Design Responsible AI, Security, Governance, Risk Management, and Compliance AB-100 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which activity is part of a responsible AI review?

   • ATuning hyperparameters to improve accuracy
   • BBenchmarking the model's latency against competitors
   • CAssessing the AI solution for potential bias in its outputs
   • DSelecting the cheapest cloud region for deployment
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A technology company is developing an AI agent that automatically summarizes news articles. The agent uses a fine-tuned model that was trained on a dataset containing biased articles. The company's responsible AI team is concerned about the agent producing biased summaries. The architect must propose a mitigation strategy that balances fairness, accuracy, and cost. What should the architect do?

   • AAdd a post-processing filter that removes any summary containing words associated with protected attributes.
   • BDeploy the model as-is and rely on user feedback to identify biased summaries over time.
   • CUse Azure Machine Learning's fairness assessment tools to evaluate the model's outputs across different demographic groups, and retrain the model with a balanced dataset if bias is detected.
   • DIncrease the model's complexity to improve accuracy, assuming that a more accurate model will be less biased.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A healthcare organization uses an AI agent that retrieves patient data from a custom grounding index. The data science team needs to update the index with new clinical notes, but only the compliance officer should be able to export or view the raw notes. The agent itself must only access de-identified summaries. Which access control design should you implement?

   • AProvide the agent with direct database credentials that allow it to retrieve any data, including raw notes.
   • BEncrypt the raw notes and give the decryption key to both the data science team and the compliance officer.
   • CGrant the data science team write access to the index and the compliance officer read access to raw notes.
   • DUse role-based access control (RBAC) so data scientists can update the index but cannot read raw notes, and the compliance officer has read access to raw notes.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A bank deploys an AI agent that provides loan pre-approval decisions. The agent has access to customer financial data and a decision model. The security team wants to protect the agent from unauthorized access, but the business requires that customers can check their application status without logging in. Which approach balances security and business requirements?

   • AProvide a public API key that customers can use to access any application status.
   • BAllow anonymous access to the status endpoint but restrict the agent's data access to only the customer's own application ID.
   • CDisable the status-check feature entirely to eliminate risk.
   • DRequire customers to log in with multi-factor authentication before checking status.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A defense contractor fine-tunes a proprietary model for document classification. The model is deployed in a private Azure environment. The contractor wants to protect the model from being extracted by users who send many queries. Which strategy should you implement?

   • AMake the model's weights publicly available to promote transparency.
   • BUse a smaller model that is less valuable to extract.
   • CImplement rate limiting and monitor query patterns for anomalies.
   • DAllow unlimited queries to the model to maximize usability.
   Reveal Solution Discussion Select an answer first