56 free IAPP AIGP practice questions from the CertStash pack of 222, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 56 free here, all 222 in the pack, and each step includes the one before it.
Get all 222 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
Machine learning is best described as a type of algorithm by which?
Show answer and explanation
Correct answer: B. Systems can automatically improve from experience through predictive patterns.
Machine learning is fundamentally defined as a system's ability to automatically improve and learn from experience without being explicitly programmed. Option B captures this core concept by emphasizing automatic improvement from experience through predictive patterns, which is the defining characteristic of machine learning.
Why the other options are wrong
- A. This describes AI broadly (mimicking human intelligence) rather than the specific mechanism of machine learning (learning from experience).
- C. This focuses on statistical inference from samples to predict human intelligence, which is not the defining characteristic of machine learning.
- D. While data analysis occurs in machine learning, this describes data mining or knowledge discovery rather than the learning mechanism itself.
Question 2
Random forest algorithms are in what type of machine learning model?
Show answer and explanation
Correct answer: C. Discriminative.
Random forest algorithms are ensemble methods used for classification and regression tasks where the goal is to discriminate between classes based on input features. They are discriminative models because they learn to distinguish between different classes by modeling the decision boundaries directly, rather than modeling the probability distribution of the data itself.
Why the other options are wrong
- A. Symbolic models use explicit rules and logical representations, not the ensemble tree-based approach of random forests.
- B. Generative models learn the underlying probability distribution of data to generate new samples; random forests directly discriminate between classes.
- D. Natural language processing is a specific application domain, not a model type classification.
Question 3
A company developed AI technology that can analyze text, video, images and sound to tag content, including the names of animals, humans and objects. What type of AI is this technology classified as?
Show answer and explanation
Correct answer: B. Multi-modal model.
A system that processes and analyzes multiple types of data modalities (text, video, images, and sound) simultaneously to perform unified tagging and recognition is the definition of a multi-modal model. Multi-modal AI integrates information from different input types to achieve comprehensive understanding and analysis.
Why the other options are wrong
- A. Deductive inference involves drawing specific conclusions from general principles, not processing multiple data types.
- C. Transformative AI refers to AI with broad societal impact, not the technical architecture of processing multiple data modalities.
- D. Expert systems use knowledge bases and rules to emulate human expertise in specific domains, not unified multi-modal analysis.
Question 4
If it is possible to provide a rationale for a specific output of an AI system, that system can best be described as:
Show answer and explanation
Correct answer: C. Explainable.
Explainability specifically refers to the ability of an AI system to provide a clear rationale or explanation for its outputs and decisions. When a system can articulate why it made a particular decision, it is demonstrating explainability, which is crucial for user trust and understanding of AI behavior.
Why the other options are wrong
- A. Accountability refers to being answerable for actions and outcomes, not specifically the ability to provide rationale.
- B. Transparency means the system's operations are visible, but not necessarily that explanations are provided for specific outputs.
- D. Reliability refers to consistent and dependable performance, not the provision of decision rationales.
Question 5
CASE STUDY Please use the following to answer the next question: A company is considering the procurement of an AI system designed to enhance the security of IT infrastructure. The AI system analyzes how users type on their laptops, including typing speed, rhythm and pressure, to create a unique user profile. This data is then used to authenticate users and ensure that only authorized personnel can access sensitive resources. When prioritizing the updates to its policies, rules and procedures to include the new AI system for user authentication, the organization should:
Show answer and explanation
Correct answer: C. Ensure that any personal data used is only processed for a specific and lawful purpose.
When implementing an AI system that collects and processes personal biometric data (typing patterns), the organization must ensure compliance with data protection principles, particularly the requirement that personal data be processed only for specific, lawful, and justified purposes. This is a fundamental requirement under privacy regulations like GDPR and ensures the organization uses personal data ethically and legally.
Why the other options are wrong
- A. While third-party data sharing may be relevant, the primary concern is ensuring lawful processing of personal data for a specific purpose.
- B. Security controls are important but secondary to establishing the lawful basis and purpose for processing personal data.
