AI Risk and Threat Management CRAGE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   An autonomous vehicle company has an AI system that occasionally makes incorrect decisions in rare road conditions. The company has an incident response plan. During a real incident, the vehicle's AI misidentifies a pedestrian. Which action should be taken first according to the incident response plan?

   • ACollect all data from the vehicle's sensors for analysis.
   • BNotify the AI vendor and request a model update.
   • CDisable the AI system in all vehicles to prevent further incidents.
   • DEnsure the safety of all individuals involved and secure the scene.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A multinational bank is deploying an AI system for loan approvals across multiple countries. Each country has different data protection regulations. The bank's governance framework must ensure compliance. Which approach best aligns AI risk management with regulatory requirements?

   • AApply the strictest regulatory requirements from any single country to all deployments globally.
   • BDevelop a single global AI risk policy and require all countries to follow it, regardless of local laws.
   • CConduct a regulatory mapping exercise to identify applicable requirements in each jurisdiction and integrate them into the AI risk assessment.
   • DDefer to the AI vendor's compliance certifications as sufficient evidence of regulatory alignment.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   An organization decides to purchase cyber insurance to cover potential financial losses from an AI system failure. Which risk treatment strategy does this represent?

   • ARisk avoidance
   • BRisk mitigation
   • CRisk transfer
   • DRisk acceptance
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A healthcare organization uses an AI system to prioritize patient triage. The risk team has identified several risks: a data poisoning attack that could misclassify critical patients, a model bias that could under-prioritize certain demographics, and a system outage that could delay triage. The organization has limited resources and must comply with patient safety regulations. Which approach should the risk team take to prioritize these risks?

   • ATreat all risks equally and allocate resources evenly across all three risks.
   • BPrioritize the risk that is easiest to mitigate, regardless of potential harm.
   • CFocus only on the risk with the highest technical exploitability, ignoring stakeholder harm.
   • DAssess each risk's likelihood and impact using a structured methodology, then prioritize based on severity and regulatory requirements.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A financial services firm uses a machine learning model to approve credit card transactions. The model was trained on historical transaction data that included a small number of fraudulent transactions. The security team is concerned about an attacker who could submit carefully crafted transactions to influence the model's future decisions. Which threat should the team document as the primary risk in the AI threat model?

   • AModel theft, where the attacker steals the model's parameters through repeated queries.
   • BAdversarial evasion, where the attacker crafts inputs that cause misclassification at inference time without altering the model.
   • CData poisoning, where the attacker injects malicious samples into the training data to corrupt the model's learned behavior.
   • DModel inversion, where the attacker reconstructs private training data by querying the model's outputs.
   Reveal Solution Discussion Select an answer first