Third-Party AI Risk Management and Supply Chain Security CRAGE Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A company uses a third-party AI model that is distributed as a signed package. The company's security team wants to ensure that the package has not been tampered with before deployment. What should the team do?

   • AVerify the digital signature of the package using the vendor's public key.
   • BDeploy the package to a test environment and observe its behavior.
   • CCompare the package's file size with the size listed on the vendor's website.
   • DRun a virus scan on the package.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   An organization uses a third-party AI model for credit scoring. The vendor updates the model using data from a new source that the organization has not reviewed. Which category of third-party AI risk does this scenario primarily illustrate?

   • AInfrastructure risk, because the model is hosted on third-party servers.
   • BOperational risk, because the model update process is inefficient.
   • CModel risk, because the model's behavior may change in unanticipated ways.
   • DVendor financial risk, because the vendor may go out of business.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A financial services firm uses a third-party AI model for credit scoring. The vendor releases a new version of the model that the firm deploys after only checking that the API endpoint still responds. Two weeks later, the firm notices that the model's approval rate for a protected demographic group has dropped significantly. What should the firm do first?

   • ARetrain the model in-house using the firm's own data to eliminate the bias.
   • BRoll back to the previous model version and investigate the change in model behavior.
   • CUpdate the firm's monitoring dashboard to track approval rates by demographic group going forward.
   • DContact the vendor and demand a refund for the new model version.
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   When performing due diligence on a third-party AI provider, which of the following is an important indicator of the provider's reliability and security maturity?

   • AThe provider's website design.
   • BThe provider's number of social media followers.
   • CThe provider's office location.
   • DThe provider's industry certifications, such as ISO 27001.
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   In the context of third-party AI risk management, what is the purpose of a vendor risk register?

   • ATo track and document identified risks and mitigation actions for each vendor.
   • BTo store the vendor's source code for security review.
   • CTo record the vendor's employee performance reviews.
   • DTo maintain a list of vendor marketing contacts.
   Reveal Solution Discussion Select an answer first