NIST AI RMF Alignment CRAGE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which of the following is an activity performed during the Map function of the NIST AI RMF?

   • ASelecting risk response strategies such as mitigation or acceptance
   • BDefining risk tolerance levels for the organization
   • CIdentifying the intended uses and potential misuses of the AI system
   • DDeveloping metrics to evaluate AI system performance
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company is measuring the risks of an AI system that automates customer service responses. The team has collected data on response accuracy and customer satisfaction. Which metric is most relevant for measuring AI risk?

   • AThe cost savings achieved by automating customer service.
   • BThe number of customer service tickets handled per day.
   • CThe rate of incorrect or harmful responses generated by the AI system.
   • DThe number of employees who use the AI system.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   How does the NIST AI RMF integrate with an organization's broader governance structures?

   • ABy requiring the creation of a separate, independent risk management department
   • BBy replacing all existing risk management frameworks with the AI RMF
   • CBy aligning AI risk management with existing enterprise risk management and governance processes
   • DBy focusing only on technical risks and ignoring organizational governance
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A financial services firm is adopting the NIST AI RMF to manage risks of a new credit-scoring model. The board has asked for a framework that aligns with the firm's existing enterprise risk management (ERM) process and allows tailoring to different business units. The CISO suggests adopting the RMF's core functions verbatim as a one-size-fits-all compliance checklist. Which approach best aligns with the NIST AI RMF's design?

   • AAdopt only the Govern function because it aligns with the board's oversight responsibilities and avoids duplicating existing ERM processes.
   • BImplement the RMF's functions as a fixed set of controls that every business unit must follow identically to ensure consistency across the enterprise.
   • CUse the RMF's Govern, Map, Measure, and Manage functions as a flexible structure, and develop profiles and tiers to tailor risk management to each business unit's context.
   • DReplace the firm's existing ERM process with the NIST AI RMF to avoid conflicts between the two frameworks.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   How can an organization use feedback to continuously improve its AI risk management under the NIST AI RMF?

   • ABy waiting for regulatory changes before updating practices
   • BBy relying solely on external audits without internal feedback
   • CBy keeping risk management practices static once they are implemented
   • DBy regularly reviewing and updating risk management practices based on lessons learned and changing conditions
   Reveal Solution Discussion Select an answer first