- D. Policy complexity reduction for non-technical employees is a communications issue, not the primary governance priority for this scenario.
Question 6
What type of organizational risk is associated with AI’s resource-intensive computing demands?
Show answer and explanation
Correct answer: D. Environmental risk.
AI systems with resource-intensive computing demands consume significant electricity and generate substantial carbon emissions, creating environmental risks. The energy consumption required for training and running large-scale AI models contributes to climate impact and resource depletion, making this an organizational environmental risk.
Why the other options are wrong
- A. People risk relates to workforce impacts and human factors, not computational resource demands.
- B. Security risk concerns data protection and system vulnerabilities, not energy consumption.
- C. Third-party risk involves dependencies on external vendors and suppliers, not the environmental impact of computing resources.
Question 7
A hospital implements an AI system to assist doctors in diagnosing diseases based on historical patient data. Which one of the following model types best describes this system?
Show answer and explanation
Correct answer: C. Probabilistic.
A disease diagnosis system based on historical patient data uses probabilistic modeling because it must estimate the probability of different diagnoses given symptoms and patient history. Probabilistic models explicitly handle uncertainty and provide probability distributions over possible outcomes, which is essential for medical diagnosis where multiple conditions may be possible with varying likelihoods.
Why the other options are wrong
- A. Inference is the process of making predictions, not a model type classification.
- B. Statistical models encompass a broad category; probabilistic models are the specific type that handles uncertainty with probability distributions.
- D. Deterministic models produce fixed outputs for given inputs with no uncertainty, unsuitable for diagnosis where multiple outcomes have different probabilities.
Question 8
Which of the following AI uses is best described as human-centric?
Show answer and explanation
Correct answer: D. Virtual assistants are used to adapt educational content and teaching methods to individuals, offering personalized recommendations based on ability and needs.
Human-centric AI prioritizes human well-being, autonomy, and individual needs. Option D describes virtual assistants that personalize educational content based on individual ability and needs, directly supporting human development and respecting individual differences. This approach centers on enhancing human capability and choice rather than just optimizing processes or outcomes.
Why the other options are wrong
- A. While beneficial to many, improving weather predictions is more about general utility than focusing on individual human needs and autonomy.
- B. Autonomous robots reducing physical strain benefits workers, but the focus is on automation efficiency rather than personalized human development.
- C. Demand forecasting and inventory management are business optimization goals that benefit consumers generally, not human-centric applications focused on individual needs.
Question 9
Which of the following is a foundational characteristic of effective AI governance?
Show answer and explanation
Correct answer: A. Engagement of a cross-functional team.
Effective AI governance requires cross-functional collaboration involving developers, deployers, business stakeholders, compliance, ethics, and risk management teams. A cross-functional team ensures diverse perspectives on technical, legal, ethical, and operational concerns. While vendor management and policy uniformity are important, they are supporting practices rather than foundational characteristics. Public filings review is too narrow in scope and not inherently characteristic of internal governance effectiveness.
Why the other options are wrong
- B. Vendor management is important but is a supporting process, not a foundational characteristic of effective AI governance.
- C. Public filings review may provide external context but is not a core foundational element of internal governance.
- D. Uniform policies across all roles would be ineffective; different roles require different governance approaches and responsibilities.
Question 10
CASE STUDY Please use the following to answer the next question: A company is considering the procurement of an AI system designed to enhance the security of IT infrastructure. The AI system analyzes how users type on their laptops, including typing speed, rhythm and pressure, to create a unique user profile. This data is then used to authenticate users and ensure that only authorized personnel can access sensitive resources. All of the following are obligations of the company as a data controller when implementing its AI system EXCEPT?
Show answer and explanation
Correct answer: A. Ensuring that third-party processors are based in the same country as the company.
As a data controller under privacy frameworks like GDPR, the company must allow data subject access requests, implement technical and organizational security measures, and conduct impact assessments for high-risk processing. However, there is no requirement that third-party processors be based in the same country as the company. Controllers can use processors in other jurisdictions provided appropriate safeguards and contractual arrangements are in place. Geography alone is not a determining factor for processor selection under modern data protection law.
