AI Supply Chain Risk Management (e.g., Third Party Resources) AAIR Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security company uses a third-party AI model for threat detection. The model is proprietary, and the vendor does not disclose its architecture. The company is concerned about adversarial attacks that could fool the model. What is the most effective mitigation strategy?

   • ASwitch to an open-source model that is more transparent
   • BRequire the vendor to disclose the model's architecture
   • CAccept the risk because the model is proprietary and cannot be assessed
   • DImplement a robust monitoring system that detects unusual model behavior and triggers alerts
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A bank uses a third-party AI model for fraud detection. The model was accurate at deployment, but recent performance has declined, and the bank suspects the model's behavior is changing due to shifts in the underlying data. What is the most appropriate action to mitigate this risk?

   • AImplement continuous monitoring of the model's performance metrics to detect drift
   • BReplace the model immediately with a rule-based system
   • CRequest the vendor to provide a new model version
   • DIncrease the model's sensitivity to catch more fraud cases
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Why is data lineage important in AI supply chain risk management?

   • AIt eliminates the need for data validation
   • BIt reduces the cost of cloud storage
   • CIt ensures transparency and traceability of data used in AI models
   • DIt increases the speed of model training
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which standard provides requirements for an AI management system, including supply chain considerations?

   • AISO/IEC 27001
   • BISO/IEC 42001
   • CISO/IEC 20000
   • DISO 31000
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company is evaluating a third-party AI vendor for a critical application. The vendor has a strong security posture but has been criticized for using data without proper consent. The company's legal team is concerned about reputational and regulatory risks. What is the most important factor to consider in the due diligence process?

   • AThe vendor's data governance practices and evidence of lawful data acquisition
   • BThe vendor's customer support and service level agreements
   • CThe vendor's security certifications, such as ISO/IEC 27001
   • DThe vendor's financial stability and market reputation
   Reveal Solution Discussion Select an answer first