Third-Party AI Risk Management and Supply Chain Security CRAGE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A healthcare organization is evaluating a vendor that provides a pre-trained diagnostic imaging model. The vendor hosts the model in its own cloud environment and offers an API for inference. The organization's security team is concerned about the vendor's data handling practices and the model's behavior on diverse patient populations. Which action best addresses the organization's risk identification and assessment needs before signing a contract?

   • ARequest the vendor's SOC 2 Type II report and a model card, then conduct a targeted bias evaluation using the vendor's API with representative test data.
   • BDefer the assessment until after the contract is signed and the model is integrated into production.
   • CAccept the vendor's self-attestation of compliance with HIPAA and rely on the contract's liability clause for any issues.
   • DRequire the vendor to provide the full training dataset and model weights so the organization can perform its own audit.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   When managing third-party AI risks, which standard provides a framework for information security management systems (ISMS) that vendors can be certified against?

   • AISO 27001
   • BISO 9001
   • CISO 14001
   • DISO 45001
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A government agency is procuring an AI system for resume screening. The vendor claims to be compliant with the agency's national AI ethics guidelines. The agency's procurement team must conduct a vendor risk assessment. Which combination of actions would provide the most comprehensive assessment?

   • AConduct a technical review of the model's code only, without testing its outputs.
   • BAsk the vendor to sign a contract clause that holds it liable for any discriminatory outcomes.
   • CReview the vendor's algorithmic impact assessment, verify its certification against the national guidelines, and run the system on a test dataset that includes protected attributes to check for bias.
   • DRely on the vendor's self-reported compliance statement and its marketing materials.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A company uses a third-party AI model for real-time fraud detection. The vendor updates the model frequently, and the company has a monitoring system that tracks the model's accuracy and false positive rate. Recently, the monitoring system flagged a significant drop in accuracy. The company's incident response team is unsure whether the drop is due to a vendor update or a change in the input data distribution. What should the company do first?

   • ACheck whether the vendor released a new model version around the time of the drop and compare the model's performance on a holdout dataset.
   • BIncrease the monitoring frequency to gather more data before taking action.
   • CContact the vendor and ask them to revert the update.
   • DImmediately roll back to the previous model version.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A company's AI system uses a third-party pre-trained model that is integrated into a larger application. The company discovers that the model's training data included maliciously crafted examples that cause the model to misclassify certain inputs. This is an example of which type of supply chain attack, and what is the most effective mitigation?

   • AAdversarial attack; mitigate by adding more training data.
   • BModel inversion; mitigate by encrypting the model weights.
   • CModel poisoning; mitigate by validating the model's behavior on a test set before deployment.
   • DData exfiltration; mitigate by monitoring network traffic.
   Reveal Solution Discussion Select an answer first