AI Risk and Threat Management CRAGE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which document is most important to include in a contract with an AI vendor to manage third-party risk?

   • AService-level agreements (SLAs) and data protection clauses
   • BA non-disclosure agreement only
   • CA marketing brochure describing the vendor's AI capabilities
   • DA clause that absolves the vendor of all liability
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A manufacturing company uses a third-party AI vendor for predictive maintenance. The vendor's model is a black box, and the company cannot inspect the training data. The company wants to ensure the model does not introduce safety risks. Which action is most appropriate for managing third-party AI risk?

   • ATerminate the contract and build an in-house model to avoid third-party risk.
   • BAccept the risk because the vendor is a reputable company with a strong track record.
   • CRequest the vendor's source code to conduct an independent security review.
   • DRequire the vendor to provide documentation of the model's training data sources and validation results.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A multinational corporation uses AI systems across its subsidiaries. Each subsidiary has its own risk management process, and the corporation is subject to multiple regulatory frameworks. The board wants a consistent approach to AI risk management across the organization. What should the corporation implement?

   • AA centralized risk register that only tracks high-severity risks.
   • BA decentralized approach where each subsidiary independently manages AI risks without central oversight.
   • CA single risk assessment methodology that ignores local regulatory differences.
   • DA unified AI risk governance framework that aligns with regulatory requirements and is adopted by all subsidiaries.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A government agency uses an AI system to screen immigration applications. The system was developed in-house and has been in production for a year. The agency's risk team has noticed that the model's performance has degraded over time due to changes in the applicant population. The agency is subject to strict audit requirements. Which action is most appropriate to address the model drift?

   • ARevert to the original model version to maintain consistency with the initial audit.
   • BIncrease the frequency of manual reviews to compensate for the drift.
   • CDiscontinue the AI system and rely on manual processing.
   • DRetrain the model with recent data and document the change for audit purposes.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A telecom company uses an AI system from a third-party vendor to detect network anomalies. The vendor updates the model monthly. The company's risk team wants to ensure the model continues to perform well after each update. Which monitoring practice is most effective?

   • ARely on the vendor's own testing results and deploy updates immediately.
   • BFreeze the model version to avoid the risk of updates introducing new issues.
   • CConduct a full re-validation of the model after every vendor update before deploying it to production.
   • DMonitor the model's performance only when a network incident occurs.
   Reveal Solution Discussion Select an answer first