AI Security Architecture and Controls CRAGE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A government agency is deploying an AI system to assist with benefits eligibility decisions. The agency must be able to explain each decision to applicants and provide evidence for audits. Which combination of mechanisms should the agency implement?

   • ARely on the model vendor's certification that the system is fair and unbiased.
   • BPublish the model's source code on a public repository to demonstrate transparency.
   • CUse a model-agnostic explainability tool and maintain a versioned model documentation repository.
   • DUse a high-accuracy black-box model and store only the final prediction in the audit log.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An e-commerce company's AI chatbot is a critical customer-facing system. The security team is designing the architecture to ensure the chatbot remains available during a DDoS attack and that its responses are not tampered with. Which set of controls best addresses these two requirements?

   • ADeploy the chatbot behind a DDoS protection service and use signed responses with integrity verification.
   • BImplement rate limiting on the API and use a web application firewall to block malicious requests.
   • CEncrypt all chatbot traffic with TLS and store conversation logs in an immutable database.
   • DUse a load balancer with health checks and enable audit logging for all model inputs and outputs.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A government agency wants to allow researchers to analyze a census dataset while protecting individual privacy. The agency is considering differential privacy and homomorphic encryption. Which statement correctly describes the trade-off between these two techniques?

   • AHomomorphic encryption eliminates the need for differential privacy
   • BDifferential privacy is only applicable to deep learning models
   • CHomomorphic encryption is easier to implement than differential privacy
   • DDifferential privacy provides a formal privacy guarantee for published statistics, while homomorphic encryption allows computation on encrypted data but does not prevent re-identification of the results
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A financial regulator requires that an AI model's decisions be explainable to customers. The data science team wants to use a deep neural network for accuracy, but the model is a black box. The team is considering (1) using a simpler interpretable model, (2) using post-hoc explainability tools, or (3) using a hybrid approach. The regulator also requires that explanations be auditable and consistent. Which approach is most likely to satisfy the regulator?

   • AUse the deep neural network and rely on the model's high accuracy to justify decisions.
   • BUse post-hoc explainability tools without any validation of their consistency.
   • CUse a simple interpretable model, such as logistic regression, to guarantee explainability.
   • DUse a hybrid approach: a deep neural network for accuracy, with post-hoc explainability tools and rigorous validation of explanation consistency.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which type of attack involves an adversary inserting malicious samples into the training dataset to cause the model to learn incorrect behaviors?

   • AAdversarial example attack
   • BModel inversion attack
   • CData poisoning attack
   • DPrompt injection attack
   Reveal Solution Discussion Select an answer first