AI Security Architecture and Design AAISM Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A multinational corporation is building a global AI system for supply chain optimization. The system ingests data from various regional offices, some of which are in countries with strict data localization laws. The data must be aggregated for training, but the company wants to minimize compliance risk. Which architecture best addresses this constraint?

   • AUse a federated learning approach where models are trained locally and only model updates are shared.
   • BAnonymize all data before transfer to the central location.
   • CUse a multi-region deployment where each region trains its own model and the models are not shared.
   • DTransfer all data to a central data center in a country with favorable data laws.
   Reveal Solution Discussion Select an answer first
2. 12foundation · medium

   Which infrastructure security control is specifically used to protect the confidentiality of AI models and training data stored on disk?

   • AIntrusion detection system
   • BAccess control lists
   • CEncryption at rest
   • DNetwork segmentation
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A government agency is deploying an AI system for border control. The system uses facial recognition and must operate in real-time. The threat model identifies a risk that an attacker could craft physical perturbations (e.g., special glasses) to evade detection. The agency also has a strict requirement that the system must not be taken offline for maintenance during peak hours. Which mitigation strategy best balances the threat and the operational constraint?

   • ASchedule regular model retraining during off-peak hours to incorporate new attack patterns.
   • BImplement adversarial training to make the model robust to physical perturbations.
   • CIncrease the sensitivity of the facial recognition threshold to reduce false negatives.
   • DDeploy a secondary verification system that uses a different biometric modality.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company has deployed a machine learning model as a service that predicts equipment failure. The model is accessed via a REST API. The security team wants to prevent unauthorized users from querying the model and to detect if the model is being used in a way that could indicate an attack. Which set of controls should be implemented?

   • ANetwork segmentation and a web application firewall (WAF) to protect the API.
   • BAPI keys for authentication, rate limiting, and logging of all API requests.
   • CEncrypt the model file and store it in a secure vault.
   • DUse a VPN for all API traffic and disable public access to the API.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company is conducting a security architecture review of its AI system. The review finds that the system uses a shared model for multiple clients, and each client's data is stored in the same database with a client ID field. The review also notes that the system does not have a mechanism to prevent a client from accessing another client's data if the client ID is manipulated. Which gap is most critical to address?

   • ALack of monitoring: the system should log all access attempts.
   • BLack of least privilege: clients should only have access to their own data.
   • CLack of input validation: the client ID should be validated.
   • DLack of encryption: data should be encrypted at rest.
   Reveal Solution Discussion Select an answer first