Why the other options are wrong
- B. Data subject access requests (DSARs) are a core obligation of data controllers under privacy regulations.
- C. Technical and organizational measures to protect personal data are mandatory obligations of data controllers.
- D. Conducting a DPIA/PIA for AI systems processing biometric data for authentication is a legal obligation for high-risk processing.
What people say about the full AIGP pack 5.0 from 1
I didn't think studying for the AIGP exam would be enjoyable but these study dump files made it much simpler. Thanks alot....
Question 11
CASE STUDY Please use the following to answer the next question: ABC Corp. is a leading insurance provider offering a range of coverage options to individuals. ABC has decided to utilize artificial intelligence to streamline and improve its customer acquisition and underwriting process, including the accuracy and efficiency of pricing policies. ABC has engaged a cloud provider to utilize and fine-tune its pre-trained, general purpose large language model (“LLM”). In particular, ABC intends to use its historical customer data, including applications, policies, and claims, and proprietary pricing and risk strategies to provide an initial qualification assessment of potential customers, which would then be routed to a human underwriter for final review. ABC and the cloud provider have completed training and testing the LLM, performed a readiness assessment, and made the decision to deploy the LLM into production. ABC has designated an internal compliance team to monitor the model during the first month, specifically to evaluate the accuracy, fairness, and reliability of its output. After the first month in production, ABC realizes that the LLM declines a higher percentage of women’s loan applications due primarily to women historically receiving lower salaries than men. Each of the following steps would support fairness testing by the compliance team during the first month in production EXCEPT:
Show answer and explanation
Correct answer: B. Providing the loan applicants with information about the model capabilities and limitations.
Fairness testing during production monitoring focuses on analyzing the model's decision-making patterns, understanding disparities, and identifying data gaps. Options A, C, and D all directly support fairness testing by examining decision consistency across demographics, exploring root causes through interpretability tools, and identifying training data gaps. Option B, providing applicants with information about model capabilities, is an important transparency and communication step but does not contribute to the compliance team's internal fairness testing process during the first month of monitoring.
Why the other options are wrong
- A. Validating decision-making consistency across demographic groups is a core fairness testing activity.
- C. Identifying gaps in training data for specific demographics directly supports bias mitigation planning.
- D. Using explainability tools to understand factors behind decision differences is essential for fairness analysis.
Question 12
After deploying an AI model, what must be documented?
Show answer and explanation
Correct answer: D. The model’s architecture, performance metrics and updates.
After deploying an AI model, comprehensive documentation must include the model's architecture (how it's structured), performance metrics (how well it performs), and updates (changes made post-deployment). This documentation is essential for reproducibility, maintenance, and ongoing model management. While training data, hyperparameters, and monitoring are important, option D captures the critical post-deployment documentation artifacts that stakeholders need to understand the deployed model itself.
Why the other options are wrong
- A. Training details and hyperparameters are pre-deployment documentation; stakeholder feedback alone is insufficient for comprehensive deployment documentation.
- B. While monitoring and risk documentation are important, this lacks the critical architectural and performance metric documentation needed for the deployed model.
- C. Licensing and team information, while useful, do not capture the technical documentation required to understand and maintain the actual deployed model.
Question 13
ISO 42001 International Standard offers guidance for organizations to develop trustworthy AI management systems by:
Show answer and explanation
Correct answer: B. Requiring organizations to continuously improve the effectiveness of their AI management systems.
ISO 42001 is based on continuous improvement principles similar to other ISO management system standards. It requires organizations to establish processes for continuously improving the effectiveness of their AI management systems through monitoring, measurement, and iterative enhancement, ensuring that AI governance remains effective over time.
Why the other options are wrong
- A. ISO 42001 does not impose specific minimum parameters but rather establishes a management system framework.
- C. While high-risk aspects are important, the standard's primary guidance is on establishing effective management systems broadly.
