NIST AI RMF Alignment CRAGE Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   An organization has implemented the NIST AI RMF and is now in the continuous improvement phase. The team notices that risk assessments are becoming outdated quickly due to rapid changes in the AI system. Which action best supports continuous improvement?

   • AEstablish a trigger-based review process that re-evaluates AI risks when significant changes occur (e.g., model updates, new data sources, or changes in use context).
   • BOnly update risk assessments when a major incident occurs.
   • CConduct a single annual review of all AI risk assessments, regardless of changes.
   • DFreeze the risk assessment methodology to ensure comparability over time.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A manufacturing firm has identified and measured several risks in its predictive-maintenance AI, including a high likelihood of false alarms that could cause unnecessary downtime. According to the NIST AI RMF's Manage function, what should the firm do next?

   • ADocument the risk and take no action until the system is deployed and real-world data is available.
   • BTransfer the risk to the equipment vendor without further analysis.
   • CPrioritize the false-alarm risk against other risks and select a response, such as adjusting the model threshold or adding human oversight.
   • DImmediately retire the AI system because any false alarms are unacceptable.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A company is implementing the NIST AI RMF Govern function. The company has a complex organizational structure with multiple departments involved in AI development. Which activity is most important for the Govern function?

   • ADefining clear roles and responsibilities for AI risk management, including a designated accountable owner for each AI system.
   • BSelecting the AI vendor based on cost and performance.
   • CCreating a detailed technical specification for the AI system's algorithms.
   • DDeveloping a marketing plan to communicate the AI system's benefits to customers.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A logistics company has measured the risks of its route-optimization AI and found that the system may cause unfair distribution of workloads among drivers. The risk team must decide how to respond. Which response best aligns with the Manage function's guidance?

   • ATransfer the risk to the AI vendor by requiring them to fix any issues.
   • BImmediately disable the route-optimization system to eliminate the risk.
   • CAccept the risk because the system improves overall efficiency.
   • DPrioritize this risk against other operational risks and choose a response, such as adjusting the optimization algorithm or adding driver input into route decisions.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A software company has just completed its initial implementation of the NIST AI RMF for a new chatbot. The risk manager wants to ensure continuous improvement. Which practice best supports the RMF's continuous improvement cycle?

   • ASchedule periodic reviews of the AI system's risk profile, update the current profile to reflect changes, and adjust the target profile as organizational risk tolerance evolves.
   • BFreeze the risk assessment after deployment to maintain a stable baseline for comparison.
   • CRely on the development team to informally monitor risks without updating formal profiles.
   • DConduct a single annual audit and only update documentation if a major incident occurs.
   Reveal Solution Discussion Select an answer first