AI Risk and Threat Management CRAGE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is a key benefit of regularly communicating AI risk status to executive leadership?

   • AIt removes the need for technical risk assessments
   • BIt ensures that only technical staff are aware of risks
   • CIt guarantees that all AI risks will be eliminated
   • DIt enables informed decision-making and resource allocation for risk treatment
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company's AI risk team has identified a critical vulnerability in a customer-facing recommendation system. The vulnerability could expose customer preferences. The team needs to communicate this risk to the executive board, which is not technically sophisticated. What is the best way to communicate this risk?

   • AProvide a detailed technical report including the specific attack vectors and model architecture.
   • BSend an email with a link to the full risk assessment document and ask the board to review it.
   • CPresent a clear summary of the risk, its potential business impact, and the proposed mitigation plan in non-technical language.
   • DOnly inform the legal department and keep the board unaware to avoid alarm.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A government agency uses an AI system to screen benefit applications. The system begins to deny applications at a much higher rate than usual. The agency has an incident response plan for IT systems but not specifically for AI failures. What is the most important first step in responding to this AI-related incident?

   • AWait for the next scheduled review to see if the issue resolves itself.
   • BContact the vendor of the AI system to demand a fix.
   • CImmediately shut down the AI system and revert to manual processing.
   • DActivate the incident response plan and assemble a cross-functional team including data scientists, legal, and communications.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An e-commerce company uses an AI chatbot to handle customer service. The chatbot sometimes generates offensive responses, which the company has identified as a risk. The company also notices that the chatbot's responses are influenced by user inputs in real time. Which additional risk should the company identify and categorize?

   • AModel inversion, where the chatbot reveals private customer data.
   • BPrompt injection, where a user crafts inputs to manipulate the chatbot into performing unintended actions.
   • CData poisoning, where the training data is corrupted by malicious actors.
   • DAdversarial evasion, where the chatbot misclassifies user intent.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A hospital is deploying an AI system to predict patient deterioration. The risk team has identified two risks: (1) the model may fail to predict deterioration for patients with rare conditions, and (2) the model may produce false alarms that desensitize staff. The hospital has limited resources for risk mitigation. Which risk should be prioritized for mitigation?

   • ABoth risks equally, because they both affect patient outcomes.
   • BDefer both risks until after deployment to gather real-world data.
   • CThe failure to predict rare conditions, because it could lead to patient harm and is difficult to detect.
   • DThe false alarms, because they affect staff behavior and could reduce trust in the system.
   Reveal Solution Discussion Select an answer first