Courseiva

CCNA AI Risk Management Questions

28 of 103 questions · Page 2/2 · AI Risk Management · Answers revealed

Practice these questionsDomain overviewAll questions
76
MCQmedium

When assessing the risk of 'Prompt Leaking', what is the most important control to implement?

A.Increasing the model's parameter count.
B.Encrypting the model output.
C.Strict output filtering and instruction separation.
D.Only allowing access from internal IP addresses.
AnswerC

Strict output filtering and instruction separation directly counter prompt leaking by isolating system instructions from user-supplied content, so injected queries cannot extract the underlying prompt. This satisfies the scenario's core constraint: preventing disclosure of confidential system prompts through crafted inputs, rather than merely detecting leakage after exposure.

Why this answer

Prompt leaking occurs when an attacker extracts the system prompt or confidential instructions embedded in an LLM application. The most effective control is strict output filtering combined with instruction separation — keeping system instructions isolated from user input and filtering responses that would reveal them. This directly addresses the exfiltration channel rather than the model's size, transport, or network location.

Exam trap

AAISM often tests the misconception that infrastructure controls (network restriction, encryption, model size) mitigate prompt leaking, when the effective control must operate on the prompt/response content itself.

How to eliminate wrong answers

Option A is wrong because increasing parameter count does not prevent prompt leakage — larger models can still be induced to reveal system prompts through jailbreaks, and scale is unrelated to instruction confidentiality. Option B is wrong because encrypting model output protects data in transit but the leaked prompt is already in plaintext inside the response before encryption, so the attacker decrypts and reads it. Option D is wrong because restricting access to internal IPs only narrows the attacker population; an insider or compromised internal host can still perform prompt leaking, and it does nothing to stop the extraction technique itself.

Practice this question →
77
MCQhard

In an AI supply chain, what is 'Dependency Confusion' risk?

A.When two models conflict in memory.
B.When a build system pulls a malicious package instead of the intended private one.
C.When the training data is ambiguous.
D.When a developer forgets to update a library.
AnswerB

Dependency confusion exploits package managers that resolve names from public registries before private ones. An attacker publishes a public package matching an internal dependency name, so the build system fetches the malicious version instead of the intended private package.

Why this answer

Dependency confusion is a supply chain attack where a build system resolves a package name from a public repository (e.g., npm, PyPI) instead of the intended private/internal package, because the attacker published a malicious package with the same name and a higher version number. The build pulls the malicious package (B), executing attacker code with the build system's privileges. It exploits the fact that package managers often check public registries first or prefer higher versions regardless of source.

Exam trap

AAISM often tests the misconception that dependency confusion is about outdated libraries or version conflicts — it is specifically an adversarial substitution attack exploiting package name resolution across public and private registries.

How to eliminate wrong answers

Option A is wrong because two models conflicting in memory is a runtime resource contention issue, not a supply chain attack vector. Option C is wrong because ambiguous training data is a data quality problem that affects model accuracy, not a package resolution attack. Option D is wrong because forgetting to update a library is a patch management hygiene issue — it may leave known vulnerabilities unpatched, but it is not dependency confusion, which is an active adversarial technique.

Practice this question →
78
Multi-Selectmedium

Which TWO techniques help mitigate 'Model Poisoning'?

Select 2 answers
A.Data sanitization and filtering of training inputs.
B.Increasing the number of neurons in the model.
C.Using robust statistical aggregation for training data.
D.Moving the model to a public cloud environment.
E.Reducing the number of training epochs.
AnswersA, C

Sanitising and filtering training inputs removes adversarial or corrupted samples before they enter the training pipeline, preventing attackers from embedding malicious patterns into the model. This directly addresses model poisoning by ensuring only trusted, validated data shapes the learned parameters.

Why this answer

Model poisoning occurs when an adversary injects malicious or corrupted samples into the training data to skew the learned parameters, so data sanitization and filtering of training inputs (A) is correct because it detects and removes anomalous, mislabeled, or adversarial records before they influence gradient updates. Robust statistical aggregation for training data (C) is also correct because techniques such as trimmed mean, median, or Krum-style aggregation limit the influence of outlier or poisoned updates, especially in distributed or federated learning. Increasing the number of neurons (B) only changes model capacity and does not address corrupted training inputs, while moving the model to a public cloud (D) may actually expand the attack surface rather than mitigate poisoning.

Reducing the number of training epochs (E) merely shortens training and can even leave the model underfit without preventing poisoned data from being learned.

Exam trap

AAISM often tests whether candidates conflate poisoning (training-time integrity) with evasion or extraction attacks, and whether they mistake model-size or training-duration tweaks for genuine data-integrity defenses.

Practice this question →
79
MCQmedium

An AI risk manager is presenting to the board on the organization's AI risk appetite. The board asks how the organization should handle an AI system that delivers high business value but has a residual risk level that exceeds the stated risk appetite for model accuracy in financial forecasting. Which response BEST reflects ISACA's risk management principles?

