Identify and Manage the Risks Associated with Emerging Technologies, Such as AI. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A financial services firm has completed a risk assessment for a new AI chatbot that handles customer inquiries. The assessment identified a moderate risk of the chatbot providing incorrect financial advice. The CISO wants to ensure this risk is included in the enterprise risk register. What is the most effective way to integrate this emerging technology risk?

   • AAdd the AI chatbot risk to the existing risk register with the same likelihood and impact scoring used for other systems.
   • BCreate a separate, standalone AI risk register managed only by the data science team.
   • CReport the risk only to the legal department for compliance review.
   • DWait until the chatbot is in production and incidents occur before adding it to the risk register.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A pharmaceutical company is using AI to accelerate drug discovery. The AI system has identified a promising compound, but the model's decision process is opaque, and regulators require explainability for approval. The company must decide how to manage this risk. The company has a high risk appetite for research but a low risk appetite for regulatory compliance. What is the most appropriate strategy?

   • AAvoid the risk by abandoning the AI-discovered compound.
   • BAccept the risk because the compound is promising and the company has a high risk appetite for research.
   • CMitigate the risk by developing explainability tools for the AI model and documenting the decision process for regulators.
   • DTransfer the risk by partnering with another company that will handle regulatory approval.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A healthcare provider is evaluating a vendor's AI diagnostic tool that analyzes medical images. The vendor claims 95% accuracy, but the provider's own test on a small sample of local patient data shows 80% accuracy. The provider must decide whether to pilot the tool. What is the most appropriate next step?

   • AAsk the vendor to guarantee 95% accuracy in the contract.
   • BConduct a formal risk assessment that evaluates the likelihood and impact of misdiagnosis in the local patient population.
   • CAccept the vendor's 95% accuracy claim and proceed with the pilot.
   • DReject the tool because the local accuracy is lower than the vendor's claim.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A logistics company has deployed an AI routing system that optimizes delivery routes. Six months after deployment, the company notices that the system's performance has degraded during peak holiday seasons. What should the company do to address this emerging technology risk?

   • AEstablish a continuous monitoring process that tracks the AI system's performance metrics and triggers a review when degradation is detected.
   • BDisable the AI system and revert to manual route planning.
   • CIgnore the degradation because the system performed well for the first six months.
   • DRetrain the model immediately with the most recent holiday season data.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   When an organization decides to stop using an AI feature because the risks are too high, which risk management strategy is being applied?

   • ARisk avoidance
   • BRisk mitigation
   • CRisk acceptance
   • DRisk transfer
   Reveal Solution Discussion Select an answer first