NIST AI RMF Alignment CRAGE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   What do tiers in the NIST AI RMF represent?

   • AThe complexity of the AI algorithms used
   • BThe severity of risks associated with a specific AI system
   • CThe level of rigor and sophistication of an organization's AI risk management practices
   • DThe number of AI systems an organization deploys
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What is the primary purpose of the NIST AI Risk Management Framework (AI RMF)?

   • ATo provide a voluntary, flexible framework that helps organizations manage risks associated with AI systems throughout their lifecycle
   • BTo replace existing organizational risk management frameworks with a single standardized approach
   • CTo certify AI systems as safe and trustworthy before they are deployed in any environment
   • DTo mandate specific technical controls that all AI systems must implement to be legally compliant
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A global consumer-goods company is implementing the NIST AI RMF. The company's regions have very different levels of AI risk management maturity. The central team wants to set a common target profile while allowing regions to progress at their own pace. Which approach best aligns with the RMF's use of profiles and tiers?

   • AUse a single tier for all regions to simplify reporting and comparison.
   • BRequire all regions to adopt the highest tier immediately to ensure rapid alignment.
   • CDefine an enterprise-wide target profile and let each region develop its own current profile, selecting a tier that reflects its current maturity and a roadmap to reach the target.
   • DLet each region independently define its own target profile without central coordination.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   In the NIST AI RMF, what is the purpose of a profile?

   • ATo tailor the framework to an organization's specific risk management needs and objectives
   • BTo provide a one-size-fits-all set of mandatory controls for all AI systems
   • CTo certify that an AI system meets all regulatory requirements
   • DTo replace the need for continuous risk monitoring
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A government agency is integrating the NIST AI RMF with its existing enterprise risk management (ERM) framework, which is based on ISO 31000. The agency's leadership wants to avoid duplicate processes and ensure that AI risks are considered alongside other organizational risks. Which approach best aligns with the RMF's guidance on integration?

   • ARun the RMF as a separate, parallel process to ensure AI risks receive dedicated attention.
   • BReplace the ISO 31000 framework with the NIST AI RMF to avoid confusion between the two.
   • CAdopt the RMF only for AI systems that are considered high-risk, and leave other AI systems unmanaged.
   • DMap the RMF's functions and outcomes to the existing ERM framework's processes and use the same risk register and escalation paths.
   Reveal Solution Discussion Select an answer first