Third-Party AI Risk Management and Supply Chain Security CRAGE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A government agency is procuring an AI system for document classification. The vendor is a small startup with an innovative model but limited security resources. The agency requires the vendor to comply with strict security and ethical standards. The agency also needs the system to be deployed within six months. What is the most effective approach to manage the vendor risk?

   • AConduct a thorough vendor risk assessment and require the vendor to implement compensating controls before deployment.
   • BAccept the vendor's security posture as-is because the model is innovative and the agency needs speed.
   • CRequire the vendor to obtain SOC 2 Type II certification before the agency will consider the contract.
   • DReject the vendor immediately because the startup lacks sufficient security resources.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   When conducting a vendor risk assessment for a third-party AI system, which of the following should be evaluated as part of the vendor's ethical posture?

   • AThe vendor's compliance with SOC 2 Type II.
   • BThe vendor's use of diverse and representative training data.
   • CThe vendor's financial stability and revenue growth.
   • DThe vendor's incident response plan.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An e-commerce company is selecting a third-party AI vendor for product recommendation. The vendor has a history of data breaches but has recently improved its security posture. The company's risk team is performing due diligence. Which action is most aligned with best practices for AI supply chain due diligence?

   • AReview the vendor's incident history, request details of remediation actions, and verify current security certifications before making a decision.
   • BDisqualify the vendor immediately because of its past data breaches.
   • CAccept the vendor because it now has a security certification, without reviewing its incident history.
   • DAsk the vendor to provide a list of its other customers to assess their satisfaction.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company uses a third-party AI model that is delivered as a container image from a public registry. The company's security team wants to ensure the integrity of the model in production, but the team also needs to deploy updates quickly. Which approach best balances security and operational agility?

   • AScan the container image for vulnerabilities once at the time of initial deployment.
   • BPin the container image to a specific digest and verify the signature before deployment.
   • CUse the latest tag for the container image to always get the newest model version.
   • DCopy the container image to an internal registry and allow any internal team to update it.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A hospital is evaluating a third-party AI system for patient triage. The vendor is a startup with a promising model but limited security certifications. The hospital's legal team is concerned about liability and compliance with health data regulations. The hospital's IT team is concerned about integration with existing systems. Which approach best balances the need for innovation with risk management?

   • AAccept the vendor without additional controls because the model is innovative and could save lives.
   • BRequire the vendor to provide the model's source code and host it on the hospital's own infrastructure.
   • CConduct a phased pilot with a limited dataset, require the vendor to obtain a SOC 2 report within a defined timeframe, and include contractual clauses for data protection and liability.
   • DReject the vendor because it lacks security certifications.
   Reveal Solution Discussion Select an answer first