AI Risk Management

Which of these is a 'Proactive' risk management strategy?

When conducting a risk assessment for an AI system, which TWO of the following are considered 'AI System' components that require individual threat assessment?

An attacker is performing a 'Model Extraction' attack. What is the most likely goal of the attacker?

When establishing a risk management framework for GenAI, which THREE factors should be prioritized to satisfy the NIST AI Risk Management Framework requirements?

You are assessing the risk of 'Data Poisoning'. Which stage of the machine learning lifecycle is most vulnerable to this attack?

Which THREE technical controls are recommended to secure an AI model's API endpoint?

What is 'Model Drift'?

Which risk management activity happens during the 'Design' phase of an AI project?

What is the primary risk associated with 'Overfitting' in an AI model?

Which TWO measures are most effective in reducing the risk of 'Hallucinations' in LLM systems?

Which TWO items must be documented in an 'AI Model Card'?

What is 'AI Red Teaming'?

You are auditing an AI system for 'Model Explainability' (XAI). Why is XAI critical from a risk management perspective?

Which TWO security controls are recommended for protecting 'Training Data'?

What is the primary risk of 'Over-reliance' on AI outputs?

A model is vulnerable to 'Evasion Attacks' using FGSM (Fast Gradient Sign Method). Which architectural change most effectively increases robustness?

What is the purpose of 'AI Model Inventory'?

What is a 'Side-Channel Attack' against an AI model?

When assessing AI third-party vendor risk, which document is most useful for understanding the vendor's data handling practices?

Which THREE technical controls effectively manage 'Third-Party AI Vendor' risks?

Which THREE criteria are essential for evaluating the risk of an AI vendor's 'Model Card'?

You are managing an AI project and notice the model is performing poorly on a subset of data representing a protected class. What is the correct next step in the risk assessment process?

Which TWO of the following are primary risks associated with 'membership inference attacks' against an AI model?

What is 'Model Stealing' as a risk?

Which control is most effective against 'Data Poisoning' in a collaborative learning environment?

What is the purpose of 'AI Model Transparency' in a risk management framework?

Which THREE elements are essential for 'AI Governance'?

You are managing risks for a federated learning deployment. What is the primary security concern regarding the 'model updates' sent from the edge clients to the aggregator?

What is the primary objective of a 'Bias Audit' in an AI risk management program?

You are assessing a supply chain risk where an AI model uses a pre-trained base model from a third-party hub. Which action most effectively mitigates the risk of model poisoning during the integration phase?

When utilizing a third-party AI vendor, which contractual requirement is most critical for addressing 'shadow AI' risks within an enterprise?

Which TWO factors help maintain 'AI Accountability'?

An organization is evaluating 'Third-Party AI Models'. Which risk is most effectively addressed by a 'Model Evaluation Report'?

An organization is using an LLM-based agent. What is the primary risk associated with 'indirect prompt injection' in this environment?

When evaluating an AI model for production, what does the 'F1 Score' tell you from a risk management perspective?

A machine learning model is showing signs of 'data drift'. What is the most effective initial step in the risk assessment process?

Which THREE factors must be included in a 'Model Risk Management' (MRM) policy?

What is the key risk difference between 'Data Privacy' and 'Model Security' in AI?

What is the best way to manage 'Bias' in an AI system?

What is the primary role of a 'Human-in-the-loop' (HITL) in AI risk management?

During an adversarial threat modeling exercise for a facial recognition system, you identify a risk of pixel perturbation attacks. Which countermeasure is the most appropriate technical control to implement?

An organization is performing threat modeling for a RAG (Retrieval-Augmented Generation) pipeline. Which specific vulnerability is unique to the retrieval component?

When assessing the risk of 'Prompt Leaking', what is the most important control to implement?

In an AI supply chain, what is 'Dependency Confusion' risk?

Which TWO techniques help mitigate 'Model Poisoning'?

Which THREE components are critical for an 'AI Incident Response' plan?

What is the primary goal of 'Model Monitoring' in the context of risk management?

Which THREE practices are necessary for managing 'AI Model Version Control' as part of an overall risk management strategy?

A researcher is using 'Adversarial Training' to defend against evasion. How exactly does this work?

What is the primary risk of using 'Pre-trained models' from public hubs without verification?

A developer is implementing 'Differential Privacy' on a training dataset. What is the primary trade-off they are managing?

Which THREE items should be included in an 'AI Vendor Assessment'?

Which THREE technical configurations help mitigate the risk of 'Model Exfiltration'?

Which TWO of the following are considered 'AI Supply Chain' risks?

Which TWO factors contribute to 'Model Obsolescence' risk?

Which THREE steps are needed for 'AI Risk Assessment'?

When dealing with 'Adversarial Evasion', why is the 'black-box' nature of an API a risk?

What is the most effective control to prevent 'Model Scraping' from an exposed AI prediction API?

Which of the following describes 'Model Integrity' risk?

You are implementing 'AI Red Teaming'. What is the most effective way to test against prompt injection?

What is 'AI Shadowing' or 'Shadow AI' in an enterprise setting?

Which of the following best describes 'Model Inversion' as a security risk?