2.3 Identify and Explain the Classification and Attributes of AI Applications and Apply Security Controls NETWORK-SECURITY-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A city government is deploying an AI system for predictive policing. The system uses historical crime data to allocate patrol resources. The city council is concerned about potential bias and wants to adopt the NIST AI RMF. The team has completed the GOVERN and MAP functions. Which activity is MOST critical to complete NEXT to address the council's bias concern?

   • AConduct a DPIA to assess the impact on citizens' rights.
   • BImplement a real-time monitoring dashboard for the AI system's predictions.
   • CMeasure the AI system's performance using metrics that disaggregate outcomes by demographic group.
   • DPublish the AI system's source code for public review.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A healthcare organization has sanctioned a clinical documentation AI assistant for use by physicians. The assistant integrates with the EHR and can draft patient notes. The compliance officer requires that the AI assistant's access to patient records be limited to the minimum necessary for its function. Which control BEST satisfies this requirement?

   • AConfigure the AI assistant's service account with scoped permissions that allow it to read only the specific patient data fields it needs for documentation.
   • BImplement role-based access control (RBAC) so only physicians can access the AI assistant.
   • CLog all queries made by the AI assistant to the EHR for audit purposes.
   • DEnable multi-factor authentication (MFA) for all physicians logging into the AI assistant.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is a PCI DSS requirement that applies to AI applications handling cardholder data?

   • AEnsuring all AI models are trained on public data only
   • BEncrypting cardholder data during transmission over open networks
   • CObtaining consent from cardholders before processing their data
   • DDeleting cardholder data immediately after each transaction
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary compliance obligation for an AI application that stores, processes, or transmits cardholder data?

   • AObtaining a security certification from the card brands
   • BEnsuring all data is stored on-premises
   • CRegistering with the local data protection authority
   • DComplying with PCI DSS requirements
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A European bank is deploying an AI system that assesses creditworthiness. The system processes personal data of EU customers. The DPO has determined that the processing is high-risk and requires a DPIA. What is the PRIMARY purpose of conducting the DPIA before deployment?

   • ATo document the lawful basis for processing and obtain explicit consent from all data subjects.
   • BTo identify and mitigate risks to the rights and freedoms of data subjects arising from the AI processing.
   • CTo obtain prior authorization from the supervisory authority before any processing can occur.
   • DTo demonstrate that the AI model's algorithms are free from bias and have been independently audited.
   Reveal Solution Discussion Select an answer first