AI Security Architecture and Controls CRAGE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company is deploying a facial recognition model for physical access control. The security team is concerned about an attacker presenting a printed photo to the camera. Which control should be implemented at the deployment stage to mitigate this spoofing attack?

   • AEncrypt the video feed between the camera and the model server
   • BUse a stronger authentication method for the model server
   • CAdd liveness detection to verify the subject is a real person
   • DTrain the model on more diverse facial images
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A hospital network wants to collaborate with three other hospitals to train a disease-prediction model without sharing raw patient records. The data is subject to strict privacy regulations. Which approach should they use?

   • AUsing homomorphic encryption on the raw data and sending it to a central server
   • BFederated learning with differential privacy
   • CAnonymizing the data and publishing it openly
   • DCentralizing all data in a single cloud data warehouse
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which security control is most directly applicable during the data collection stage of the AI lifecycle?

   • AModel versioning and rollback procedures
   • BAdversarial robustness testing of the trained model
   • CData provenance tracking and access controls on datasets
   • DInput validation and sanitization at inference endpoints
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A research hospital wants to collaborate with other institutions to train a predictive model on patient data. The hospital's legal team requires that patient data never leaves the hospital's network, but the model must benefit from all institutions' data. Which technique should they use?

   • AFederated learning with secure aggregation of model updates.
   • BDifferential privacy by adding noise to the data and then sharing the noisy dataset.
   • CHomomorphic encryption on the entire patient dataset before sharing it with collaborators.
   • DCreate a shared cloud storage bucket and grant all institutions access to the raw data.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company is deploying an AI system that will be audited by a regulatory body. The auditor requires evidence that the model was trained on appropriate data, that the model's decisions are fair, and that the system was tested for security vulnerabilities. What should the company prepare?

   • AA single document containing the model's source code and deployment architecture.
   • BA model documentation package including data sheets, model cards, and security test reports.
   • CA certificate from the model vendor stating that the model is compliant with all regulations.
   • DA list of all employees who worked on the AI project and their roles.
   Reveal Solution Discussion Select an answer first