CCNA AI Governance And Program Management Questions

This is correct because these metrics connect control execution to risk outcomes. Completion rates show whether required assessments occur before deployment; open findings and aging reveal unresolved exposure; incident trends show whether risks materialize. Together they let the board assess whether management is reducing risk within appetite and where intervention is needed, which is the purpose of governance reporting.

AI governance compliance must cover external legal and regulatory obligations, such as data protection law, sector rules and emerging AI-specific statutes. Addressing this satisfies the stem's requirement that compliance spans both mandatory external requirements and internal policy adherence.

This is correct because risk appetite becomes enforceable only when translated into tiers with specific controls, approvers, and review frequency. The board approves the tolerance levels; management applies the corresponding controls. This structure lets auditors test whether a high-impact AI system received the required approvals and monitoring, converting an abstract appetite statement into operational requirements.

Embedding an imperceptible watermark into model outputs lets governance teams trace which model produced given content, satisfying the provenance and accountability requirement. This enables detection of synthetic media and supports audit, misuse investigation and compliance verification across deployed AI systems.

This is correct because a standard converts high-level principles into mandatory, repeatable criteria that business units can apply when evaluating AI vendors. It specifies what evidence suppliers must provide, such as model documentation, security testing, and data handling terms, and where approvals are required. This bridges the gap between board-level principles and operational procurement decisions without requiring the board to define technical criteria.

Privacy risk hinges on knowing what personal data exists, where it flows, and why it is processed. Mapping data lineage, sensitivity classification, and processing purpose exposes lawful-basis gaps, retention issues, and unauthorised secondary use that other AIA domains cannot surface.

The Govern function centres on establishing organisational structures, so defining roles, responsibilities and accountability directly satisfies the stem's governance-framework requirement. This assigns ownership of generative AI outcomes, distinguishing Govern from Map, Measure and Manage, which address context, evaluation and treatment rather than oversight structures.

Ultimate accountability for AI governance rests with the board and executive leadership because they set risk appetite, approve strategy, and are answerable to stakeholders and regulators. While operational responsibility is delegated to management, the governing body cannot delegate its accountability. This aligns with ISACA's principle that AI governance is an extension of enterprise governance, requiring top-level ownership.

An enterprise GRC platform with AI capabilities holds an inventory of AI models and use cases with owners and risk ratings, maps controls to frameworks such as the NIST AI RMF, ISO/IEC 42001 and the EU AI Act, stores assessments and test evidence, tracks issues, and reports to management and auditors, all with access control and audit trails. That single system of record is what centralised oversight requires.

Model drift often occurs when the input data distribution shifts from the training data. Monitoring input data distributions helps detect covariate shift, a common cause of performance degradation. This is a critical element because it provides early warning of drift, allowing the organization to retrain or adjust the model before decisions become unreliable, thereby maintaining supply chain efficiency.

Containment and impact assessment comes first because it limits blast radius and establishes scope before eradication or recovery. Assessing affected models, data and downstream systems lets responders prioritise, preserve forensic evidence and decide whether to roll back or isolate, satisfying the stem's requirement for the initial incident response step.

This directly satisfies the General Counsel's requirement: the charter names the executive body that owns AI outcomes and documents that assignment at board level. Assigning ultimate ownership to a defined executive body is the core of accountability in AI governance and ensures regulatory and legal consequences have a clear owner rather than diffusing across teams.

Pre-deployment design and threat modeling identify AI-specific risks such as data poisoning, model inversion and prompt injection before release, when remediation is cheapest. This manages lifecycle risk at the earliest stage, satisfying the stem's requirement for activities spanning the AI lifecycle.

Data quality for AI training is measured across accuracy, completeness and consistency, since these dimensions jointly determine whether training data faithfully represents the target domain. Tracking them detects bias, missing values and conflicting records that would otherwise degrade model reliability and fairness.

Poisoned training data corrupts the learned parameters themselves, so the model's outputs become unreliable or attacker-influenced. This directly undermines model integrity and reliability, the governance concern the stem asks about, rather than merely exposing data or disrupting availability.

A federated model with accountable subsidiary owners applies central criteria locally while feeding a single enterprise inventory. This preserves local knowledge and speed, ensures consistent risk assessment standards, and gives the central office visibility across all regions. It directly addresses registration, assessment, and monitoring consistency without centralizing every decision.

Continuous monitoring with fairness metrics allows the organization to detect bias as it arises in production. A defined mitigation workflow ensures that when bias is detected, corrective actions are taken promptly. This approach addresses the dynamic nature of bias and provides an ongoing control that aligns with the governance team's objective.

An explicit prohibition on entering confidential, personal, or proprietary data into public generative AI tools directly targets the data leakage risk. It sets a clear boundary that employees can follow and that can be enforced through monitoring and disciplinary measures. This policy element is the most direct because it removes the action that causes exposure in the first place.

Mandatory disclosure that content was generated by AI ensures transparency for consumers and supports accountability obligations under data protection regulations, which require lawful, fair and transparent processing. It also helps prevent deceptive marketing claims about authorship.

