NIST AI RMF Alignment CRAGE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A multinational bank is adopting the NIST AI RMF. The bank's risk committee is debating whether to treat the RMF as a compliance checklist or as a risk-based framework. The compliance officer argues that a checklist ensures consistency across regions, while the CRO argues that a risk-based approach better addresses varying local risks. Which approach best aligns with the RMF's design?

   • AUse the RMF as a risk-based framework, applying its functions and outcomes flexibly and using profiles and tiers to tailor to each region's risk context.
   • BUse the RMF only for high-risk AI systems and rely on local regulations for lower-risk systems.
   • CImplement the RMF's Govern function only, since governance is the most critical component.
   • DAdopt the RMF as a compliance checklist to ensure uniform implementation across all regions.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is an example of a qualitative method used in the Measure function of the NIST AI RMF?

   • ACalculating the probability of a system failure using historical data
   • BRunning statistical tests on model performance metrics
   • CConducting expert interviews to assess the severity of potential harms
   • DMeasuring the financial impact of a risk using cost-benefit analysis
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is an example of integrating the NIST AI RMF with broader organizational governance?

   • AUsing the AI RMF only for AI systems that are externally facing
   • BIncorporating AI risk considerations into the organization's enterprise risk management (ERM) framework
   • CDelegating all AI risk decisions to a single individual without oversight
   • DKeeping AI risk management completely separate from other risk management activities
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A financial institution is deploying an AI system for loan approval. The risk team is using the NIST AI RMF Map function to understand the system's context. Which activity is most aligned with the Map function?

   • ADocumenting the intended uses, the affected stakeholders (e.g., loan applicants, regulators), and the potential positive and negative impacts on those stakeholders.
   • BSelecting a set of risk metrics and thresholds for model accuracy and fairness to be used in ongoing evaluation.
   • CImplementing a real-time monitoring dashboard to track model performance drift after deployment.
   • DRunning a quantitative stress test to calculate the probability of loan default under various economic scenarios.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company has identified a high-risk AI system that could cause significant harm if it fails. The company decides to implement additional safety measures and monitoring. Which risk response strategy is the company using?

   • AAvoidance, because the company is eliminating the risk by not using the system.
   • BMitigation, because the company is reducing the likelihood or impact of the risk.
   • CTransfer, because the company is shifting the risk to another party.
   • DAcceptance, because the company is acknowledging the risk and taking no action.
   Reveal Solution Discussion Select an answer first