AI Threat and Vulnerability Management AAISM Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A security architect is creating a threat model for an AI system that uses a public dataset for training and is deployed in a containerized environment. The architect wants to identify the most critical attack surface. Which element should be considered the highest-risk attack surface?

   • AThe container orchestration platform, because it is a general infrastructure risk.
   • BThe public dataset itself, because it may contain malicious data.
   • CThe model's inference API, because it is exposed to the internet.
   • DThe training data pipeline, because it is a common target for data poisoning attacks.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A multinational corporation is implementing a vulnerability management program for its AI systems. The program must comply with GDPR and industry regulations. Which practice is most important to include?

   • AShare vulnerability information publicly to promote transparency.
   • BUse only open-source AI models to avoid vendor lock-in.
   • CConduct vulnerability assessments only when a new model is deployed.
   • DDocument the risk assessment and remediation decisions for each AI vulnerability.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A healthcare startup uses a proprietary diagnostic model hosted as a public API. A competitor launches a similar service, and the startup suspects model extraction. The startup's security team must respond without disrupting clinical operations. Which response is most appropriate?

   • AImplement rate limiting and monitor API query patterns for anomalies, then retrain the model with a different architecture if extraction is confirmed.
   • BAdd a watermark to the model's outputs and take legal action against the competitor.
   • CImmediately shut down the public API and move the model to a private network.
   • DIncrease the model's prediction confidence threshold to make it harder to extract.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is the purpose of risk scoring in AI vulnerability management?

   • ATo replace the need for manual security reviews
   • BTo prioritize vulnerabilities based on their potential impact and likelihood of exploitation
   • CTo assign a monetary value to each vulnerability
   • DTo automatically remediate all vulnerabilities
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which factor is typically considered when prioritizing AI vulnerabilities?

   • AThe number of lines of code in the model
   • BThe age of the model's training data
   • CThe programming language used to develop the model
   • DThe business impact of the affected AI system
   Reveal Solution Discussion Select an answer first