AI Risk and Threat Management CRAGE Practice Questions (Page 11)

Questions 51–54

1. 51foundation · easy

   Which risk treatment strategy is being applied when an organization discontinues an AI feature because the associated risks are deemed unacceptable?

   • ARisk transfer
   • BRisk mitigation
   • CRisk avoidance
   • DRisk acceptance
   Reveal Solution Discussion Select an answer first
2. 52expert · hard

   A cybersecurity team is threat modeling an AI-based intrusion detection system (IDS) that uses a deep learning model to classify network traffic. The team is concerned about adversarial evasion attacks that could allow malicious traffic to bypass detection. They also need to plan for potential incidents. What is the most comprehensive approach?

   • ADevelop a threat model that includes adversarial evasion, data poisoning, and model inversion, and create an incident response plan that addresses model-specific failures.
   • BMonitor the model's performance and alert if accuracy drops below a threshold.
   • CImplement a firewall to block all incoming traffic that does not match known signatures.
   • DTrain the model with more diverse data to improve its accuracy.
   Reveal Solution Discussion Select an answer first
4. 53application · medium

   A healthcare startup is developing an AI system that predicts patient readmission risk. The risk team has identified two risks: (1) the model may exhibit bias against certain demographic groups, and (2) the model may fail to predict readmission for patients with rare conditions. The team must decide which risk to address first. Which approach best aligns with structured risk assessment and prioritization?

   • APrioritize the bias risk because it could cause direct harm to patients and lead to regulatory penalties, even if its likelihood is lower.
   • BPrioritize the rare-condition risk because it affects a larger number of patients and is easier to mitigate.
   • CAddress both risks simultaneously with equal resources because all AI risks are equally important.
   • DDefer both risks until after deployment because real-world data will reveal which risk is more severe.
   Reveal Solution Discussion Select an answer first
5. 54expert · hard

   A company uses a third-party AI model for resume screening. The risk team is conducting a risk assessment. They have limited information about the vendor's training data and have discovered that the model may have a gender bias. The vendor is unwilling to share the training data due to intellectual property concerns. The company must comply with equal employment opportunity laws. What is the best course of action?

   • AConduct an independent bias audit using the model's outputs on test data, and if bias is confirmed, require the vendor to remediate or consider alternative vendors.
   • BAccept the vendor's assurance that the model is unbiased and proceed with deployment.
   • CTerminate the contract immediately and build an in-house model.
   • DDeploy the model and monitor for bias after a few months of use.
   Reveal Solution Discussion Select an answer first