, not a risk management objective, and could even increase risk. Option D is wrong because replacing human employees with AI is a business strategy decision, not the objective of an AI risk management program.

Practice this question →

MCQhard

A global bank's AI risk committee is defining key risk indicators (KRIs) for its portfolio of customer-facing AI systems. The committee wants KRIs that provide early warning of emerging risk rather than lagging confirmation of past failures. Which KRI design best meets this objective?

A.Percentage of AI models whose input data drift exceeds a defined threshold over a rolling 30-day window.

B.Aggregate spend on AI risk remediation activities compared with the annual budget.

C.Number of confirmed regulatory findings related to AI systems in the past quarter.

D.Total count of AI-related customer complaints resolved by the service desk each month.

AnswerA

Data drift beyond a threshold is a leading indicator: it signals that model inputs are diverging from training conditions before performance degradation or biased outcomes become visible to customers or regulators. Tracking the percentage of affected models over a rolling window gives the committee an early, actionable signal to trigger retraining or enhanced monitoring.

Why this answer

Leading KRIs measure conditions that precede adverse outcomes, giving the committee time to intervene. Input data drift beyond a defined threshold is detectable before model outputs degrade, before customers are harmed, and before regulators take notice. By tracking the proportion of models breaching the drift threshold over a rolling window, the committee gains a forward-looking signal that can trigger retraining, rollback, or heightened oversight.

Exam trap

The trap here is treating any frequently reported AI metric, such as complaint counts or remediation spend, as a leading indicator when those measures only confirm harm or cost that has already been incurred.

Practice this question →

Multi-Selectmedium

Which TWO types of documentation are critical for AI Transparency requirements?

Select 2 answers

A.Data Sheets for Datasets explaining the provenance and makeup of training data.

B.Model Cards detailing intended use, limitations, and performance.

C.A weekly calendar of team meetings.

D.The employee handbook.

E.A list of all employees who have access to the office.

AnswersA, B

Data Sheets for Datasets document a training dataset's provenance, composition, collection methods, and known limitations. This satisfies AI transparency by disclosing what data shaped the model, enabling stakeholders to assess suitability, bias exposure, and fitness for purpose rather than treating the model as an opaque artefact.

Why this answer

Data Sheets for Datasets (A) are critical because AI transparency requires documenting the provenance, composition, collection methods, and preprocessing of training data so stakeholders can assess bias, consent, and suitability. Model Cards (B) are equally essential since they disclose a model's intended use, limitations, performance metrics across relevant subgroups, and ethical considerations, directly supporting transparency obligations. Together these artifacts give the technical and contextual information regulators and users need to understand how an AI system was built and how it should be used.

The remaining options do not belong: a weekly meeting calendar (C) and an employee handbook (D) are general administrative documents unrelated to AI system transparency, and an office access list (E) concerns physical security, not AI documentation.

Exam trap

AAIR often tests whether candidates confuse general corporate documentation (handbooks, calendars, access lists) with AI-specific transparency artifacts, so the trap is selecting any document that sounds 'official' rather than one that specifically describes datasets or models.

Practice this question →

Multi-Selectmedium

Which TWO metrics are most appropriate for measuring the effectiveness of an AI Risk Program?

Select 2 answers

A.The average salary of data scientists.

B.Number of coffee machines in the building.

C.Number of social media followers of the company.

D.Total number of AI-related incidents reported and remediated.

E.Percentage of AI models that have undergone a formal risk assessment.

AnswersD, E

Counting reported and remediated AI incidents gives a direct, quantifiable measure of the risk programme's operational effectiveness, satisfying the stem's demand for metrics rather than qualitative assessments. Remediation volume evidences that identified risks are actually being treated, not merely logged.

Why this answer

Option D is correct because tracking the total number of AI-related incidents reported and remediated directly measures how well the AI Risk Program detects, responds to, and resolves real risk events, which is a core effectiveness indicator. Option E is correct because the percentage of AI models that have undergone a formal risk assessment measures the program's coverage and consistency in applying risk controls across the AI model inventory, reflecting proactive risk management maturity. Options A, B, and C are not appropriate because average data scientist salary, coffee machine count, and social media followers are unrelated to AI risk identification, assessment, mitigation, or governance outcomes and do not indicate program effectiveness.

