AI Security Architecture and Controls CRAGE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A research consortium wants to train a model on genomic data from multiple countries. Each country has laws that prohibit the transfer of genomic data across borders. The consortium also needs to ensure that the model does not leak information about any individual's genome. Which combination of techniques is most appropriate?

   • AAnonymize the genomic data and share it centrally, relying on anonymization to protect privacy.
   • BFederated learning to keep data in each country, combined with differential privacy to protect individual genomes.
   • CUse a trusted third party to collect and store all genomic data in a neutral country.
   • DHomomorphic encryption to encrypt the data and share it with a central server for training.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A multinational corporation is deploying an AI HR screening tool. The EU AI Act classifies the tool as high-risk, and the company must ensure that the system is subject to a risk management system and that human oversight is possible. Which set of actions best aligns with these compliance requirements?

   • AImplement a risk management process, maintain logs of system outputs, and design a human-in-the-loop review for adverse decisions
   • BDeploy the model in a sandbox and only use it for internal testing
   • CAnonymize all candidate data and deploy the model without further controls
   • DUse a black-box model and rely on external auditors to certify the system
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   In threat modeling for AI systems, what is the primary characteristic of an adversarial attack (e.g., an adversarial example)?

   • AIt involves small, often imperceptible perturbations to inputs that cause misclassification
   • BIt targets the model's training data by injecting malicious records
   • CIt exploits a vulnerability in the model's API to execute arbitrary code
   • DIt requires physical access to the AI hardware
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which activity is a key part of integrating AI security architecture with regulatory compliance requirements?

   • AEncrypting all model weights with a single key
   • BUsing only open-source AI models to avoid licensing issues
   • CMapping security controls to specific regulatory obligations
   • DDeploying AI models on-premises to avoid all data protection laws
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A healthcare startup is deploying a diagnostic imaging model. During a red-team exercise, the security team discovers that an attacker can alter a small number of pixels in an X-ray to make the model misclassify a malignant tumor as benign. The team wants to implement a control that directly reduces the risk of such manipulation at inference time. Which control should they prioritize?

   • ADeploy an input sanitization layer that detects and rejects adversarial perturbations
   • BAdd adversarial training examples to the training dataset
   • CEncrypt the model weights at rest using a hardware security module
   • DRestrict API access to the model using role-based authentication
   Reveal Solution Discussion Select an answer first