AI Incident Response, BIA, Business Continuity, and Disaster Recovery AAIR Practice Questions (Page 8)

Questions 36–36

1. 36application · medium

   A fraud-detection model suddenly begins approving high-risk transactions. The data science team confirms the model's training data was tampered with, and the security team suspects an insider. The incident response team is activated. Which action should be taken FIRST during the containment phase?

   • AIsolate the affected model and disable its ability to approve transactions.
   • BNotify the organization's legal and communications teams about the incident.
   • CRetrain the model on a clean dataset to restore its accuracy.
   • DPreserve the tampered training data as evidence for forensic analysis.
   Reveal Solution Discussion Select an answer first