A.Suspend the AI system immediately because any residual risk exceeding the stated appetite represents an unacceptable control failure.
B.Present options for risk treatment including additional controls to reduce residual risk, a time-bound exception with compensating controls, or suspension of the system, and document the board's decision.
C.Revise the risk appetite statement to accommodate the AI system's residual risk level so the system remains compliant with policy.
D.Accept the residual risk because the business value outweighs the risk and the board has ultimate authority to approve exceptions.
AnswerB

This reflects ISACA's core principle that risk treatment options must be presented to decision makers with full information. The risk manager's role is to quantify the gap, propose mitigation alternatives, and ensure the decision is documented. A time-bound exception with compensating controls keeps the system operational while remediation proceeds, and board documentation creates accountability.

Why this answer

ISACA's risk management principles require the risk manager to present decision makers with a full range of treatment options and ensure the chosen path is documented. When residual risk exceeds appetite but business value is high, the appropriate response is a managed exception with compensating controls and a remediation timeline, approved and recorded at the appropriate governance level. This preserves both accountability and business continuity.

Exam trap

The trap here is choosing between unconditional acceptance and outright suspension, when the correct approach is a structured, documented exception with compensating controls and a remediation plan.

Practice this question →
80
Multi-Selecthard

Which THREE components are critical for an 'AI Incident Response' plan?

Select 3 answers
A.Communication channels with data scientists and legal teams.
B.Requirements to publish all internal vulnerabilities publicly.
C.Procedures for model rollback or disablement.
D.Identification of model-specific failure indicators.
E.Automated deletion of all logs.
AnswersA, C, D

AI incidents demand coordinated escalation between technical responders who understand model behaviour and legal teams assessing liability, disclosure and regulatory duties. Naming both as critical components satisfies the stem's requirement for cross-functional communication channels, since data scientists diagnose model failures while legal teams govern breach notification and compliance obligations.

Why this answer

Option A is correct because an AI incident response plan must define communication channels that bring together data scientists (who understand model behavior and can diagnose failures) and legal teams (who handle regulatory, liability, and disclosure obligations), ensuring coordinated and compliant escalation. Option C is correct because procedures for model rollback or disablement are essential to quickly contain harm by reverting to a prior known-good model version or taking the model offline when it misbehaves. Option D is correct because identifying model-specific failure indicators — such as data drift, adversarial inputs, bias spikes, or anomalous confidence scores — enables early detection and triage of AI incidents that differ from traditional IT failures.

Option B does not belong because publishing all internal vulnerabilities publicly is not a standard incident response requirement and could increase risk and violate disclosure norms. Option E does not belong because automated deletion of all logs destroys the forensic evidence needed for incident investigation, root-cause analysis, and compliance reporting.

Exam trap

AAISM often tests whether candidates recognize that incident response requires evidence preservation and cross-functional coordination, so distractors like 'delete all logs' or 'publish all vulnerabilities' are inserted to catch those who confuse containment with destruction of evidence.

Practice this question →
81
MCQmedium

What is the primary goal of 'Model Monitoring' in the context of risk management?

A.To reduce the cost of GPU usage.
B.To block all internet traffic.
C.To update the marketing website automatically.
D.To detect performance degradation, drift, and anomalous behavior.
AnswerD

Model Monitoring continuously tracks live inference data against training baselines, surfacing data drift, concept drift, performance decay and anomalous inputs. This satisfies the stem's risk-management goal by providing early warning of degrading model behaviour, enabling timely retraining, rollback or escalation before business impact accumulates.

Why this answer

Model Monitoring in AI risk management exists to continuously observe a deployed model's inputs, outputs, and statistical behavior so that degradation (accuracy loss), data/concept drift, and anomalous activity are detected early. Because models decay as real-world data diverges from training data, monitoring is the control that surfaces these failures before they cause business or safety harm. Detection of these three failure modes is the core purpose, not cost or infrastructure management.

Exam trap

AAISM often tests whether candidates confuse model monitoring (behavioral/drift detection) with infrastructure monitoring or cost management, so distractors describe operational or financial tasks rather than model-performance observation.

How to eliminate wrong answers

Option A is wrong because GPU cost optimization is a FinOps concern handled by infrastructure tooling, not the objective of model monitoring. Option B is wrong because blocking internet traffic is a network security control unrelated to model behavior observation. Option C is wrong because updating a marketing website is a content deployment task with no connection to model performance or drift detection.

Practice this question →
82
Multi-Selectmedium

A hospital is deploying an AI triage system that recommends patient priority levels. The risk committee wants to ensure ongoing risk visibility after go-live. Which TWO activities provide continuous risk visibility for this deployed system? (Choose two.)

Select 2 answers
A.Documenting the model architecture and hyperparameters in the model registry.
B.Conducting a one-time fairness audit before the system goes live.
C.Monitoring model input distribution drift against the training baseline.
D.Reviewing the model's original validation accuracy report from the pre-deployment assessment.
E.Tracking clinician override rates and the reasons clinicians disagree with AI recommendations.
AnswersC, E

Input distribution drift monitoring detects when live patient data diverges from the training distribution, which can degrade model performance and introduce new clinical risks. This provides continuous, ongoing visibility into a key risk driver after deployment, making it a core post-deployment risk management activity for the triage system.

Why this answer

Continuous risk visibility after deployment requires monitoring activities that generate ongoing signals. Input distribution drift monitoring detects when live data diverges from training conditions, and tracking clinician override rates captures real-world disagreement that may indicate model errors or edge cases. Static artifacts such as validation reports, one-time audits, and architecture documentation do not provide continuous visibility.

