Third-Party AI Risk Management and Supply Chain Security CRAGE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium · select all that apply

   A manufacturing company is selecting a third-party AI vendor for quality control. The vendor has a good reputation but has experienced a minor security incident in the past. The company's procurement team is performing due diligence. Which actions are appropriate for AI supply chain due diligence? (Select all that apply.)

   • AReview the vendor's incident history and request details of the remediation actions taken.
   • BAccept the vendor's self-assessment of its security posture without further verification.
   • CVerify the vendor's certifications, such as ISO 27001, and ensure they are current.
   • DInclude a contractual clause that requires the vendor to notify the company of any future security incidents.
   • EDisqualify the vendor solely because of the past minor incident.
   Check answers Discussion Select an answer first
2. 7application · medium

   A company uses a third-party AI model that is distributed as a container image. The company's security team wants to implement a supply chain security control to ensure that only approved images are used in production. What should the team implement?

   • AA network firewall that blocks access to the container registry.
   • BA logging system that records all image pulls.
   • CA manual review process for every image before deployment.
   • DAn image allowlist that only permits approved and signed images to be deployed.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company uses a third-party AI model that is distributed as a container image. The company's security team discovers that the vendor's container registry was compromised and that a malicious image was published. The company has already pulled the image and is running it in production. What is the most immediate and effective response?

   • AIncrease network monitoring and hope that the malicious behavior is detected before damage occurs.
   • BContinue running the current image while waiting for the vendor to provide a patch.
   • CQuarantine the affected containers, revert to a known-good image from a verified backup, and scan all other images from the same registry for indicators of compromise.
   • DDelete the vendor's container registry account and rely on the vendor's next release.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company uses a third-party AI model for predictive maintenance. The vendor has a history of releasing updates that sometimes degrade performance. The company has a service-level agreement (SLA) with the vendor that includes penalties for performance degradation. The company's operations team wants to ensure that the model continues to meet performance thresholds. What is the best approach to manage this risk?

   • ARely on the SLA penalties to compensate for any performance degradation.
   • BImplement a continuous monitoring process that tracks model performance and triggers a review when thresholds are breached.
   • CSwitch to a different vendor with a better performance record.
   • DRequire the vendor to provide a detailed changelog for every update.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A telecommunications company uses a third-party AI model for network anomaly detection. The model is updated frequently by the vendor. The company's security team has limited resources and cannot manually review every update. The company wants to maintain effective monitoring without overburdening its team. Which strategy is most effective?

   • ARequire the vendor to provide a detailed change log for every update and manually review each one.
   • BImplement an automated validation pipeline that tests each new model version against a set of known attack scenarios and performance benchmarks before deployment, and alert the security team only when a test fails.
   • CSchedule a monthly review of the model's performance and security.
   • DDeploy all updates immediately and rely on the vendor's testing to ensure quality.
   Reveal Solution Discussion Select an answer first