AI Risk and Threat Management CRAGE Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A bank uses a third-party AI vendor for fraud detection. The vendor's model has a high detection rate but also produces a high number of false positives, causing customer dissatisfaction. The bank's contract with the vendor includes a service-level agreement (SLA) that penalizes the vendor for downtime but not for false positives. The bank is considering renewing the contract. Which action is most appropriate to manage this third-party AI risk?

   • AIncrease the model's detection threshold to reduce false positives without consulting the vendor.
   • BRenegotiate the contract to include performance metrics for false positives and a remediation plan.
   • CSwitch to a different vendor that promises fewer false positives.
   • DAccept the false positives as a trade-off for high detection rates.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A company's AI risk team has identified a high-severity risk in a new AI feature that is about to launch. The risk could cause financial loss to customers. The product manager wants to launch on schedule, while the risk team recommends delaying the launch. The CEO needs to make a decision. What is the most effective way for the risk team to communicate the risk to the CEO?

   • AEscalate the issue to the board of directors without informing the CEO.
   • BPresent a concise summary of the risk, its potential financial impact on customers and the company, and the trade-off between launching now versus delaying.
   • CSend a detailed technical report of the risk to the CEO's office.
   • DRecommend delaying the launch without providing alternatives or impact analysis.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A financial regulator requires a bank to ensure that its AI credit-scoring model is explainable and does not discriminate. The bank's current model is a complex deep learning model that is not explainable. The bank has a limited budget and must meet the regulatory deadline. What is the most appropriate risk mitigation strategy?

   • AOutsource the model to a third-party vendor that provides explainability reports.
   • BApply for an extension from the regulator to allow more time to develop an explainable model.
   • CKeep the deep learning model and use post-hoc explanation tools like LIME or SHAP to provide explanations.
   • DReplace the deep learning model with a simpler, interpretable model such as logistic regression, even if it slightly reduces accuracy.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   An insurance company has deployed an AI underwriting model. The risk team has established a monitoring process that tracks model performance and fairness metrics. After a quarterly review, they notice a slight increase in the model's rejection rate for a specific demographic group. What should the risk team do first?

   • AImmediately retrain the model with the most recent data to correct the bias.
   • BInvestigate the root cause of the change, including data drift or changes in the input distribution, before taking action.
   • CIgnore the change because it is within the acceptable tolerance threshold.
   • DReport the change to the board and recommend shutting down the model.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which step is typically the FIRST in an AI incident response process?

   • ARecovery of the system
   • BEradication of the root cause
   • CDetection and identification of the incident
   • DContainment of the incident
   Reveal Solution Discussion Select an answer first