Exam trap

The trap here is treating static documentation or one-time audits as continuous risk monitoring, when continuous visibility requires ongoing data collection and analysis after deployment.

Practice this question →
83
Multi-Selecthard

Which THREE practices are necessary for managing 'AI Model Version Control' as part of an overall risk management strategy?

Select 3 answers
A.Allowing only one developer to modify the model.
B.Using Git-based tracking for model configuration and code.
C.Maintaining a complete lineage of training data used for each version.
D.Storing only the production model artifact.
E.Automated logging of training parameters and hyperparameters.
AnswersB, C, E

Git-based tracking captures every change to model configuration and training code, giving an auditable revision history. This satisfies the risk-management requirement for traceable, reproducible model versions, enabling rollback and forensic review when a deployed model drifts or misbehaves.

Why this answer

Option B is correct because Git-based tracking provides immutable, auditable version history for model code, configuration files, and pipeline definitions, which is essential for reproducibility and rollback in a risk management strategy. Option C is correct because maintaining a complete lineage of training data for each model version enables traceability, bias investigation, and compliance auditing, ensuring you can reproduce and justify any deployed model. Option E is correct because automated logging of training parameters and hyperparameters (e.g., learning rate, batch size, epochs, random seeds) captures the exact conditions under which each version was produced, which is necessary for reproducibility and drift analysis.

Option A is not appropriate because restricting modification to a single developer creates a single point of failure and removes peer review, weakening governance rather than strengthening version control. Option D is not appropriate because storing only the production model artifact discards prior versions, training metadata, and lineage, making rollback, auditing, and root-cause analysis impossible.

Exam trap

AAISM often tests the misconception that saving the production model artifact alone constitutes version control, when reproducibility actually requires code, data lineage, and parameter history together.

Practice this question →
84
MCQeasy

A retail company's AI-powered recommendation engine begins suggesting products that are culturally insensitive in certain regions. The model has not been changed, but sales data from a newly acquired subsidiary was recently added to its training pipeline. Which risk management principle does this scenario BEST illustrate?

A.Model drift caused by changes in the data supply chain can introduce new ethical and reputational risks.
B.Acquiring a subsidiary always requires retraining all enterprise AI models from scratch.
C.Recommendation engines are inherently unbiased and only reflect objective customer preferences.
D.Ethical risks in AI are only relevant during the initial design phase and not after deployment.
AnswerA

Adding data from a newly acquired subsidiary changed the training data distribution without changing the model code, producing culturally insensitive recommendations. This illustrates how data supply chain changes cause model drift that introduces new ethical and reputational risks, requiring risk management to monitor data provenance and pipeline changes.

Why this answer

The scenario shows that integrating new data from an acquisition altered the recommendation engine's behavior, producing culturally insensitive outputs without any model code change. This is a data supply chain induced drift that creates ethical and reputational risk, underscoring the need to govern data provenance and monitor model behavior after data pipeline changes.

Exam trap

The trap here is assuming that because the model code did not change, the model's risk profile also did not change, overlooking how new training data can alter behavior.

Practice this question →
85
MCQmedium

A global bank deploys a generative AI assistant that drafts personalized wealth-management emails using the bank's proprietary product catalogue and live client portfolio data. The AI risk manager must classify the assistant's risk tier before go-live. The assistant can only read data, never execute trades, and all drafts require advisor approval before sending. Which classification approach BEST aligns with an AI risk management framework?

A.Classify as low risk because the human advisor approval step fully eliminates any residual risk from the AI output.
B.Classify as minimal risk because the assistant is read-only and therefore cannot directly modify any production systems or client accounts.
C.Classify based on the potential impact of the assistant's output and the sensitivity of the data it processes, not solely on its lack of write access.
D.Classify as high risk automatically because any use of generative AI in a regulated financial institution must be treated as high risk by default.
AnswerC

Risk tiering should reflect both data sensitivity and the severity of harm if the output is wrong or leaked. Live client portfolio data is confidential, and inaccurate personalized advice can cause financial and regulatory harm even without trade execution. Impact-based classification captures these dimensions, whereas technical capability alone understates the risk.

Why this answer

Risk classification should be driven by the potential impact of the AI output and the sensitivity of the data involved. The assistant processes live client portfolio data and generates regulated financial content, so confidentiality and accuracy risks persist even with advisor review. Technical capabilities like read-only access are relevant inputs but insufficient on their own, and blanket high-risk labelling ignores proportionality.

Exam trap

The trap here is assuming that human review or read-only access alone eliminates risk, when classification must reflect data sensitivity and potential impact of the output.

Practice this question →
86
MCQhard

A researcher is using 'Adversarial Training' to defend against evasion. How exactly does this work?

A.It uses a secondary model to detect malicious input.
B.It restricts input to a whitelist of authorized users.
C.It trains the model on adversarial examples alongside clean data.
D.It adds noise to the weights of the model.
AnswerC

Adversarial training augments the training set with perturbed inputs labelled with their true classes, so the model learns decision boundaries robust to evasion perturbations. This directly reduces the attacker's ability to craft inputs that flip predictions.

Why this answer

Adversarial training is a defense technique where the model is trained on a dataset that includes both clean examples and adversarial examples—inputs intentionally perturbed to fool the model. By learning from these adversarial examples, the model becomes more robust and can correctly classify them, thereby improving its resistance to evasion attacks.