- D. ISO standards are additive; new standards do not explicitly override previous ones but rather complement the standards landscape.
Question 14
An organization is assessing the impact of four separate AI tools currently in use. Which one should it prioritize last?
Show answer and explanation
Correct answer: A. An AI system that recommends products based on customer prompts via chat.
When prioritizing AI tools for impact assessment, an organization should prioritize last those with the lowest potential for harm or highest discretionary use. Option A, an AI system recommending products via chat, has the lowest risk profile because product recommendations are non-critical, customers can easily ignore them, and negative outcomes are typically low-stakes. In contrast, options B, C, and D all involve high-stakes decisions affecting employment, customer service quality, and financial creditworthiness, making them higher-priority for assessment.
Why the other options are wrong
- B. Resume screening affects hiring decisions and has significant employment equity implications, requiring priority assessment.
- C. Emotion analysis on customer service calls affects interactions and service quality, requiring priority assessment.
- D. Creditworthiness assessment has major financial implications for customers and requires priority assessment.
Question 15
Which of the following are subjects covered by a typical impact assessment?
Show answer and explanation
Correct answer: D. Fundamental rights, data protection and safety.
A typical AI impact assessment covers fundamental rights (fairness, non-discrimination, autonomy), data protection (privacy, consent, data governance), and safety (robustness, security, reliability). These are the core ethical and regulatory domains assessed in responsible AI governance frameworks. Options A, B, and C include relevant considerations but do not accurately reflect the standard subject areas covered by formal impact assessments.
Why the other options are wrong
- A. While third-party, model, and legal risks are important, they are not the standard subjects of an impact assessment.
- B. Datasets, behavior, and tooling are implementation details, not the ethical and rights-focused subjects of impact assessments.
- C. Toxicity, accuracy, and development are technical concerns but do not comprehensively describe impact assessment subject matter.
Question 16
All of the following are common optimization techniques in deep learning to determine weights that represent the strength of the connection between artificial neurons EXCEPT:
Show answer and explanation
Correct answer: C. Autoregression, which analyzes and makes predictions about time-series data.
Autoregression is not an optimization technique for determining neural network weights. Autoregression is a statistical and machine learning technique for time-series analysis and prediction where future values are predicted based on past values. It is fundamentally different from weight optimization methods. Gradient descent, momentum, and backpropagation are all optimization techniques specifically designed to adjust and optimize the weights that represent neuron connections during neural network training.
Why the other options are wrong
- A. Gradient descent is a core optimization algorithm that iteratively adjusts weights to minimize loss.
- B. Momentum is an optimization technique that accelerates gradient descent convergence and improves stability.
- D. Backpropagation is the fundamental algorithm for computing gradients and updating weights in neural networks.
Question 17
A French medical research center wishes to develop an AI-based system which will predict the risk of serious diseases based on the patient’s genetic data. In order to do so it contracts with a tech company and provides it with patients’ data previously obtained by the center during the research. To guarantee compliance when processing special categories of personal data, the medical research center must ensure that:
Show answer and explanation
Correct answer: C. The patients have given explicit consent to using the data.
Under GDPR Article 9, processing special categories of personal data (including genetic and health data) is generally prohibited unless specific conditions are met. Explicit consent from data subjects is one of the primary lawful bases that allows such processing. While anonymization, preventive medicine purposes, and EU location may be relevant considerations, explicit consent is the fundamental requirement that must be ensured to guarantee compliance when processing genetic and health data.
Why the other options are wrong
- A. Designing for preventive medicine does not automatically authorize processing of special category data without proper legal basis.
- B. Anonymized data falls outside GDPR scope entirely, but true anonymization is difficult to achieve with genetic data and is not the requirement here; consent is still needed for non-anonymized data.
- D. The processor's location and whether it uses cloud services are operational considerations unrelated to the fundamental requirement for lawful basis to process special categories of data.
