Identify and Manage the Risks Associated with Emerging Technologies, Such as AI. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A non-profit organization is deploying an AI system to screen job applicants. The risk assessment found a potential for the system to discriminate against older workers. The organization's leadership is considering accepting the risk because the system improves efficiency. However, the organization's legal counsel warns that this could violate age discrimination laws. What is the most responsible course of action?

   • ATransfer the risk by purchasing insurance for potential discrimination claims.
   • BProceed with the risk acceptance because the leadership has the authority to make this decision.
   • CRe-evaluate the risk acceptance decision in light of the legal counsel's warning and consider mitigation or avoidance to ensure legal compliance.
   • DKeep the risk acceptance decision confidential to avoid legal scrutiny.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A city government is deploying an AI system to allocate police resources based on crime prediction. The risk assessment identified a risk that the system could reinforce existing biases in policing, leading to over-policing of certain neighborhoods. The city council is divided: some members want to deploy to improve efficiency, others want to abandon the project. The CISO must advise the council. What is the most responsible recommendation?

   • ARecommend immediate full deployment because the efficiency gains are important for public safety.
   • BRecommend a phased deployment with continuous bias monitoring, community engagement, and a clear process for adjusting or stopping the system if bias is detected.
   • CRecommend abandoning the project entirely because the bias risk is too high.
   • DRecommend deploying the system but keeping the risk assessment confidential to avoid public concern.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A hospital is deploying an AI system to predict patient readmission risk. The system uses electronic health records (EHRs). The risk assessment reveals that the model performs well for the majority population but poorly for minority populations due to historical underrepresentation in the training data. The hospital must decide how to proceed. The hospital's risk appetite is low, and it is subject to strict anti-discrimination regulations. What is the most appropriate risk management strategy?

   • ATransfer the risk by purchasing liability insurance for potential discrimination claims.
   • BAvoid the risk by not deploying the AI system at all.
   • CAccept the risk because the model still performs well overall and improves efficiency.
   • DMitigate the risk by collecting more representative data and retraining the model before deployment.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A university is deploying an AI system to screen student applications. The risk assessment identified a moderate risk of the system inadvertently discriminating against applicants from certain backgrounds. The university's leadership decides to accept this risk. What must the university do to ensure this decision is responsible?

   • ATransfer the risk to the IT department by assigning them the responsibility.
   • BDocument the risk acceptance decision, including the rationale and the responsible party, and communicate it to relevant stakeholders.
   • CImmediately deploy the system without further review.
   • DKeep the decision confidential to avoid public scrutiny.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A multinational corporation has AI systems deployed across its European, Asian, and North American divisions. Each division has conducted its own risk assessment for its AI systems. The enterprise CISO wants to consolidate these into a single view. What is the most effective approach?

   • AAsk each division to submit a summary report in its own format.
   • BUse a common risk assessment framework and scoring methodology across all divisions to enable aggregation and comparison.
   • CDelegate the consolidation task to each division's local IT team.
   • DCreate a separate enterprise risk register that only includes risks from the largest division.
   Reveal Solution Discussion Select an answer first