Exam trap

The trap is confusing adversarial training with other defenses like input validation, secondary detection models, or weight noise; adversarial training specifically augments the training data with adversarial examples.

How to eliminate wrong answers

Option A is wrong because using a secondary model to detect malicious input is a detection-based defense, not adversarial training. Option B is wrong because restricting input to a whitelist of authorized users is an access control measure, not a training technique. Option D is wrong because adding noise to weights is a regularization technique (e.g., weight noise) that may improve generalization but is not adversarial training.

Practice this question →
87
MCQmedium

What is the primary risk of using 'Pre-trained models' from public hubs without verification?

A.The model will not support Python.
B.The model may contain backdoors or malicious code.
C.The model will be too small.
D.The model will not have a web interface.
AnswerB

Public hub artefacts are opaque binaries, so a poisoned checkpoint or serialised payload can embed a backdoor or execute malicious code when loaded. Without verification of provenance and integrity, that hidden behaviour is inherited by any system deploying the model.

Why this answer

Pre-trained models downloaded from public hubs (e.g., Hugging Face, TensorFlow Hub) are serialized artifacts that may execute arbitrary code on load — Python pickle files, custom layers, or Lambda layers can embed malicious payloads. Without verification (checksums, signatures, model cards, or scanning), an attacker who uploaded a poisoned model can achieve code execution or implant a backdoor that triggers on specific inputs. This is the primary supply-chain risk of consuming untrusted model artifacts.

Exam trap

AAISM often tests the assumption that 'open-source' or 'public hub' implies 'safe' — candidates overlook that model artifacts are executable code, not passive data, and pick a functional limitation instead of the supply-chain security risk.

How to eliminate wrong answers

Option A is wrong because framework support (Python, PyTorch, TensorFlow) is unrelated to the security risk of unverified downloads — a model can support Python and still be malicious. Option C is wrong because model size is a performance/capability concern, not a security risk; small models are not inherently dangerous. Option D is wrong because a web interface is an application-layer concern, not a property of the model artifact itself, and its absence poses no security threat.

Practice this question →
88
MCQmedium

A developer is implementing 'Differential Privacy' on a training dataset. What is the primary trade-off they are managing?

A.Privacy budget (epsilon) vs. model utility/accuracy.
B.Model training speed vs. model cost.
C.Security of the training pipeline vs. developer productivity.
D.Deployment latency vs. model scalability.
AnswerA

Epsilon quantifies the privacy budget: lower values add more noise, strengthening indistinguishability but degrading model accuracy. Raising epsilon improves utility while weakening the privacy guarantee. The developer must therefore balance how much privacy loss is acceptable against the predictive performance the model must retain.

Why this answer

Differential privacy works by injecting calibrated noise into computations so that any single individual's data has a bounded influence on the output. The privacy budget, epsilon (ε), controls how much noise is added: smaller epsilon means stronger privacy but lower model utility/accuracy. The developer's primary trade-off is therefore between the privacy budget and model utility (A).

Exam trap

AAISM often tests whether candidates understand that differential privacy's core trade-off is mathematical (privacy budget vs. utility), not operational (speed, cost, latency, or pipeline security).

How to eliminate wrong answers

Option B is wrong because training speed versus cost is an infrastructure/economic trade-off unrelated to differential privacy's core mechanism. Option C is wrong because pipeline security versus developer productivity is an operational concern, not the mathematical trade-off differential privacy introduces. Option D is wrong because deployment latency versus scalability is a serving-time performance consideration, whereas differential privacy operates during training or query time on the data, not on inference latency.

Practice this question →
89
Multi-Selectmedium

Which THREE items should be included in an 'AI Vendor Assessment'?

Select 3 answers
A.Review of the model transparency/model card documentation.
B.The personal home addresses of all employees.
C.Assessment of the vendor's AI risk framework.
D.Evidence of secure development practices.
E.The vendor's entire source code repository.
AnswersA, C, D

Model cards document a model's intended use, training data, performance metrics and known limitations. Reviewing them during vendor assessment verifies the transparency and disclosure the stem demands, exposing bias, provenance and evaluation gaps before procurement, rather than relying solely on the vendor's marketing claims.

Why this answer

A is correct because reviewing model transparency and model card documentation lets the assessor verify what data, limitations, intended use, and performance characteristics the AI model has, which is essential for informed third-party risk decisions. C is correct because evaluating the vendor's AI risk framework shows whether they govern AI risks through policies, controls, monitoring, and accountability aligned to standards such as NIST AI RMF or ISO/IEC 42001. D is correct because evidence of secure development practices, such as SDLC controls, code review, testing, and vulnerability management, demonstrates that the AI system is built and maintained securely.

B is not appropriate because employees' personal home addresses are private personal data irrelevant to assessing an AI vendor's risk posture. E is not appropriate because requiring the vendor's entire source code repository is excessive, impractical, and not a standard assessment item; source code may be proprietary and is typically reviewed only under specific escrow or audit arrangements.

Exam trap

The trap is selecting options that are either privacy-invasive (home addresses) or commercially unrealistic (full source code) — candidates must focus on documentation, risk frameworks, and secure development evidence as the appropriate assessment artifacts.

Practice this question →
90
Multi-Selecthard

Which THREE technical configurations help mitigate the risk of 'Model Exfiltration'?

