AI Incident Response and Business Continuity CRAGE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   During an AI incident, the response team needs to preserve evidence for a potential lawsuit. The incident involves a model that was tampered with. What is the most comprehensive evidence preservation approach?

   • AEmail the incident report to the legal team and delete the original logs.
   • BCopy the model file to a USB drive and store it in a safe.
   • CCreate a forensic image of the model server, including memory, and maintain a chain of custody for all logs.
   • DTake screenshots of the model's outputs and save them to a shared drive.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What is the primary purpose of isolating data during an AI incident?

   • ATo improve the model's accuracy
   • BTo make the data more accessible to the response team
   • CTo prevent the spread of contaminated data to other systems
   • DTo reduce storage costs
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Why is it important to align AI incident response with organizational incident management frameworks?

   • ATo ensure consistent escalation paths and coordination across teams
   • BTo create a separate incident response team for AI only
   • CTo avoid involving the IT department in AI incidents
   • DTo ensure that AI incidents are handled in isolation from other incidents
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which method is specifically used to detect AI-specific incidents such as model drift or data poisoning?

   • AReviewing firewall logs
   • BChecking CPU usage on servers
   • CAnalyzing user login patterns
   • DMonitoring model performance metrics over time
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   An AI system that approves loan applications is showing a sudden increase in approval rates. The team suspects the model has been tampered with. What is the most appropriate triage action?

   • ARoll back the model to the previous version to stop the increase.
   • BAssess the impact on loan approvals and determine the severity of the potential tampering.
   • CImmediately shut down the loan approval system to prevent further approvals.
   • DNotify all loan applicants that their applications may be affected.
   Reveal Solution Discussion Select an answer first