Exam trap

AAIR often tests the distinction between vanity/business metrics (salaries, followers, facilities) and genuine risk program effectiveness metrics, so candidates must recognize that only metrics tied to risk identification, assessment, or remediation are valid.

Practice this question →

MCQeasy

Which of the following is a classic example of 'AI Hallucination' that needs monitoring?

A.The system is running slowly

B.The system requires too much electricity

C.The system password has expired

D.The system generates confident but factually incorrect information

AnswerD

Generating fluent, confident output that is factually wrong is the defining hallucination failure mode, so monitoring must detect unsupported claims rather than merely flagging uncertain or hedged responses. This satisfies the stem's requirement for a classic example needing oversight.

Why this answer

AI hallucination refers to a model generating confident but factually incorrect or nonsensical information, which is a key risk that requires monitoring. This can lead to misinformation, user harm, and reputational damage. The other options describe operational or infrastructure issues, not hallucination.

Exam trap

AAIR often tests the confusion between operational issues (performance, cost) and AI-specific risks like hallucination, leading candidates to pick irrelevant technical problems.

How to eliminate wrong answers

Option A is wrong because slow system performance is a latency or resource issue, not a hallucination. Option B is wrong because high electricity consumption is an efficiency concern, not a factual accuracy problem. Option C is wrong because an expired password is a security/authentication issue, unrelated to model output correctness.

Practice this question →

MCQmedium

Why is it critical to have 'Human-in-the-Loop' (HITL) for high-risk AI decisions?

A.To make the computer faster

B.To replace the need for model testing

C.To provide accountability and a safeguard against errors

D.To save money on hardware

AnswerC

Human-in-the-Loop inserts a person who reviews and can override high-risk AI outputs, creating a traceable decision owner. This delivers accountability and acts as a safeguard against model errors, satisfying the stem's requirement for high-risk decisions.

Why this answer

Human-in-the-Loop (HITL) ensures that a qualified human reviews and can override high-risk AI decisions, providing both accountability (a responsible person is answerable for the outcome) and a safeguard against model errors, bias, or edge cases the model was not trained for. This is essential for high-stakes domains like healthcare, finance, and criminal justice.

Exam trap

The trap is thinking HITL is about performance or cost optimization — it is fundamentally about accountability and error mitigation in high-risk decisions.

How to eliminate wrong answers

Option A is wrong because HITL adds human review time and does not make the computer faster — it may slow the process. Option B is wrong because HITL complements, not replaces, model testing; testing validates the model before deployment, while HITL catches issues in production. Option D is wrong because HITL typically increases operational cost (human reviewers), not reduce hardware costs.

Practice this question →

Multi-Selecteasy

Which TWO teams should be involved in the initial risk review for an AI chatbot?

Select 2 answers

A.Data Science/ML Engineering

B.Legal Department

C.The company mailroom staff

D.The local fitness coach

E.The custodial cleaning staff

AnswersA, B

Data Science/ML Engineering must join the initial risk review because they understand the chatbot's model, training data and known limitations. This satisfies the stem's constraint by supplying the technical evidence needed to assess model-specific risks before deployment.

Why this answer

Option A (Data Science/ML Engineering) is correct because this team owns the chatbot's model design, training data, and evaluation metrics, so they are best positioned to identify technical risks such as bias, hallucination, prompt injection, and data leakage during an initial risk review. Option B (Legal Department) is correct because legal must assess regulatory compliance (e.g., GDPR, CCPA), intellectual property, liability, and contractual exposure arising from the chatbot's outputs and data handling. The remaining options do not belong: the mailroom staff (C), local fitness coach (D), and custodial cleaning staff (E) have no role in AI system risk assessment, data governance, or regulatory compliance for a chatbot.

Exam trap

The trap is selecting irrelevant roles (mailroom, fitness coach, custodial staff) as distractors — exam questions about AI risk review expect you to identify the technical and legal functions that actually own AI risk.