Select 3 answers
A.Increasing the number of public endpoints.
B.Strict IAM policies limiting access to the model weight files.
C.API response truncation or fuzzing to hide internal weights.
D.Egress traffic filtering from the model inference environment.
E.Using clear text for all model logs.
AnswersB, C, D

Model weights are the exfiltration target, so restricting who can read those files removes the primary attack path. Strict IAM policies on the weight storage enforce least privilege, preventing unauthorised principals from copying or downloading the model artefacts directly.

Why this answer

Option B is correct because strict IAM policies that limit access to model weight files enforce least-privilege authorization, preventing unauthorized principals from reading or copying the stored weights that constitute the model itself. Option C is correct because API response truncation or fuzzing reduces the information returned by inference endpoints, making it harder for an attacker to reconstruct or extract internal weights through repeated querying (a model-stealing/extraction attack). Option D is correct because egress traffic filtering from the model inference environment blocks outbound connections, stopping an attacker or compromised workload from exfiltrating model artifacts or weights to external destinations.

Option A is not correct because increasing the number of public endpoints expands the attack surface and makes exfiltration easier, not harder. Option E is not correct because clear-text logging of model data exposes sensitive information and increases the risk of leakage rather than mitigating exfiltration.

Exam trap

AAISM often tests the misconception that adding public endpoints or logging in clear text improves security, when in fact they increase exfiltration risk; candidates must select the three controls that genuinely restrict access, obscure outputs, and block egress.

Practice this question →
91
MCQmedium

A financial services firm uses a third-party large language model (LLM) API to summarize internal audit reports. The CISO is concerned that confidential report content could be retained by the provider and later resurface in responses to other customers. Which risk management action BEST addresses this specific concern?

A.Deploy a data loss prevention (DLP) solution that blocks any audit report content from leaving the corporate network.
B.Fine-tune an open-source LLM on the audit reports and host it entirely on-premises.
C.Require the provider to contractually commit to zero data retention and verify this through their SOC 2 Type II report and data processing addendum.
D.Implement prompt injection filtering on all outbound requests to the LLM API.
AnswerC

Zero data retention commitments, verified through independent audit reports and a binding data processing addendum, directly address the risk that confidential content is stored and reused. This is the only option that targets the specific retention-and-resurfacing concern with enforceable, verifiable controls rather than technical or procedural mitigations aimed at different risks.

Why this answer

The core risk is that a third-party LLM provider may retain confidential audit content and expose it to other tenants. A contractual zero-retention commitment, backed by independent audit evidence and a data processing addendum, creates enforceable, verifiable assurance. Technical controls like prompt filtering or DLP address different threat vectors and would not prevent provider-side retention or cross-tenant leakage.

Exam trap

The trap here is assuming that technical controls such as DLP or prompt filtering address third-party data retention risk, when the actual exposure is contractual and provider-side.

Practice this question →
92
Multi-Selectmedium

Which TWO of the following are considered 'AI Supply Chain' risks?

Select 2 answers
A.Inclusion of poisoned data in third-party datasets.
B.Vulnerabilities in pre-trained model weights from model hubs.
C.Lack of internal developer training.
D.Excessive use of cloud storage.
E.High turnover of AI research staff.
AnswersA, B

Poisoned data in third-party datasets is an AI supply chain risk because it compromises training inputs sourced externally, before the model reaches your control. This satisfies the stem's supply chain constraint: the threat originates from an upstream vendor's data, not from your own model, deployment or inference environment.

Why this answer

Option A is correct because AI supply chain risk explicitly covers the ingestion of third-party datasets that may contain poisoned or tampered training data, which can corrupt model behavior or implant backdoors. Option B is correct because pre-trained model weights downloaded from model hubs are external artifacts that can carry hidden vulnerabilities, backdoors, or malicious code, making them a core supply chain risk. Options C, D, and E are not AI supply chain risks: lack of developer training is an internal skills/awareness issue, excessive cloud storage is a resource-management concern, and high staff turnover is a human-resources/continuity issue, none of which involve compromised external components or data flowing into the AI system.

Exam trap

AAISM often tests whether candidates distinguish supply chain risks (external data, model, or tooling dependencies) from internal organizational risks like staffing, training, or cloud cost management.

Practice this question →
93
MCQmedium

A healthcare organization is deploying a generative AI chatbot that provides medical information to patients. The AI security manager is concerned about the risk of the chatbot generating harmful or misleading medical advice. Which control is MOST appropriate to mitigate this risk before deployment?

A.Require all chatbot responses to be reviewed and approved by a licensed physician before being sent to the patient.
B.Implement a content filter that blocks any response containing medical terminology not approved by the organization's clinical team.
C.Fine-tune the generative model on a curated dataset of clinically validated medical information and implement a guardrail that restricts responses to that knowledge base.
D.Deploy the chatbot in a limited pilot with a disclaimer that the information is not medical advice and monitor user feedback for harmful outputs.
AnswerC

Fine-tuning on validated clinical data improves accuracy, and a retrieval-augmented generation (RAG) guardrail that restricts responses to a trusted knowledge base prevents the model from hallucinating or generating unsupported advice. This directly mitigates the risk of harmful or misleading output by grounding responses in verified medical information. It is the most appropriate pre-deployment control.

