Third-Party AI Risk Management and Supply Chain Security CRAGE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A company is considering a vendor that provides an AI-based customer analytics platform. The vendor has a bug bounty program and publishes an annual transparency report. The company's procurement team wants to perform due diligence. What should the team review?

   • AThe vendor's employee count and office locations.
   • BThe vendor's customer testimonials on social media.
   • CThe vendor's bug bounty program results and transparency report to assess security posture and incident handling.
   • DThe vendor's marketing materials to understand the platform's features.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   A comprehensive vendor risk assessment for an AI vendor should include an evaluation of the vendor's compliance posture. Which of the following is a key element of that evaluation?

   • AThe vendor's employee satisfaction scores.
   • BThe vendor's brand recognition.
   • CThe vendor's marketing strategy.
   • DThe vendor's adherence to relevant data protection regulations.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   An organization has deployed a third-party natural language processing model for customer support. The vendor releases a new version of the model every month. The organization's risk team wants to ensure that the model's performance and ethical behavior remain consistent over time. Which approach best supports ongoing third-party AI risk monitoring?

   • AConduct a one-time evaluation after each major version release, but not for minor updates.
   • BRely on the vendor's release notes and trust that the vendor has performed adequate testing.
   • CEstablish a continuous monitoring process that includes automated testing of the model's outputs on a fixed benchmark dataset and regular review of the vendor's security advisories.
   • DFreeze the model version and refuse all updates to avoid change-related risks.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which of the following is a preventive strategy to mitigate supply chain attacks targeting AI components?

   • AWaiting for a security incident to occur before taking action.
   • BDisabling all third-party integrations.
   • CImplementing a software bill of materials (SBOM) for AI models and dependencies.
   • DRelying solely on the vendor's assurances of security.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A software company uses an open-source AI library for image recognition in its product. The company discovers that the library's repository was compromised and a malicious version was published. The company has already integrated the malicious version into its product. What is the most effective mitigation strategy?

   • ARemove the library entirely and rewrite the image recognition functionality from scratch.
   • BWait for the open-source community to release a patched version and then update.
   • CAdd a note in the product documentation warning users about the potential risk.
   • DImmediately revert to a known-good version of the library, scan the entire codebase for any other compromised dependencies, and implement a software composition analysis (SCA) tool to prevent future occurrences.
   Reveal Solution Discussion Select an answer first