The programme builds workforce competence around AI-specific threats such as prompt injection, data leakage and model misuse, so staff recognise and avoid unsafe behaviour. It satisfies the goal of reducing human-originated AI risk through awareness rather than technical controls.

Model validation and testing reports evidence that a model was independently assessed against defined acceptance criteria before deployment, capturing methodology, datasets, results and sign-off. This satisfies the audit trail's need to demonstrate documented, verifiable oversight of model performance and fitness for purpose, rather than relying on unsubstantiated assertions.

Accountability cannot be delegated to the AI system or its developers; the business unit leader owns the deployed system's outcomes and bears responsibility for its risk decisions. This satisfies the stem's demand for ultimate, non-transferable ownership within the deploying unit.

Governance must begin by defining the organisation's fairness and equity metrics, because bias cannot be measured, monitored or mitigated without agreed criteria. These metrics establish the baseline against which datasets, models and outcomes are assessed for disparate impact.

Classifying by potential impact on safety, privacy and business operations ties governance controls to actual risk exposure, so oversight, testing and documentation scale with the harm a system could cause. This risk-based axis drives proportionate treatment across the AI inventory.

Model documentation capturing features, decision logic, and known limitations provides the traceable basis for explaining why the triage tool produced a recommendation. It supports clinician understanding and regulatory review by making the model's behavior inspectable, which directly satisfies the governance committee's explainability requirement.

Post-hoc explanation tools, such as SHAP or LIME, provide insights into which features influenced a specific AI decision. This helps clinicians and patients understand the rationale behind recommendations, fostering trust and enabling informed decisions. It directly addresses explainability, a key ethical principle, by making the AI's reasoning transparent without requiring access to the model's internal workings.

Logging model development and decision-making creates an auditable record, which is the mechanism that satisfies Accountability. It assigns and evidences responsibility for the LLM's behaviour, letting the company trace who decided what and why, rather than merely documenting data lineage or performance metrics.

Standardising workflows for human intervention ensures reviewers receive consistent context, escalation paths and response steps, so oversight is repeatable rather than ad hoc. This directly supports Human-in-the-Loop governance by making intervention a defined, auditable process across AI systems.

A defined AI risk appetite statement with quantified thresholds gives the organization an objective basis for deciding when a risk must be escalated to the board. Without agreed tolerances, escalation becomes subjective and inconsistent. It is the foundational element that makes the escalation mechanism meaningful and actionable for governance bodies.

A governance body with clear decision rights is what turns policy into action: it approves AI use cases, grants exceptions, and oversees adherence. Assigning these rights prevents diffuse ownership and ensures escalations and disputes have a forum empowered to decide, which is essential for consistency across business units.

This directly addresses the failure: the rating was treated as static, so drift and emergent bias went undetected. By defining triggers for re-evaluation and feeding refreshed inherent and residual ratings back into the enterprise register, the committee retains its ranking and budgeting capability while making risk ratings living artifacts rather than one-time deployment snapshots.

Periodic security assessments verify that vendor AI systems maintain robust security posture over time. Penetration testing uncovers vulnerabilities, while reviewing incident response plans ensures the vendor can handle AI-specific breaches. This ongoing scrutiny is critical for managing third-party risk and aligning with the organization's governance standards, as it provides assurance beyond initial onboarding.

Finalising the Model Card at deployment records intended use, known limitations and security parameters, giving governance an auditable artefact before the model serves traffic. This satisfies the stem's requirement for an essential governance activity within the deployment phase.

An AI incident response plan defines the procedures for detecting, reporting, escalating, and remediating AI-related incidents, including offensive language generation. It assigns roles, sets communication protocols, and outlines containment and recovery steps. This artifact ensures consistency and accountability when incidents occur, directly addressing the governance team's need for a standardized approach.

DLP tools inspect outbound content and block or quarantine transfers containing sensitive data, directly interrupting the exfiltration path. Applied to AI pipelines, they enforce policy on prompts, responses and exports, satisfying the data leakage control requirement by preventing unauthorised disclosure rather than merely detecting it afterwards.

Inference latency is a core model performance metric, capturing how quickly the deployed model returns predictions. Monitoring it detects degradation from model drift, resource contention or scaling issues, directly satisfying the stem's requirement to track model performance alongside security indicators.

Ongoing monitoring continuously tracks live model performance and risk metrics after deployment, detecting drift, degradation or emerging threats. This satisfies the stem's requirement for a recurring operational activity rather than one-off validation, which belongs to earlier lifecycle stages.

AI Risk Appetite defines the amount and type of risk an organisation is prepared to accept in pursuit of its AI objectives, directly satisfying the stem's requirement for a definition. It sets tolerance boundaries governing AI development and deployment decisions, distinct from risk capacity or actual exposure, and must align with broader enterprise risk appetite.

Red teaming exercises adversarial techniques against AI systems to surface exploitable weaknesses, prompt-injection paths and unsafe failure modes before real attackers find them. This satisfies the governance objective of proactive risk identification, feeding findings into controls and oversight rather than reacting after an incident.