Question 18
A shipping service based in the US is looking to expand its operations into the EU. It utilizes an in-house developed multimodal AI model that analyzes all personal data collected from shipping senders and recipients, and optimizes shipping routes and schedules based on this data. As they expand into the EU, all of the following descriptions should be included in the technical documentation for their AI model EXCEPT:
Show answer and explanation
Correct answer: B. A description of the prioritization of the risks of deployment of the AI system.
Technical documentation for AI systems under the EU AI Act must include a general description of the system (A), descriptions of performance metrics and their appropriateness (C), and detailed descriptions of system elements and development processes (D). However, a description of the prioritization of deployment risks is not a standard requirement in technical documentation, risk assessments and mitigation strategies are required, but not necessarily a prioritization framework in this specific manner.
Why the other options are wrong
- A. General system descriptions are required in technical documentation.
- C. Performance metrics and their appropriateness for the specific system must be documented.
- D. Detailed descriptions of AI system elements and development processes are mandatory requirements.
Question 19
Your management consulting firm is planning to use an AI system to support its employees. Which category of operator applies to the firm in this context?
Show answer and explanation
Correct answer: D. Deployer.
When a management consulting firm implements an AI system to support its own employees' operations, it is acting as a deployer. A deployer is an organization that uses an AI system in its operations. The firm is not a provider (vendor/developer), not a distributor (reseller), and not an authorized representative (legal agent for another party). The deployer role encompasses organizations that integrate AI systems into their business processes and bear responsibility for how those systems operate within their organization.
Why the other options are wrong
- A. An authorized representative acts as a legal agent for another party, not for internal use of AI systems.
- B. A distributor sells or supplies AI systems; the firm is using the system internally, not distributing it.
- C. A provider develops or sells AI systems; the consulting firm is a user/operator of the technology, not the developer.
Question 20
What is the most important factor when deciding whether or not to select a proprietary AI model?
Show answer and explanation
Correct answer: A. What business purpose it will serve.
The most important factor when selecting any AI model, proprietary or otherwise, is understanding the business purpose it will serve. Without clarity on business objectives, use cases, and requirements, no other technical specifications matter. Options B, C, and D are important validation criteria, but they are secondary considerations that depend on first establishing what business problem needs to be solved.
Why the other options are wrong
- B. Update frequency is important for maintenance but secondary to understanding business purpose.
- C. Training data disclosure is important for transparency and bias assessment but not the most important decision factor.
- D. System cards identifying risks are valuable for risk management but come after establishing business purpose.
Question 21
What is the primary objective of continuous monitoring in the lifecycle of an AI tool?
Show answer and explanation
Correct answer: B. To track and adjust the tool’s performance in order to ensure that it meets its goals.
Continuous monitoring in AI tool lifecycles exists primarily to track performance metrics and make adjustments to ensure the tool continues meeting its intended goals. This involves comparing actual outputs against expected performance targets and making necessary calibrations. Option A is incorrect because independent algorithm evolution without human oversight violates responsible AI principles. Option C conflates monitoring with data governance. Option D addresses infrastructure maintenance, not the primary objective of monitoring performance.
Why the other options are wrong
- A. Independent evolution without human intervention contradicts responsible AI governance practices.
- C. Data privacy restrictions are a separate governance concern, not the primary objective of performance monitoring.
- D. Computational resource upgrades address infrastructure needs, not performance tracking objectives.
Question 22
CASE STUDY Please use the following to answer the next question: A local police department in the United States procured an AI system to monitor and analyze social media feeds, online marketplaces and other sources of public information to detect evidence of illegal activities (e.g., sale of drugs or stolen goods). The AI system works by surveying the public sites in order to identify individuals that are likely to have committed a crime. It cross-references the individuals against data maintained by law enforcement and then assigns a percentage score of the likelihood of criminal activity based on certain factors like previous criminal history, location, time, race and gender. The police department retained a third-party consultant to assist in the procurement process, specifically to evaluate two finalists. Each of the vendors provided information about their system’s accuracy rates, the diversity of their training data and how their system works. The consultant determined that the first vendor’s system has a higher accuracy rate and based on this information, recommended this vendor to the police department. The police department chose the first vendor and implemented its AI system. As part of the implementation, the department and consultant created a usage policy for the system, which includes training police officers on how the system works and how to incorporate it into their investigation process. The police department has now been using the AI system for a year. An internal review has found that every time the system scored a likelihood of criminal activity at or above 90%, the police investigation subsequently confirmed that the individual had, in fact, committed a crime. Based on these results, the police department wants to forego investigations for cases where the AI system gives a score of at least 90% and proceed directly with an arrest. Which AI risk would NOT have been identified during the procurement process based on the categories of information requested by the third-party consultant?
