Third-Party AI Risk Management and Supply Chain Security CRAGE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   During a third-party AI vendor onboarding review, a risk analyst identifies that the vendor's training data includes personal data from a jurisdiction with strict data protection laws, and the vendor has not documented lawful bases for processing. In the context of third-party AI risk identification, how should this finding be categorized?

   • AStrategic risk, because it affects the long-term alignment of the vendor with the organization's goals.
   • BCompliance and legal risk, because it exposes the organization to regulatory penalties and legal challenges.
   • COperational risk, because it affects the vendor's day-to-day model training operations.
   • DReputational risk, because the vendor's data practices could harm the organization's public image.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A defense contractor uses a third-party AI model for object detection in surveillance systems. The model is provided as a binary file with no source code. The contractor suspects that the model may have been tampered with during transit. The contractor's security team must verify the integrity of the model before deployment. Which action is most appropriate?

   • AVerify the model's cryptographic hash against the vendor's published hash, and if it matches, proceed with deployment.
   • BDeploy the model and monitor its behavior for anomalies.
   • CAsk the vendor to provide the source code for a full audit.
   • DRun the model on a test dataset and compare the outputs to expected results.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which of the following is a key component of ongoing third-party AI risk monitoring?

   • AConducting a one-time initial vendor assessment.
   • BPeriodically reviewing the vendor's security and compliance reports.
   • CRelying on the vendor's self-attestation without verification.
   • DMonitoring only at contract renewal.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   When a supply chain attack is detected in an AI component, which of the following is a key response action?

   • AImmediately notifying all customers and regulators.
   • BContinuing operations to avoid business disruption.
   • CIsolating the affected component and conducting a forensic analysis.
   • DDeleting all logs to prevent further data leakage.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A financial services firm is considering a third-party AI vendor that provides a fraud detection model. The vendor is based in a country with strong data protection laws, but the firm's customers are in the EU. The vendor's contract includes a clause allowing subprocessing of customer data in a third country without explicit consent. The firm's compliance team is reviewing the contract. Which action is most appropriate during due diligence?

   • AIgnore the clause because the vendor's model is only used for fraud detection, not for storing personal data.
   • BNegotiate the contract to require explicit consent for any subprocessing and ensure the vendor adheres to GDPR transfer mechanisms such as Standard Contractual Clauses.
   • CAccept the clause because the vendor is based in a country with strong data protection laws.
   • DRequire the vendor to store all data on-premises at the firm's own data center.
   Reveal Solution Discussion Select an answer first