Why this answer

In healthcare, generative AI must be grounded in validated knowledge to prevent harmful hallucinations. Fine-tuning on curated clinical data combined with a retrieval guardrail that limits responses to that data ensures the chatbot provides accurate, safe information. Content filtering, disclaimers, or full human review are either ineffective, insufficient, or impractical for this use case.

Exam trap

The trap here is relying on disclaimers or human review as primary controls, when the most effective mitigation is to ground the model's outputs in a validated knowledge base through fine-tuning and retrieval guardrails.

Practice this question →
94
Multi-Selectmedium

Which TWO factors contribute to 'Model Obsolescence' risk?

Select 2 answers
A.Availability of superior, more efficient alternatives.
B.The model has reached its maximum iteration count.
C.Significant changes in production data distribution.
D.The training data was encrypted.
E.The model is stored on a local server.
AnswersA, C

Superior, more efficient alternatives directly drive model obsolescence by rendering the deployed model uncompetitive on accuracy, latency or cost. This satisfies the stem's focus on obsolescence risk: newer architectures or training approaches can outperform the existing model, forcing replacement before its planned lifecycle ends.

Why this answer

Model obsolescence risk arises when a deployed model no longer delivers optimal value relative to what is available or what the environment demands. Option A is correct because the emergence of superior, more efficient alternatives (e.g., newer architectures, better-performing pretrained models, or more cost-effective algorithms) can render an existing model outdated even if it still functions correctly. Option C is correct because significant changes in production data distribution — known as data drift or concept drift — cause the model's learned patterns to no longer match real-world inputs, degrading performance and effectively making the model obsolete for its original purpose.

Option B is incorrect because reaching a maximum iteration count is a training hyperparameter/stopping condition, not a cause of obsolescence; the model simply stops training. Option D is incorrect because encrypting training data is a security measure and has no bearing on whether a model becomes obsolete. Option E is incorrect because storing a model on a local server is a deployment/hosting choice and does not by itself contribute to obsolescence risk.

Exam trap

The trap here is conflating training-time stopping conditions (iteration limits) or infrastructure choices (local storage, encryption) with lifecycle obsolescence risk — candidates must recognize that obsolescence is driven by external alternatives and data distribution shifts, not by how or where the model was trained or stored.

Practice this question →
95
Multi-Selectmedium

Which THREE steps are needed for 'AI Risk Assessment'?

Select 3 answers
A.Perform a threat modeling exercise.
B.Publish the risk assessment on the public internet.
C.Inventory the AI systems.
D.Evaluate the risk impact and likelihood.
E.Train a new model to verify the findings.
AnswersA, C, D

Threat modelling systematically identifies how an AI system could be attacked or misused, exposing adversarial, data-poisoning and model-theft scenarios. It is a core AI risk assessment step because it surfaces threats before controls are selected and residual risk is accepted.

Why this answer

An AI risk assessment must begin with discovery, so option C (Inventory the AI systems) is correct because you cannot assess risks for AI assets you have not identified, including models, datasets, and their owners. Option A (Perform a threat modeling exercise) is correct because threat modeling systematically identifies threats, attack vectors, and vulnerabilities specific to each AI system, such as data poisoning, model evasion, or prompt injection. Option D (Evaluate the risk impact and likelihood) is correct because risk assessment requires scoring each identified risk by its potential impact and probability to prioritize mitigation.

Option B is not part of the assessment process; publishing results on the public internet would expose sensitive system details and is not a required step. Option E is unnecessary because training a new model is a development activity, not a validation method for an AI risk assessment.

Exam trap

AAISM often tests the misconception that risk assessment is a purely technical exercise, luring candidates toward options about model training or public disclosure instead of the governance triad of inventory, threat modeling, and impact/likelihood scoring.

Practice this question →
96
MCQhard

When dealing with 'Adversarial Evasion', why is the 'black-box' nature of an API a risk?

A.Because it allows attackers to build surrogate models via iterative querying.
B.Because it makes the model impossible to update.
C.Because it prevents log auditing.
D.Because it forces the use of HTTPS.
AnswerA

Attackers lacking gradient or architecture access can still query the API repeatedly, observing input-output pairs to train a surrogate model that approximates the target. That substitute then generates transferable adversarial examples, so black-box opacity does not prevent evasion.

Why this answer

A black-box API exposes only inputs and outputs, so an attacker can iteratively query it to train a surrogate model that approximates the target's decision boundary. This surrogate then enables transferable adversarial examples — inputs crafted on the substitute that also fool the original model. The opacity that protects the model's internals simultaneously provides the query access needed for model extraction and evasion.

Exam trap

AAISM often tests whether candidates understand that black-box access is a query-based attack surface, not a security guarantee — the trap is choosing answers about model updates, logging, or transport security instead of recognizing surrogate-model construction via iterative querying.

How to eliminate wrong answers

Option B is wrong because black-box access does not prevent model updates — the provider can retrain or patch the model at any time; the risk is evasion, not immutability. Option C is wrong because black-box APIs typically log every query, and logging is often more robust than in white-box deployments; the issue is not auditing. Option D is wrong because HTTPS is a transport security control that protects data in transit and is orthogonal to adversarial evasion — it does not address model behavior.

Practice this question →
97
MCQmedium

What is the most effective control to prevent 'Model Scraping' from an exposed AI prediction API?

