Third-Party AI Risk Management and Supply Chain Security CRAGE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company uses a third-party AI model for resume screening. The vendor's model is hosted on the vendor's cloud infrastructure, and the company sends resumes to the vendor for processing. The company is concerned about the risk of the vendor's cloud provider having a data breach. How should the company categorize this risk?

   • AAs a regulatory risk, since the company may violate data protection laws.
   • BAs a third-party infrastructure risk, since the vendor relies on a cloud provider that may have vulnerabilities.
   • CAs a model risk, since the AI model may make biased decisions.
   • DAs an operational risk, since the model may be unavailable.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A logistics company uses a third-party AI route optimization service. The service is critical to daily operations. The company's risk manager wants to implement ongoing monitoring to detect any degradation in the service's performance or security. Which monitoring approach is most effective?

   • AImplement automated performance monitoring that tracks key metrics such as route accuracy and response time, and subscribe to the vendor's security bulletins.
   • BConduct a manual review of the vendor's performance every six months.
   • CSet up a monthly meeting with the vendor to discuss any issues.
   • DRely on the vendor's service level agreement (SLA) to ensure performance and security.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A global bank is deploying an AI-based anti-money laundering (AML) system. The vendor is based in a country that is not a member of the EU, but the bank operates in multiple EU member states. The bank's compliance team must ensure that the vendor's data processing complies with GDPR. The vendor proposes to process all data in its home country. Which action is most appropriate?

   • AAccept the vendor's proposal because the bank is a global entity and GDPR does not apply to non-EU vendors.
   • BRequire the vendor to store all data within the EU, even if it means higher costs.
   • CAssess whether the vendor's home country provides an adequate level of data protection, and if not, implement appropriate safeguards such as Standard Contractual Clauses or Binding Corporate Rules.
   • DAsk the vendor to sign a data processing agreement that includes GDPR terms, without further assessment.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A multinational corporation is deploying an AI-based HR system across several countries, including the EU and the US. The vendor's data processing practices differ by region. The corporation's legal team is reviewing the vendor's compliance with applicable regulations. Which action is most appropriate to ensure regulatory compliance?

   • AAsk the vendor to store all data in the US to avoid EU regulations.
   • BRely on the vendor's global privacy policy as sufficient for all regions.
   • CApply the most stringent regulation (GDPR) to all regions to simplify compliance.
   • DMap the data flows for each region, verify that the vendor's practices align with GDPR and relevant US state laws, and update contracts to include region-specific data processing terms.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A multinational corporation is selecting a vendor to provide an AI-based translation service for customer communications. The vendor has offices in several countries and uses subprocessors for data storage. The corporation's legal team requires that the vendor's subprocessors be disclosed and that data transfers comply with applicable cross-border regulations. What should the corporation include in the vendor contract?

   • AA clause that requires the vendor to store all data in the corporation's home country.
   • BA clause requiring the vendor to list all subprocessors and obtain approval before adding new ones.
   • CA clause that holds the vendor liable for any data breach regardless of cause.
   • DA clause that allows the vendor to change subprocessors as long as they are in the same country.
   Reveal Solution Discussion Select an answer first