AI Security Architecture and Controls CRAGE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A multinational corporation is deploying an AI HR screening tool. The EU operations require compliance with GDPR, and the US operations require compliance with local anti-discrimination laws. The compliance team wants a single framework to manage both. What should they do?

   • AFollow only GDPR because it is the strictest regulation and will automatically satisfy US laws.
   • BAdopt a unified AI governance framework that maps controls to both GDPR and US anti-discrimination requirements.
   • CDeploy separate AI systems for EU and US operations, each with its own compliance controls.
   • DUse a third-party certification as proof of compliance for all jurisdictions.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company is deploying an AI model for real-time fraud detection. The model must have low latency, but the security team wants to add a control to detect adversarial inputs. They are considering (1) a separate anomaly detection model that screens inputs before the main model, and (2) adversarial training of the main model. The team has limited compute budget and cannot afford both. Which approach should they choose?

   • ANeither, because adversarial attacks are rare and not worth the investment.
   • BBoth, because defense in depth is always necessary for AI systems.
   • CAdversarial training of the main model, because it improves robustness without adding inference-time latency.
   • DA separate anomaly detection model, because it can be tuned independently without retraining the main model.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A bank is required by an auditor to demonstrate that its AI credit model was developed and validated according to internal policies. The bank needs to provide evidence of the model's development process, data sources, and testing results. Which mechanism best supports this audit requirement?

   • AMaintain a model documentation repository with versioned records of data, code, and test results
   • BRely on the model vendor's certification without internal documentation
   • CStore the model in a password-protected folder with no change log
   • DUse a black-box model and provide only the final accuracy metric
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   In the context of AI security architecture, which triad of core principles is most commonly used to guide the protection of AI systems and their data?

   • APrevention, detection, and response
   • BEncryption, hashing, and digital signatures
   • CConfidentiality, integrity, and availability
   • DAuthentication, authorization, and accounting
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which privacy-preserving technique adds carefully calibrated noise to data or query results to prevent the disclosure of information about any individual record?

   • ADifferential privacy
   • BFederated learning
   • CData masking
   • DHomomorphic encryption
   Reveal Solution Discussion Select an answer first