Risk Assessment CRAGE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium · select all that apply

   A company is performing risk identification for its AI supply chain. The company uses a third-party AI model for customer service chatbots. Which of the following are potential AI-related risks that should be identified? Select all that apply.

   • AThe chatbot may be too expensive to maintain.
   • BThe chatbot may generate offensive or biased responses, leading to reputational damage.
   • CThe chatbot may have a software bug that causes it to crash.
   • DThe vendor may go out of business, causing service disruption.
   Check answers Discussion Select an answer first
2. 32application · medium

   A government agency is evaluating AI risks from a facial recognition vendor. The agency has a very low risk tolerance for privacy violations. The risk assessment identifies a medium-likelihood, high-impact privacy risk. What should the agency do?

   • AAccept the risk because the likelihood is medium.
   • BDefer the risk until the next assessment cycle.
   • CTreat the risk as high priority and implement mitigation measures.
   • DTransfer the risk by purchasing liability insurance.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   An insurance company is assessing risks from an AI underwriting model provided by a vendor. The risk analysis shows a 20% chance of a model error that could lead to regulatory fines of $1 million and reputational damage. The company's risk appetite is low for regulatory fines. The vendor offers a warranty that would cover the fines but not reputational damage. The cost of the warranty is $150,000 per year. The company has a limited budget for risk treatment. What should the company do?

   • AAccept the risk because the likelihood is only 20%.
   • BAvoid the risk by discontinuing the use of the AI underwriting model.
   • CMitigate the risk by implementing additional model validation controls.
   • DPurchase the warranty to transfer the financial risk of fines.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   An organization has a risk treatment plan for AI supply chain risks that includes quarterly vendor assessments. After two quarters, the risk owner notices that the vendor's security posture has improved, but a new risk has emerged related to the vendor's use of a sub-subcontractor. What should the risk owner do?

   • ARemove the risk from the register because the vendor's security improved.
   • BWait until the next annual review to address the new risk.
   • CInform the vendor but take no further action.
   • DUpdate the risk register with the new risk and adjust the monitoring plan.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A bank is assessing a third-party AI fraud detection system. The risk assessment identified a low-likelihood, high-impact risk of a sophisticated cyberattack that could compromise the system. The bank's risk appetite is very low for any risk that could lead to a major security breach. The cost to fully mitigate the risk is estimated at $5 million, which the bank considers too high. What is the most appropriate risk treatment?

   • ATransfer the risk by purchasing cyber insurance.
   • BMitigate the risk by implementing additional security controls.
   • CAccept the risk because the likelihood is low.
   • DAvoid the risk by discontinuing the use of the AI fraud detection system.
   Reveal Solution Discussion Select an answer first