Identify and Manage the Risks Associated with Emerging Technologies, Such as AI. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An organization is deploying an AI system for employee performance evaluation. The risk assessment found a potential for bias against remote workers. The CISO must communicate this risk to the board of directors, who are non-technical. What is the most effective communication approach?

   • AProvide the board with the full technical risk assessment report, including model metrics and data distributions.
   • BPresent a business-impact summary that explains the potential for unfair evaluations and the associated legal and reputational consequences.
   • CExplain that the AI system is unbiased because it was trained on company data.
   • DRecommend immediate deployment because the risk is only potential and may not occur.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is a common risk assessment methodology used to evaluate emerging technology risks?

   • ATOGAF enterprise architecture
   • BNIST Risk Management Framework (RMF)
   • CAgile software development
   • DITIL service management
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the purpose of periodically reviewing emerging technology risk assessments?

   • ATo update the risk assessment based on changes in the technology and threat landscape
   • BTo transfer risks to other departments
   • CTo ensure the risk assessment is never changed
   • DTo delete outdated risk assessments
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   When communicating emerging technology risks to a non-technical audience, what is the most effective approach?

   • AProvide detailed technical specifications of the AI model
   • BUse business impact language and avoid technical jargon
   • CFocus only on the probability scores and ignore impact
   • DUse the same communication style as for technical stakeholders
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A government agency is deploying an AI system to assist with benefits eligibility determinations. The risk assessment found a potential for the system to make errors that could deny benefits to eligible citizens. The agency must communicate this risk to the public. What is the most appropriate communication strategy?

   • APublish a plain-language summary of the AI system's purpose, the identified risks, and the safeguards in place to protect citizens.
   • BIssue a press release stating that the AI system is accurate and reliable, without mentioning potential errors.
   • CDelay any public communication until the system has been in operation for a year.
   • DShare the full technical risk assessment report on the agency's website.
   Reveal Solution Discussion Select an answer first