AI Risk and Threat Management CRAGE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company plans to use a third-party AI service for image recognition in a security system. The vendor's service is hosted in a foreign country. The company is concerned about data privacy regulations and the vendor's security practices. What should the company do before signing the contract?

   • ARely on the vendor's privacy policy and assume they comply with regulations.
   • BSign the contract and address any issues after deployment.
   • CRequire the vendor to store all data in the company's home country.
   • DPerform a third-party risk assessment that includes data residency, security controls, and compliance with relevant regulations.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An insurance company has deployed an AI system that determines premium rates. The system was validated before deployment, but the company wants to ensure it continues to operate fairly and accurately as market conditions change. Which practice best supports continuous risk monitoring and review?

   • ASchedule a one-time audit six months after deployment to assess performance.
   • BReview the model's performance only when new regulations are introduced.
   • CEstablish automated performance and fairness metrics that trigger alerts when thresholds are breached.
   • DRely on customer complaints to identify any issues with the AI system.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary purpose of aligning AI risk management with organizational governance frameworks?

   • ATo ensure AI risk practices are consistent with the organization's overall risk appetite and regulatory obligations
   • BTo make AI risk management solely the responsibility of the IT department
   • CTo eliminate the need for separate AI risk assessments
   • DTo ensure all AI risks are transferred to third parties
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A retail company uses a third-party AI vendor for demand forecasting. The vendor's model has a known vulnerability to adversarial inputs that could cause inaccurate forecasts during peak seasons. The company cannot replace the vendor quickly. Which mitigation strategy is most appropriate under these constraints?

   • AAccept the risk because the vendor is responsible for the model's performance.
   • BImplement additional monitoring and manual review of forecasts during peak seasons to detect anomalies.
   • CAvoid the risk by discontinuing the use of the vendor's model immediately.
   • DTransfer the risk by purchasing cyber insurance that covers forecasting errors.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In a quantitative AI risk assessment, which factor is directly used to calculate the annualized loss expectancy (ALE)?

   • AControl effectiveness and residual risk
   • BLikelihood rating and impact rating from a risk matrix
   • CSingle loss expectancy (SLE) and annualized rate of occurrence (ARO)
   • DVulnerability score and threat intelligence feed
   Reveal Solution Discussion Select an answer first