Design Responsible AI, Security, Governance, Risk Management, and Compliance AB-100 Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A government agency is deploying an AI agent to assist citizens with benefit applications. The agency must comply with strict ethical guidelines, including transparency, accountability, and the right to human review. The agent will make initial eligibility determinations. The agency's legal team requires a documented process for citizens to appeal automated decisions. What should the architect include in the governance framework?

   • APublish the agent's decision-making algorithm on the agency's website to ensure transparency.
   • BUse a black-box model and provide no explanation for decisions, but allow citizens to request a copy of their data.
   • CAllow the agent to make final decisions without human review, but provide a generic email address for citizens to submit complaints.
   • DImplement a human-in-the-loop review process for all adverse decisions, and maintain an audit trail of the agent's reasoning and data used for each decision.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A bank is deploying an AI agent that approves small business loans. The bank's governance committee requires that the agent's decisions be explainable and that customers can request a review of any automated decision. What should the architect include in the solution?

   • AUse a complex deep learning model and provide customers with a generic explanation that the decision was based on their financial history.
   • BUse an interpretable model, such as a decision tree, and store the reasoning for each decision in an audit log.
   • CUse a black-box model but do not log any decision details to protect customer privacy.
   • DAllow the agent to make final decisions without any human review, but provide a phone number for customers to call.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A financial services firm has a proprietary AI model that predicts credit risk. The model is deployed as a REST API in Azure. The security team is concerned about model theft and adversarial attacks. Which set of measures should the architect implement to protect the model?

   • ADisable logging and monitoring to reduce the attack surface and avoid attracting attackers.
   • BExpose the model API publicly without authentication to maximize accessibility for internal applications.
   • CUse a shared API key embedded in client-side code for all users to simplify access.
   • DRequire authentication and authorization for API access, rate-limit requests, and monitor for unusual query patterns that may indicate model extraction attempts.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A legal firm is deploying an AI agent that drafts contract clauses. The agent uses a large language model and has access to a repository of confidential client documents. The firm requires that the agent cannot be tricked into revealing confidential information from other clients. The architect must design security measures to protect the agent and its data. Which approach best meets the requirement?

   • AStore all client documents in a single Azure Blob container and rely on the model's training to keep information confidential.
   • BUse a single agent instance for all clients but add a system prompt instructing the agent not to reveal other clients' information.
   • CUse a shared grounding index but filter results based on the user's email address at query time.
   • DImplement tenant-level isolation by deploying separate agent instances for each client, each with its own grounding data store and strict RBAC permissions.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A retail company deploys an AI agent that accesses customer order history and a product catalog. The agent is exposed via a public web chat interface. The security team is concerned about attackers using the chat to manipulate the agent into revealing other customers' data. Which security measure should you implement?

   • AUse a stronger encryption algorithm for the chat traffic.
   • BImplement per-user authentication and authorization so the agent only retrieves data for the authenticated user.
   • CAdd a firewall rule that blocks all incoming traffic to the chat interface.
   • DDisable the chat interface during off-peak hours.
   Reveal Solution Discussion Select an answer first