Third-Party AI Risk Management and Supply Chain Security CRAGE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company uses a third-party AI model that is hosted on the vendor's infrastructure. The vendor uses a machine learning operations (MLOps) platform to manage model versions. The company is concerned about the risk of an attacker gaining access to the MLOps platform and modifying the model. What is the primary attack surface?

   • AThe company's employee training data.
   • BThe company's internal network, which is used to access the vendor's API.
   • CThe MLOps platform, which is a central point for model management and a target for attackers.
   • DThe vendor's customer support portal.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A manufacturing company uses a third-party AI vision system to inspect products on an assembly line. The system is updated weekly with new model weights downloaded from the vendor's server. The company's security team is concerned about the integrity of the model weights during download. Which attack surface is most directly relevant?

   • AThe vendor's internal employee training program.
   • BThe physical security of the assembly line cameras.
   • CThe model update channel, where an attacker could intercept and modify the weights.
   • DThe company's internal firewall configuration.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company uses a third-party AI model for fraud detection. The vendor's model is updated monthly, and the company has a monitoring process that tracks the model's false positive rate. After a recent update, the false positive rate increases significantly. What should the company do as part of ongoing third-party AI risk monitoring?

   • AImmediately terminate the contract with the vendor.
   • BIgnore the increase because the vendor is responsible for model performance.
   • CAdjust the monitoring threshold to hide the increase.
   • DInvestigate the cause of the increase and coordinate with the vendor to understand the model change.
   Reveal Solution Discussion Select an answer first
5. 4application · medium · select all that apply

   A university is procuring an AI system for student admissions. The vendor is a large tech company with a strong security reputation. The university's ethics committee is concerned about potential bias in the admissions model. Which actions should the university take as part of a comprehensive vendor risk assessment? (Select all that apply.)

   • AInclude contractual clauses that require the vendor to disclose any future changes to the model that could affect fairness.
   • BRely on the vendor's security certifications as sufficient evidence of ethical compliance.
   • CAsk the vendor to provide a list of other universities using the system to gauge satisfaction.
   • DReview the vendor's algorithmic impact assessment and any independent audits of the model.
   • ERun the model on historical admissions data to check for disparate impact across demographic groups.
   Check answers Discussion Select an answer first
6. 5foundation · easy

   During AI supply chain due diligence, which of the following documents should be reviewed to understand the vendor's liability and data handling obligations?

   • AThe vendor's marketing brochures.
   • BThe vendor's employee handbook.
   • CThe contract and service level agreements (SLAs).
   • DThe vendor's product roadmap.
   Reveal Solution Discussion Select an answer first