Risk Assessment CRAGE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company is conducting a risk assessment for its AI-based recruitment tool, which is supplied by a vendor that uses a large language model. The company is concerned about the possibility of the model generating biased recommendations that could lead to discriminatory hiring practices. In which risk category should this be documented?

   • ALegal and reputational risk
   • BTechnical risk
   • CFinancial risk
   • DOperational risk
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A manufacturing company is evaluating risks from an AI predictive maintenance system. The risk analysis shows a 10% chance of a critical system failure each year, which would cause $2 million in downtime. The company's risk appetite allows up to $150,000 in annual expected loss for operational risks. What should the company do?

   • ATransfer the risk by buying insurance for the full $2 million.
   • BTreat the risk by implementing additional monitoring and backup systems.
   • CRe-evaluate the risk using a qualitative method.
   • DAccept the risk because the chance of failure is only 10%.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A startup is developing an AI-powered recruitment tool and plans to use a third-party data provider for training data. The startup has no formal risk management process. What is the first step the startup should take to manage AI supply chain risks?

   • AAvoid using third-party data altogether.
   • BPurchase cyber insurance to cover potential liabilities.
   • CSign a contract with the data provider to limit liability.
   • DConduct a risk assessment to identify and analyze potential risks from the data provider.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A financial institution has implemented a risk monitoring process for its AI trading system. The process includes daily automated checks and monthly manual reviews. The system has been stable for a year. The institution is considering reducing the frequency of monitoring to save costs. What is the best decision?

   • AIncrease monitoring frequency to hourly to be safe.
   • BMaintain the current monitoring frequency because the risk environment can change rapidly.
   • CReduce monitoring to quarterly because the system has been stable.
   • DEliminate automated checks and rely on manual reviews.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is an example of a technical risk in an AI supply chain?

   • AA vendor's financial instability threatens their ability to deliver services
   • BA third-party model provider fails to document training data provenance
   • CA new regulation restricts the use of certain AI algorithms
   • DNegative media coverage about a supplier's labor practices
   Reveal Solution Discussion Select an answer first