A.Require users to sign a Terms of Service agreement.
B.Implement tiered access and rate limiting.
C.Increase the complexity of the model.
D.Use an obfuscated model file name.
AnswerB

Tiered access restricts who may query the API, while rate limiting caps query volume per identity, starving the automated harvesting that model scraping depends on. Together they directly constrain the extraction channel, satisfying the stem's demand for prevention rather than detection.

Why this answer

Model scraping involves repeatedly querying a prediction API to reconstruct the model's behavior or extract training data. Tiered access combined with rate limiting is the most effective control because it constrains query volume per identity and gates higher-volume access behind stricter authorization, making large-scale extraction economically and technically infeasible. This directly targets the scraping mechanism rather than relying on legal or cosmetic deterrents.

Exam trap

The trap here is that candidates gravitate toward legal (ToS) or obscurity-based (obfuscated filename) answers because they sound like controls, but the exam expects recognition that only technical volume controls like tiered access and rate limiting actually prevent scraping.

How to eliminate wrong answers

Option A is wrong because a Terms of Service agreement is a legal deterrent with no technical enforcement — attackers scraping a model are not deterred by contractual language, and enforcement requires costly litigation after the damage is done. Option C is wrong because increasing model complexity does not prevent scraping and may actually increase the value of extraction to attackers; complexity is unrelated to query-volume controls. Option D is wrong because obfuscating the model file name is security through obscurity — attackers interact with the API endpoint, not the file name, so this provides no protection against scraping.

Practice this question →
98
MCQmedium

Which of the following describes 'Model Integrity' risk?

A.The risk that the model will be too slow.
B.The risk of data being leaked during training.
C.The risk of the model weights being maliciously modified.
D.The risk that users will stop using the app.
AnswerC

Model integrity risk concerns unauthorised tampering with trained parameters, where attackers alter weights to change predictions or embed backdoors. This differs from data poisoning, which corrupts training inputs, and from availability risks affecting model uptime.

Why this answer

Model integrity risk is the risk that the model's weights, architecture, or artifacts are tampered with — whether through supply-chain compromise, insider threat, or malicious fine-tuning — so the model behaves differently than intended. This is distinct from data leakage, performance, or adoption risks.

Exam trap

AAISM often tests whether candidates can separate integrity (unauthorized modification of the model) from confidentiality (data leakage) and availability/performance (slowness) — the trap is picking a related-sounding risk that belongs to a different CIA triad category.

How to eliminate wrong answers

Option A is wrong because slowness is a performance/latency concern, not an integrity concern — it does not involve unauthorized modification of the model. Option B is wrong because data leakage during training is a confidentiality/privacy risk, not an integrity risk; the model may be intact but the data was exposed. Option D is wrong because users abandoning the app is an adoption/business risk, unrelated to the model's integrity.

Practice this question →
99
MCQhard

A global insurer uses an AI model to flag potentially fraudulent claims. Six months after deployment, claim volume patterns shift substantially because of a regional economic downturn, and the model's false-positive rate rises sharply. The risk team must respond in a way that reflects sound AI risk management. Which action is MOST appropriate?

A.Retire the model permanently and revert to fully manual claim review until a replacement is validated.
B.Suppress reporting of the increased false-positive rate until the next scheduled annual model validation to avoid disrupting operations.
C.Leave the model unchanged and rely on the existing appeals process to correct any erroneous fraud flags after claimants complain.
D.Trigger the model's drift response plan: reassess performance by segment, adjust thresholds or retrain, and strengthen human review for affected claims.
AnswerD

A sharp rise in false positives after a population shift is the classic signal that a pre-defined drift response should activate. Reassessing segment-level performance locates where the model degrades, threshold adjustment or retraining restores accuracy, and heightened human review protects claimants in the interim. This treats the finding as a managed risk event with defined steps rather than a surprise.

Why this answer

The scenario describes concept or data drift caused by an external economic shift, evidenced by a sharp increase in false positives. Sound AI risk management calls for activating the pre-defined drift response: reassess performance by segment, adjust thresholds or retrain, and increase human review for affected claims while remediation proceeds. This protects claimants, restores model performance, and keeps the response within a governed, documented process rather than an improvised or deferred one.

Exam trap

The trap here is treating a detected performance degradation as either a reason to abandon the model entirely or a matter that can wait for the next scheduled validation cycle.

Practice this question →
100
MCQmedium

You are implementing 'AI Red Teaming'. What is the most effective way to test against prompt injection?

A.Check for compliance with data privacy laws.
B.Review the training data logs for errors.
C.Scan the code repository for hardcoded secrets.
D.Execute a series of iterative adversarial prompt attempts against the production model.
AnswerD

Iterative adversarial prompting directly exercises the model's instruction-following boundary, satisfying the stem's requirement to test prompt injection specifically. Unlike static checklists or code review, repeated attempts probe how the model handles conflicting instructions and embedded malicious content, revealing exploitable weaknesses in its input handling.

Why this answer

Executing iterative adversarial prompt attempts against the production model is the most effective way to test for prompt injection because it directly exercises the attack surface — the model's input handling — under real conditions. Prompt injection is an input-layer vulnerability, so the only reliable test is to attempt injections and observe whether the model follows injected instructions, leaks system prompts, or bypasses guardrails. Iterative testing (red teaming) allows testers to refine payloads based on model responses.

