AI Supply Chain Risk Management (e.g., Third Party Resources) AAIR Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A healthcare organization uses a third-party AI diagnostic tool. The vendor's service level agreement (SLA) guarantees 99.9% uptime but does not specify how the vendor handles data breaches or how the organization can verify the vendor's security controls. The organization wants to strengthen its contractual risk controls. Which addition to the contract is most critical?

   • AA clause specifying financial penalties for every hour of downtime beyond the SLA
   • BA clause requiring the vendor to notify the organization of any data breach within 72 hours
   • CA clause requiring the vendor to use encryption for all data in transit and at rest
   • DA clause granting the organization audit rights to review the vendor's security practices and incident response procedures
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company is considering using a third-party AI model for hiring decisions. The vendor's documentation indicates that the model was trained on data from a specific geographic region. The company operates globally and is concerned about compliance with local employment laws. What is the most important risk to assess?

   • AThe model may be too slow to process applications from multiple regions
   • BThe model may not perform well for candidates from other regions, leading to biased hiring decisions
   • CThe vendor may not have a data processing agreement in place
   • DThe vendor may not provide a warranty for the model's accuracy
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is an example of an industry standard that may apply to third-party AI resources?

   • AHTML5
   • BGDPR
   • CISO 9001
   • DIEEE 802.11
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A government agency is adopting an AI system that uses a third-party model and a cloud infrastructure vendor. The agency must ensure that the AI system is trustworthy and that risks across the entire supply chain are managed. Which framework is most appropriate for the agency to apply?

   • ACOBIT framework for IT governance
   • BNIST AI Risk Management Framework (AI RMF)
   • CISO/IEC 27001 information security management standard
   • DITIL service management framework
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which entity in the AI supply chain is primarily responsible for providing the computational resources needed to train large AI models?

   • AModel developers
   • BData providers
   • CDeployment platforms
   • DInfrastructure vendors
   Reveal Solution Discussion Select an answer first