AI Risk and Threat Management CRAGE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   When communicating AI risks to a non-technical audience, which approach is most effective?

   • AUsing technical jargon and detailed model architecture diagrams
   • BSharing raw training data statistics without context
   • CUsing plain language and focusing on potential business and societal impacts
   • DAvoiding any mention of risk to prevent alarm
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A bank's AI risk team has identified three risks: a model bias that could lead to discriminatory lending (high impact, low likelihood), a data breach via a third-party API (medium impact, high likelihood), and a model outage that could disrupt transactions (high impact, medium likelihood). The bank has limited resources. Which risk should be prioritized first?

   • AThe data breach via the third-party API, because it has the highest likelihood and medium impact.
   • BAll risks equally, because they all have potential harm.
   • CThe model outage, because it has high impact and medium likelihood.
   • DThe model bias, because it has high impact on stakeholders.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following is an example of a societal risk associated with an AI system?

   • AAn AI hiring tool inadvertently discriminates against a protected group, leading to unequal employment opportunities.
   • BA server outage prevents the AI service from responding to user requests for several hours.
   • CAn attacker exploits a vulnerability in the model's API to extract sensitive training data.
   • DA model's training data contains outdated information that reduces prediction accuracy over time.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A financial services company deploys a machine learning model to approve credit card transactions. The model was trained on historical transaction data that included a small number of fraudulent transactions. The security team wants to proactively identify how an attacker could manipulate the model to approve fraudulent transactions. Which approach best addresses this concern?

   • ARestrict access to the model's training data to only the data science team.
   • BConduct a threat modeling exercise focused on adversarial machine learning attacks, such as data poisoning and evasion, and document mitigations.
   • CIncrease the frequency of model retraining to every week to ensure the model adapts to new fraud patterns.
   • DImplement a real-time monitoring dashboard that alerts on sudden changes in approval rates.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A hospital uses an AI system to recommend medication dosages. During a routine monitoring review, the system recommends a dosage that is 10 times the normal amount for a patient. The risk team is activated. The hospital has an AI incident response plan, but it was designed for data breaches, not clinical decision support failures. What is the most critical action the team should take?

   • ANotify the hospital's legal team and wait for their instructions before taking any action.
   • BImmediately suspend the AI system from clinical use and initiate a root cause analysis, while communicating with clinical staff and regulators.
   • CAdjust the model's dosage calculation algorithm and redeploy it immediately.
   • DContinue monitoring to see if the anomaly occurs again.
   Reveal Solution Discussion Select an answer first