Exam trap

AAISM often tests the difference between AI-specific adversarial testing and traditional security testing — candidates pick code scanning or privacy compliance because they sound like 'security,' but prompt injection requires runtime adversarial prompts against the model itself.

How to eliminate wrong answers

Option A is wrong because checking compliance with data privacy laws is a governance/legal review, not a technical test of prompt injection — it does not exercise the model's input handling. Option B is wrong because reviewing training data logs looks for data quality or poisoning issues, not runtime prompt injection, which occurs at inference time regardless of training data. Option C is wrong because scanning the code repository for hardcoded secrets is a static application security test (SAST) that finds credentials in source code, not a test of how the model responds to malicious prompts.

Practice this question →
101
MCQeasy

What is 'AI Shadowing' or 'Shadow AI' in an enterprise setting?

A.The practice of monitoring AI usage in real-time.
B.Employees using unapproved AI tools for work tasks.
C.The process of testing models before release.
D.The use of AI for internal cybersecurity tasks only.
AnswerB

Shadow AI describes staff adopting unsanctioned generative or analytical AI services for work, bypassing IT review. Data leaves governed boundaries without DLP, logging or vendor assessment, creating confidentiality, compliance and IP exposure that security teams cannot monitor.

Why this answer

Shadow AI refers to employees using unapproved AI tools — such as public LLM chatbots, browser extensions, or SaaS AI features — for work tasks without IT or security oversight. This creates data leakage, compliance, and intellectual property risks because sensitive information may be sent to third-party services outside the organization's governance.

Exam trap

AAISM often tests whether candidates confuse shadow AI (unauthorized employee use of AI tools) with legitimate AI governance activities like monitoring, testing, or sanctioned security use.

How to eliminate wrong answers

Option A is wrong because real-time monitoring of AI usage is a detection/governance control, not the definition of shadow AI. Option C is wrong because testing models before release is a standard MLOps validation activity, unrelated to unauthorized use. Option D is wrong because using AI for internal cybersecurity tasks is a legitimate, sanctioned use case, not shadow AI, unless those tools are themselves unapproved.

Practice this question →
102
MCQmedium

A security analyst is reviewing the risk register for a deployed credit-scoring AI model and notices that the 'Model Drift' risk entry has no owner and no monitoring threshold. The model currently performs well on the original validation set. What is the MOST appropriate action for the analyst to take?

A.Assign an accountable risk owner, define drift monitoring thresholds and triggers, and establish a documented response process.
B.Immediately decommission the model and replace it with a rules-based scoring system to eliminate drift risk entirely.
C.Document the drift risk in the register as accepted, noting that the model's current accuracy exceeds the business requirement.
D.Wait until the next scheduled annual model retraining to reassess drift, since the model currently meets performance targets.
AnswerA

The core failure is a risk with no owner, no threshold, and no response plan, which violates basic risk treatment principles. Assigning an accountable owner, defining quantified drift thresholds with alerting triggers, and documenting a response process converts an unmanaged risk into a governed, measurable control loop that can be audited and improved.

Why this answer

An unowned, threshold-less drift risk in a credit-scoring model is an unmanaged risk, not an accepted one. Effective AI risk management requires an accountable owner, quantified monitoring thresholds with alerting, and a documented response process, which together turn a latent risk into a governed control. Deferring, decommissioning, or passively accepting the risk all fail to establish the governance the scenario demands.

Exam trap

The trap here is assuming that strong performance on the original validation set means drift is not a live risk, when drift is precisely about divergence between training and production data over time.

Practice this question →
103
MCQeasy

Which of the following best describes 'Model Inversion' as a security risk?

A.The model is overwritten with malicious logic.
B.The model becomes unavailable to users.
C.The model predicts the wrong output due to noisy inputs.
D.An attacker probes the model to reconstruct training samples.
AnswerD

Model inversion exploits prediction outputs to infer sensitive training data, letting an attacker reconstruct representative samples or attributes. This differs from membership inference, which only determines whether a record was used, satisfying the requirement to describe inversion as a confidentiality risk.

Why this answer

Model Inversion is a privacy attack in which an adversary repeatedly queries a deployed model and analyzes the input-output relationship to reverse-engineer sensitive details of the training data, potentially reconstructing representative samples or inferring attributes of individuals in the training set. It exploits the fact that ML models memorize statistical patterns (and sometimes specific records) from their training data, leaking that information through predictions and confidence scores.

Exam trap

The trap here is confusing privacy attacks (inversion, membership inference, extraction) with integrity or availability attacks (poisoning, evasion, DoS); candidates often pick 'overwritten with malicious logic' because it sounds like a security breach.

How to eliminate wrong answers

Option A is wrong because overwriting a model with malicious logic describes a model poisoning or model tampering attack, not inversion. Option B is wrong because making a model unavailable to users describes a denial-of-service or availability attack, which is unrelated to extracting training data. Option C is wrong because predicting wrong outputs from noisy inputs describes adversarial example or input perturbation attacks that degrade accuracy, not a privacy breach that reconstructs training samples.

Practice this question →
← PreviousPage 2 of 2 · 103 questions total

Ready to test yourself?

Try a timed practice session using only AI Risk Management questions.

Start 20-question session