Third-Party AI Risk Management and Supply Chain Security CRAGE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company is performing due diligence on a third-party AI vendor that provides a natural language processing API. The vendor claims to be compliant with ISO 27001 and has a published incident response plan. What additional evidence should the company request?

   • AThe vendor's marketing brochure and pricing details.
   • BThe vendor's social media activity.
   • CThe vendor's employee satisfaction survey results.
   • DThe vendor's ISO 27001 certificate and a summary of recent security incidents and their resolutions.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A financial institution is adopting a third-party AI model for credit scoring. The model is trained on data from multiple upstream suppliers, including credit bureaus and alternative data providers. The institution's risk team must identify and categorize AI-related risks in this supply chain. Which risk categorization approach is most comprehensive?

   • AFocus only on the model's performance metrics and ignore data provenance.
   • BRely on the primary vendor's risk assessment and do not assess upstream suppliers.
   • CTreat all suppliers as equal and apply a generic vendor risk assessment template.
   • DCategorize risks into data-related (e.g., data quality, bias), model-related (e.g., performance drift, explainability), and infrastructure-related (e.g., security of the hosting environment) categories, and assess each upstream supplier's contribution to these risks.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company operates in a jurisdiction that has enacted an AI-specific regulation requiring impact assessments for high-risk AI systems. The company uses a third-party AI system for hiring decisions. What should the company do to comply with the regulation?

   • AAsk the vendor to conduct the impact assessment on behalf of the company.
   • BRely on the vendor's existing certifications to demonstrate compliance.
   • CStop using the AI system until the regulation is clarified.
   • DConduct an AI impact assessment that covers the third-party system's data processing, risk mitigation, and oversight measures.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A retail company uses a third-party AI chatbot for customer support. The chatbot is trained on data that includes customer names and purchase history. The company discovers that the chatbot sometimes reveals one customer's purchase history to another customer. What type of third-party AI risk does this represent?

   • AInfrastructure security risk due to a vulnerability in the chatbot hosting environment.
   • BCompliance risk only because the company may violate data protection regulations.
   • CData privacy and confidentiality risk due to model behavior.
   • DModel poisoning risk because the training data was tampered with.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A healthcare organization is evaluating a vendor that supplies an AI-based diagnostic support tool. The vendor is SOC 2 Type II certified and GDPR compliant, but has had two data breaches in the past three years. The organization's compliance team requires that patient data remain within the country of treatment. Which action should the organization take during vendor risk assessment?

   • AAccept the vendor based on SOC 2 and GDPR certifications, since these cover security and privacy comprehensively.
   • BProceed with the vendor because the AI tool is only a decision-support system and does not store patient data.
   • CAsk the vendor to sign a GDPR data processing agreement, which will legally ensure data stays in the country of treatment.
   • DRequire the vendor to provide evidence of data residency controls and review the incident history to determine if the breaches affect the AI model or training data.
   Reveal Solution Discussion Select an answer first