Third-Party AI Risk Management and Supply Chain Security CRAGE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium · select all that apply

   A healthcare organization uses a third-party AI diagnostic tool. The tool is updated regularly by the vendor. The organization's risk team wants to implement ongoing monitoring to ensure the tool remains safe and effective. Which practices are appropriate for ongoing third-party AI risk monitoring? (Select all that apply.)

   • AAutomatically test each new version of the tool on a validation dataset before allowing it to be used in production.
   • BWait for the vendor to notify the organization of any issues before taking action.
   • CConduct a one-time review of the tool's performance after the initial deployment and then rely on the vendor's updates.
   • DSubscribe to the vendor's security advisories and review them for any vulnerabilities that could affect the tool.
   • ETrack the tool's performance metrics, such as accuracy and false positive rates, on a continuous basis.
   Check answers Discussion Select an answer first
2. 22foundation · easy

   Which regulation directly addresses the security of network and information systems and is relevant to AI supply chain risk management in the European Union?

   • AThe General Data Protection Regulation (GDPR)
   • BThe Payment Card Industry Data Security Standard (PCI DSS)
   • CThe Network and Information Security (NIS) Directive
   • DThe Health Insurance Portability and Accountability Act (HIPAA)
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   In the context of AI supply chain security, which of the following is a primary security challenge specific to the data component?

   • AProtecting the data from unauthorized access during transmission.
   • BComplying with data retention policies.
   • CVerifying the integrity and provenance of the data used for training.
   • DEnsuring the data is stored in a public cloud.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is a unique attack surface in an AI supply chain that is not typically present in traditional software supply chains?

   • AThird-party authentication services.
   • BOpen-source libraries used in the AI application.
   • CThe model's training data and weights.
   • DThe CI/CD pipeline used to deploy the software.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company is evaluating two vendors for an AI-based customer service system. Vendor A has strong security certifications but a history of ethical controversies. Vendor B has no formal certifications but has a clean ethical record and a robust internal testing process. The company's board requires both security and ethical rigor. What should the company do?

   • AChoose Vendor A because security certifications are more important than ethical controversies.
   • BConduct a detailed risk assessment of both vendors, including their security and ethical postures, and make a decision based on the findings.
   • CChoose Vendor B because a clean ethical record is more important than certifications.
   • DAsk the vendors to form a joint venture to combine their strengths.
   Reveal Solution Discussion Select an answer first