AI Risk and Threat Management CRAGE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A large e-commerce company has deployed an AI recommendation system. The system has been found to occasionally recommend inappropriate products to minors. The company's legal team is concerned about regulatory implications, while the marketing team wants to maintain the system's performance. The risk team must communicate this risk to the board of directors. Which communication approach is most effective?

   • ARecommend pausing the recommendation system until the issue is resolved.
   • BProvide a detailed technical explanation of the recommendation algorithm's failure modes.
   • CPresent the risk in terms of potential legal penalties, brand reputation, and the mitigation plan.
   • DDownplay the risk to avoid alarming the board and affecting the company's stock price.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   When prioritizing AI risks, which combination of factors is most directly used to determine the priority level?

   • AColor of the risk dashboard and reporting frequency
   • BNumber of developers on the team and code complexity
   • CCost of the AI system and its market share
   • DSeverity of potential harm and likelihood of exploitation
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which structured methodology is commonly used to assess AI risks by evaluating both the probability of occurrence and the severity of impact?

   • AGap analysis
   • BRisk matrix (likelihood vs. impact)
   • CSWOT analysis
   • DRoot cause analysis
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A retail company uses a third-party AI chatbot for customer service. The vendor's model has a known vulnerability that could leak customer personal data. The vendor offers a patch but it will require a 48-hour downtime. The company's contract with the vendor includes a service-level agreement that requires 99.9% uptime. What is the most appropriate risk treatment decision?

   • ATransfer the risk to the vendor by requiring them to cover any breach costs.
   • BAvoid the risk by discontinuing the chatbot service permanently.
   • CApply the patch immediately, accepting the downtime and potential SLA breach.
   • DAccept the risk temporarily and schedule the patch during the next planned maintenance window.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A city government is deploying an AI system to optimize traffic light timing. The system has been tested and shows a small risk of increasing congestion in certain neighborhoods. The city council needs to decide whether to proceed. How should the AI risk team communicate this risk to the council?

   • AExplain the risk in terms of potential impact on residents, the likelihood, and the mitigation measures in place.
   • BRecommend proceeding without mentioning the risk because it is small and unlikely to occur.
   • CPresent a detailed technical report of the model's algorithms and failure modes.
   • DProvide the council with the raw data from the testing phase and let them draw their own conclusions.
   Reveal Solution Discussion Select an answer first