Show answer and explanation
Correct answer: A. Security.
The consultant evaluated accuracy, training data diversity (fairness), and how the system works (explainability), but did NOT assess security risks. Security encompasses threat modeling, data protection, system vulnerabilities, adversarial robustness, and malicious access prevention, none of which were addressed in the procurement criteria. The system's accuracy, potential for discrimination (via race/gender factors in training), and explainability were all examined during procurement.
Why the other options are wrong
- B. Accuracy was explicitly evaluated by the consultant as the basis for the recommendation.
- C. Explainability was addressed when vendors explained how their systems work.
- D. Discrimination risk related to fairness was partially assessable through diversity of training data, though inadequately so.
Question 23
CASE STUDY Please use the following to answer the next question: A global marketing agency is adapting a large language model (“LLM”) to generate content for an upcoming marketing campaign for a client’s new product: a hard hat designed for construction workers of any gender to better protect them from head injuries. The marketing agency is accessing the LLM through an application programming interface (“API”) developed by a third-party technology company. They want to generate text to be used for targeted advertising communications that highlight the benefits of the hard hat to potential purchasers. Both the marketing agency and the technology company have taken reasonable steps to address AI governance. The marketing company has: Entered into a contract with the technology company with suitable representations and warranties. Completed an impact assessment on the LLM for this intended use. Built technical guidance on how to measure and mitigate bias in the LLM. Enabled technical aspects of transparency, explainability, robustness and privacy. Followed applicable regulatory requirements. Created specific legal statements and disclosures regarding the use of the AI on its client’s advertising. The technology company has: Provided guidance and resources to developers to address environmental concerns. Build technical guidance on how to measure and mitigate bias in the LLM. Provided tools and resources to measure bias specific to the LLM. Enabled technical aspects of transparency, explainability, robustness and privacy. Mapped and mitigated potential societal harms and large-scale impacts. Followed applicable regulatory requirements and industry standards. Created specific legal statements and disclosures regarding the LLM, including with respect to IP and rights to data. All of the following should be included in the marketing company’s disclosures about the use of the LLM EXCEPT:
Show answer and explanation
Correct answer: B. Proprietary methods.
Proprietary methods and trade secrets should not be disclosed in marketing and compliance disclosures, as they represent confidential business information that the company has a right to protect. Disclosures should include intended purpose, legal compliance, and limitations to ensure transparency and user understanding, but proprietary methodology details remain protected intellectual property.
Why the other options are wrong
- A. Intended purpose must be disclosed so users understand how the AI is meant to be used.
- C. Compliance with applicable laws is essential information that must be communicated.
- D. Acknowledgement of limitations is crucial for transparent and responsible AI disclosure.
Question 24
An autonomous vehicle maker deploys an AI system whereby the car is equipped with AI that makes decisions locally, without calling in to the AI’s central server. The AI is capable of making decisions without waiting for a response from a remote system. The AI can continue to function if it temporarily loses its connection to the central server, such as driving through tunnels or areas where its signal is lost. The AI can periodically receive updates to its model from its central server. A subset of anonymized data can be used to train the manufacturer’s AI model, depending on user privacy settings. The manufacturer has deployed the AI using:
Show answer and explanation
Correct answer: B. An edge model.
