AI Security Program Development and Management AAISM Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A software company is developing an AI system that will be used in a safety-critical application, such as autonomous vehicles. The company follows a waterfall development methodology. The security team wants to ensure that AI security is integrated into the SDLC, but the project manager is concerned about delays. What is the most appropriate approach?

   • AIncorporate AI security checkpoints at each phase of the waterfall, including requirements, design, development, testing, and deployment.
   • BSkip security testing to meet the project timeline, as the system will be tested by regulators.
   • CPerform a single security review after the system is fully developed, just before deployment.
   • DUse an agile approach for security testing, even though the rest of the project is waterfall.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary purpose of developing AI-specific security policies and standards?

   • ATo provide clear guidance on secure development, deployment, and operation of AI systems
   • BTo restrict the use of AI to only a few approved teams
   • CTo satisfy regulatory requirements without considering organizational goals
   • DTo replace all existing IT security policies with AI-focused ones
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A large healthcare provider has an AI security program that has been in place for two years. The program has successfully reduced incidents, but the security team is concerned that the program may become stale as new AI technologies are adopted. The team wants to ensure continuous improvement. Which approach is most effective?

   • AWait for major incidents to occur before making changes to the program.
   • BRely on the AI vendors to provide updates on security best practices.
   • CImplement a continuous improvement process that includes regular threat intelligence feeds, quarterly program reviews, and a feedback loop from incident response.
   • DConduct an annual review of the program, including threat modeling and lessons learned from incidents, and update policies and controls accordingly.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An organization has been running its AI security program for a year. A recent incident involved an adversarial attack on a computer vision model, which was not anticipated in the original risk assessment. The security team wants to improve the program to prevent similar incidents in the future. What is the most appropriate action?

   • AReplace the computer vision model with a different model that is less susceptible to adversarial attacks.
   • BIncrease the frequency of security training for all employees.
   • CUpdate the risk assessment to include adversarial machine learning threats and revise the security controls accordingly.
   • DDocument the incident and move on, as it was a one-time event.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A non-profit organization uses AI to analyze donor data and predict donation patterns. The organization has a small staff and limited budget. The leadership wants to ensure that staff are aware of AI security risks without incurring significant costs. What is the most effective training approach?

   • AProvide training only to the staff who directly handle donor data.
   • BDevelop a short, mandatory online training module that covers key AI security risks and best practices.
   • CRely on the AI vendor's training materials, as they are free.
   • DHire an external consultant to deliver in-person training to all staff.
   Reveal Solution Discussion Select an answer first