Identify and Manage the Risks Associated with Emerging Technologies, Such as AI. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   An e-commerce company has deployed an AI recommendation system. The system's performance is monitored quarterly. After a major marketing campaign, the company notices that the recommendation system's click-through rate has dropped significantly. The data science team suspects the campaign changed customer behavior, making the model's training data less relevant. What is the most appropriate immediate action?

   • ADisable the recommendation system and revert to manual recommendations.
   • BWait for the next quarterly review to assess the situation.
   • CTrigger an ad-hoc review of the model's performance and retrain it with recent data that reflects the new customer behavior.
   • DAccept the performance drop as a temporary effect of the campaign and take no action.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   In a risk assessment for an emerging technology, what does 'likelihood' measure?

   • AThe probability that a risk event will occur
   • BThe speed at which the technology can be deployed
   • CThe potential financial loss if the risk occurs
   • DThe number of vulnerabilities in the system
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A regional bank is deploying an AI-based loan approval system trained on historical customer data. The data science team reports that the model performs well overall, but the bank's compliance officer is concerned about potential disparate impact on minority applicants. The model's decision logic is a complex ensemble that the team cannot easily explain. What should the bank do FIRST to address the most critical emerging technology risk?

   • APurchase cyber liability insurance to transfer the financial risk of a biased model.
   • BReplace the ensemble model with a simple logistic regression to ensure full explainability.
   • CImmediately deploy the model and monitor for complaints from rejected applicants.
   • DConduct a bias and fairness audit on the model's outcomes across protected groups before production deployment.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A large enterprise has multiple AI systems across different departments. Each department manages its own AI risk assessments and reports them separately to the CISO. The CISO finds it difficult to prioritize AI risks against traditional IT risks. What is the most effective way to integrate AI risk into the enterprise risk management program?

   • AEstablish a centralized AI risk register that uses the same risk scoring criteria as the enterprise risk register and is reviewed by the enterprise risk committee.
   • BAsk the CISO to personally review all AI risk assessments and decide priorities.
   • CRequire each department to report AI risks in a standardized template to the CISO.
   • DCreate a separate AI risk committee that operates independently of the enterprise risk committee.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What does 'model opacity' refer to in the context of AI risk?

   • AThe process of encrypting the AI model's data
   • BThe visual appearance of the AI's user interface
   • CThe speed at which the AI model processes data
   • DThe inability to understand how an AI model arrives at its decisions
   Reveal Solution Discussion Select an answer first