NIST AI RMF Alignment CRAGE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In the NIST AI RMF, which outcome is most directly associated with the Govern function?

   • AEstablishing organizational policies, roles, and accountability for AI risk management
   • BContinuously monitoring AI system performance against metrics
   • CIdentifying the context and potential impacts of AI use cases
   • DImplementing technical controls to mitigate AI risks
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   An insurance company has measured the risks of its claims-processing AI and found two significant risks: a high likelihood of biased outcomes for a minority group, and a low likelihood but severe risk of data breach. The risk team has limited resources to respond. Which response best aligns with the Manage function's guidance?

   • APrioritize the risks based on likelihood and impact, and allocate resources to address the bias risk first because it affects a protected group, while implementing basic safeguards for the data-breach risk.
   • BAddress the data-breach risk first because it has severe consequences, and defer the bias risk until later.
   • CTransfer both risks to the AI vendor through contractual indemnification.
   • DAccept both risks because the AI system provides significant cost savings.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A mid-sized company is adopting the NIST AI RMF. The company has a moderate risk appetite and operates in a highly regulated industry. The risk team is deciding on the appropriate tier for the Govern function. Which tier selection is most appropriate?

   • ASelect a tier that reflects the company's current governance capabilities, and set a target tier that aligns with regulatory expectations and the company's risk appetite.
   • BSelect the highest tier for all functions to ensure full compliance, regardless of current capabilities.
   • CDo not select tiers; instead, use a generic risk management approach that is not tailored to the company.
   • DSelect a low tier to minimize effort, since the company has a moderate risk appetite.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An e-commerce company is using the NIST AI RMF to assess risks of a recommendation system. The team has completed the Map function and identified potential biases. They now need to quantify the severity of these biases. Which approach best aligns with the Measure function?

   • ARely solely on the qualitative feedback from customer support tickets to gauge bias severity.
   • BDefer measurement until after deployment and use post-hoc incident reports to assess bias.
   • CConduct a quantitative analysis using fairness metrics (e.g., demographic parity) and complement it with qualitative interviews of affected user groups.
   • DUse a single quantitative metric, such as equalized odds, as the sole measure of bias.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the first step an organization should take when implementing the NIST AI RMF?

   • ASelecting risk response strategies for all identified risks
   • BEstablishing a governance structure and assigning roles for AI risk management
   • CConducting a full quantitative risk assessment of all AI systems
   • DDeploying monitoring tools to track AI system performance
   Reveal Solution Discussion Select an answer first