AI Risk and Threat Management CRAGE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A retail company uses a third-party AI vendor for inventory management. The vendor's model is hosted on the vendor's cloud infrastructure. The company has learned that the vendor had a security breach that may have exposed the model's training data. The company's contract with the vendor does not specify data breach notification procedures. Which action is most appropriate to manage this third-party risk?

   • AWait for the vendor to notify the company according to their own procedures.
   • BAssume the breach does not affect the company because the vendor hosts the model.
   • CImmediately request the vendor to provide a detailed breach report and assess the impact on the company's data.
   • DTerminate the contract with the vendor immediately to avoid further risk.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A financial technology company uses an AI model from a third-party vendor to assess creditworthiness. The model has been found to have a bias against a certain demographic group. The vendor is unwilling to share the training data or allow the company to modify the model. The company must decide how to mitigate the bias risk. Which strategy is most feasible?

   • ATerminate the contract with the vendor and build an in-house model.
   • BImplement post-processing adjustments to the model's outputs to reduce bias.
   • CRequest the vendor to retrain the model with debiased data.
   • DAccept the bias because the vendor is responsible for the model's performance.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A global pharmaceutical company is deploying an AI system to assist in drug discovery. The system uses patient data from multiple countries. The company must comply with GDPR in Europe and other local data protection laws. The AI risk team has identified a risk that the model could inadvertently reveal patient identities. The company's legal team insists on strict data minimization, while the research team wants to retain as much data as possible for model accuracy. Which approach best balances compliance and model performance?

   • AImplement differential privacy techniques to allow model training while reducing the risk of re-identification.
   • BRemove all patient data from the model and use only synthetic data.
   • CDefer the decision to the legal team because compliance is their responsibility.
   • DRetain all data because the model's accuracy is critical for drug discovery and the risk is low.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which adversarial attack aims to reconstruct or infer sensitive information about the training data by querying the model?

   • AModel inversion
   • BEvasion attack
   • CMembership inference
   • DData poisoning
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company's AI risk team has identified four risks: a model bias with high impact but low likelihood, a data poisoning attack with medium impact and medium likelihood, a system outage with high impact and high likelihood, and a regulatory fine with low impact and low likelihood. The company has limited resources. Which risk should be addressed first?

   • AThe system outage, because it has high impact and high likelihood.
   • BThe regulatory fine, because it is easy to mitigate.
   • CThe data poisoning attack, because it has medium likelihood and medium impact.
   • DThe model bias, because it has high impact.
   Reveal Solution Discussion Select an answer first