2.3 Identify and Explain the Classification and Attributes of AI Applications and Apply Security Controls NETWORK-SECURITY-ARCHITECT Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A government agency is adopting the NIST AI Risk Management Framework (AI RMF) to govern its AI systems. The agency has just completed the 'GOVERN' function by establishing policies and processes for AI risk management. Which activity BEST represents the NEXT logical step in the framework's core functions?

   • AMap the AI system's context, intended uses, and potential harms to stakeholders.
   • BMeasure the AI system's performance against established metrics and thresholds.
   • CConduct a third-party audit of the AI system's compliance with the agency's policies.
   • DManage risks by implementing controls and response plans.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following is a core function of the NIST AI Risk Management Framework?

   • AGovern
   • BRespond
   • CRecover
   • DDetect
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A financial services firm wants to allow its marketing team to use a new AI-powered copywriting tool. The CISO has approved the tool but requires that it not be used with customer PII. The security team has already deployed the tool and integrated it with the corporate identity provider. What should the security team configure NEXT to enforce the CISO's requirement?

   • ARestrict access to the AI tool to only the marketing team members who have completed privacy training.
   • BCreate a usage policy that prohibits entering customer PII and require users to acknowledge it annually.
   • CDisable the AI tool's ability to store conversation history in its vendor cloud.
   • DConfigure a data loss prevention (DLP) policy that blocks or redacts sensitive data patterns before they are submitted to the AI tool.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A consulting firm has sanctioned an AI meeting summarization tool. The tool records and transcribes meetings. The firm's security policy requires that only authorized employees can access the summaries and that all access is logged. Which combination of controls BEST satisfies this requirement?

   • AConfigure the tool to automatically delete summaries after 30 days.
   • BImplement RBAC for the tool and enable audit logging of all access to summaries.
   • CEnable MFA for all employees and require them to use a corporate VPN.
   • DUse a DLP policy to block summaries containing client names from being shared externally.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A payment processor uses an AI fraud-detection system that analyzes cardholder transactions in real time. The system stores transaction data for model training. To maintain PCI DSS compliance, which control is REQUIRED for the AI system's storage of cardholder data?

   • ARestrict access to the AI system to only the fraud analysts who need it.
   • BConduct an annual risk assessment of the AI model's accuracy and bias.
   • CEncrypt the stored cardholder data using strong cryptography.
   • DTokenize all cardholder data before it enters the AI model's training pipeline.
   Reveal Solution Discussion Select an answer first