AI Security Architecture and Controls CRAGE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which privacy-preserving technique allows multiple parties to collaboratively train a machine learning model without sharing their raw data with each other?

   • ASecure multi-party computation
   • BFederated learning
   • CDifferential privacy
   • DHomomorphic encryption
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What is the primary purpose of model documentation in an AI system?

   • ATo encrypt the model weights and prevent unauthorized access
   • BTo store the training data in a secure repository
   • CTo automatically generate explanations for every prediction the model makes
   • DTo provide a record of the model's design, intended use, limitations, and performance characteristics
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A financial institution is training a fraud-detection model on transaction data that includes sensitive customer information. The compliance team requires that raw personal data never be exposed to the data science team, but the model must still learn patterns from the data. Which approach best satisfies this constraint?

   • AEncrypt the data with a shared key and provide the key to the data science team for decryption during training.
   • BAnonymize the data by removing names and social security numbers before sharing with the data science team.
   • CUse federated learning so the model is trained across decentralized data sources without centralizing raw data.
   • DStore the data in a separate virtual network and grant the data science team read-only access to the database.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A security architect is threat modeling an AI system that uses a third-party pre-trained model. The architect identifies that the third-party model may contain backdoors inserted by the vendor. The organization has a strict policy that all models must be validated before deployment. Which control is most effective in mitigating this supply-chain risk?

   • AUse a different third-party model from a more reputable vendor.
   • BEncrypt the model weights to prevent tampering during deployment.
   • CPerform a thorough model evaluation on a held-out validation set and test for anomalous behavior on trigger inputs.
   • DRely on the vendor's security certification and documentation.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A financial institution is developing a credit-scoring model. The compliance team requires that any change to the model's training data or algorithm be traceable and approved before deployment. Which combination of controls best satisfies this requirement?

   • AEncrypting the training data and using a VPN for model access
   • BUsing a single production model and monitoring its accuracy weekly
   • CVersion control for datasets and code, plus a change advisory board review
   • DStoring all training data in a data lake with no access restrictions
   Reveal Solution Discussion Select an answer first