Practice this question →

MCQhard

When an AI model fails in production, what is the 'Post-Mortem' goal?

A.To identify root causes and update risk management practices

B.To hide the failure from management

C.To fire the developer responsible

D.To delete all logs associated with the model

AnswerA

A post-mortem examines the production failure to establish why the model failed, then feeds those findings back into risk controls, monitoring and governance. This closes the loop, reducing recurrence and improving the organisation's AI risk management practices.

Why this answer

A post-mortem's goal is to identify root causes of the failure and feed those lessons back into risk management practices, controls, and monitoring. It is a blameless, learning-oriented exercise that improves future resilience rather than assigning fault. This aligns with AAIR's emphasis on continuous improvement of the AI risk management lifecycle.

Exam trap

AAIR often tests the misconception that post-mortems are about assigning blame or hiding incidents, when the correct answer is blameless root-cause learning that improves risk practices.

How to eliminate wrong answers

Option B is wrong because hiding failures from management violates governance, transparency, and incident-reporting obligations and prevents corrective action. Option C is wrong because firing the developer is a punitive, blame-oriented response that suppresses reporting and does not address systemic root causes. Option D is wrong because deleting logs destroys the forensic evidence needed for root-cause analysis and may violate regulatory retention requirements.

Practice this question →

MCQeasy

Which team is usually responsible for the 'Technical Implementation' of risk controls in an AI model?

A.Internal Audit

B.Human Resources

C.Legal Department

D.Data Science/Machine Learning Team

AnswerD

The Data Science/Machine Learning team builds and operates the model, so it implements the technical controls — such as input validation, bias testing and monitoring hooks — within the pipeline. Business, legal and audit functions define requirements and oversee assurance rather than performing the engineering work.

Why this answer

The Data Science/Machine Learning Team is responsible for the technical implementation of risk controls in an AI model because they build, train, and deploy the model. They implement controls such as bias mitigation, model monitoring, access controls, and performance safeguards directly in the code and pipeline. Other teams provide oversight, policy, or compliance guidance but do not typically implement technical controls.

Exam trap

The trap here is that candidates may associate risk controls with audit or legal teams, but the question specifically asks about technical implementation, which falls to the ML team.

How to eliminate wrong answers

Option A is wrong because Internal Audit assesses and verifies controls but does not implement them. Option B is wrong because Human Resources manages personnel and policy, not technical AI controls. Option C is wrong because the Legal Department provides legal guidance and compliance oversight, not technical implementation.

Practice this question →

MCQhard

In an AI risk program, how should 'Residual Risk' be treated?

A.It must be formally documented and periodically reviewed against risk appetite

B.It should be ignored if below a specific performance threshold

C.It should always be zero for production systems

D.It should be formally accepted by the risk owner if it exceeds appetite

AnswerA

Residual risk is the risk remaining after controls are applied, so it must be recorded in the risk register and re-evaluated at intervals to confirm it stays within the organisation's stated risk appetite and tolerance thresholds.

Why this answer

Residual risk is the risk remaining after controls are applied, and it must be formally documented and periodically reviewed against the organization's risk appetite to confirm it stays within tolerance. This creates an auditable trail and ensures changes in the threat landscape or model behavior trigger reassessment. Treating residual risk as a one-time calculation rather than a living value is a common program failure.

Exam trap

The trap is the reversed condition in option D — candidates who know risk owners accept risk may pick it without noticing it applies only when residual risk EXCEEDS appetite, not within it.

How to eliminate wrong answers

Option B is wrong because ignoring residual risk below a performance threshold conflates model performance with risk — a model can perform well yet still create compliance, bias, or privacy exposure that must be tracked. Option C is wrong because zero residual risk is unattainable in practice; claiming it indicates either a misunderstanding of risk or a failure to identify threats. Option D is wrong because formal acceptance by the risk owner is required when residual risk EXCEEDS appetite, not when it is within appetite — the option reverses the condition and misstates the governance trigger.

Practice this question →