Business Continuity and Incident Response AAISM Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A recruitment firm uses an AI system to screen job applicants. An internal audit reveals that the system is rejecting a higher proportion of applicants from a certain demographic group, even though the training data was balanced. The behavior is traced to a subtle bias in the model's feature weighting. Which type of AI-specific incident is this?

   • AData drift
   • BAdversarial attack
   • CUnintended bias
   • DModel poisoning
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is an example of a tabletop exercise for an AI incident response plan?

   • AA live test that injects adversarial attacks into the AI model
   • BA discussion-based session where team members walk through a hypothetical AI incident scenario
   • CA full-scale simulation that shuts down production AI systems
   • DA code review of the AI application
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is a key output of a business impact analysis for an AI system?

   • AThe source code of the AI application
   • BThe marketing strategy for the AI product
   • CA list of all AI model hyperparameters
   • DRecovery time objective (RTO) and recovery point objective (RPO)
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is a unique incident type specific to AI systems?

   • ASQL injection
   • BPhishing
   • CModel poisoning
   • DDenial of service
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security operations center (SOC) detects unusual activity in an AI-based image recognition system used for access control. The system begins granting access to unauthorized individuals when presented with specially crafted images. The SOC suspects an adversarial attack. Which action is MOST appropriate for the SOC to take during the detection phase?

   • AImmediately shut down the entire access control system.
   • BRestore the model from a backup.
   • CNotify the public about the incident.
   • DAnalyze the crafted images to understand the attack vector and identify affected users.
   Reveal Solution Discussion Select an answer first