The autonomous vehicle system described uses an edge model. The key indicators are that the AI makes decisions locally on the vehicle without contacting a central server, continues functioning during network outages, and only periodically receives model updates, all hallmarks of edge computing. The model runs directly on the device (the car) at the edge of the network. While federated learning is mentioned (using anonymized data from users), the primary deployment model being described is edge-based, as the actual decision-making happens locally on the vehicle.
Why the other options are wrong
- A. Cloud models rely on central servers for inference; this system operates independently without server calls.
- C. While federated learning concepts are mentioned regarding data collection, the deployment model is edge-based, not federated.
- D. Multimodal refers to handling multiple types of input data, not a deployment architecture.
Question 25
CASE STUDY Please use the following to answer the next question: A mid-size US healthcare network has decided to develop an AI solution to detect a type of cancer that is most likely to arise in adults. Specifically, the healthcare network intends to create a recognition algorithm that will perform an initial review of all imaging and then route records to a radiologist for secondary review pursuant to agreed-upon criteria (e.g., a confidence score below a threshold). To date, the healthcare network has: Defined its AI ethical principles. Conducted discovery to identify the intended uses and success criteria for the system. Established an AI risk committee. Assembled a cross-functional team with clear roles and responsibilities. Created policies and procedures to document standards, workflows, timelines and risk thresholds during the project. The healthcare network intends to retain a cloud provider to host the solution. It also intends to retain a large consulting firm to supplement its small data science team and help develop the algorithm using the healthcare network’s existing data and de-identified data that is licensed from a large US clinical research partner. What is the most important step for the healthcare network to take when mapping its existing data to the clinical research partner data?
Show answer and explanation
Correct answer: B. Identify fits and gaps in the combined data.
Identifying fits and gaps in the combined data is the most important step because it directly informs model development strategy, determines what populations are well-represented, reveals missing data dimensions, and highlights potential bias risks. Understanding gaps in cancer representation across demographics, age groups, or imaging types is critical for a healthcare AI system. This analysis guides decisions about additional data acquisition, feature engineering, and success metrics. Storing data securely (A) is necessary but administrative. Evaluating country of origin (C) is relevant for regulatory but secondary to understanding data completeness. Labeling and cleansing (D) follow after understanding what the combined dataset contains.
Why the other options are wrong
- A. Secure storage is operationally important but doesn't inform the development strategy like fit-gap analysis does.
- C. Country of origin has regulatory relevance but is secondary to understanding data completeness and coverage.
- D. Data labeling and cleansing are necessary preprocessing steps that follow, not precede, understanding fits and gaps.
Question 26
CASE STUDY Please use the following to answer the next question: A mid-size US healthcare network has decided to develop an AI solution to detect a type of cancer that is most likely to arise in adults. Specifically, the healthcare network intends to create a recognition algorithm that will perform an initial review of all imaging and then route records to a radiologist for secondary review pursuant to agreed-upon criteria (e.g., a confidence score below a threshold). To date, the healthcare network has: Defined its AI ethical principles. Conducted discovery to identify the intended uses and success criteria for the system. Established an AI risk committee. Assembled a cross-functional team with clear roles and responsibilities. Created policies and procedures to document standards, workflows, timelines and risk thresholds during the project. The healthcare network intends to retain a cloud provider to host the solution. It also intends to retain a large consulting firm to supplement its small data science team and help develop the algorithm using the healthcare network’s existing data and de-identified data that is licensed from a large US clinical research partner. In the design phase, which of the following steps is most important in gathering the data from the clinical research partner?
Show answer and explanation
Correct answer: D. Review the terms of use.
Reviewing the terms of use is the most important initial step when gathering licensed data from the clinical research partner because it establishes legal rights, usage restrictions, and obligations. The terms define whether the data can be combined with internal data, how it can be used, retention periods, and liability allocations. This foundational step must precede all other data activities. Combining only anonymized data (A) is a good practice but doesn't address contractual obligations. Securing data (B) and performing quality assessment (C) are subsequent steps that depend on understanding what the terms of use permit.
Why the other options are wrong
- A. While using anonymized data is a privacy best practice, it doesn't address the primary need to understand contractual permissions and restrictions.
- B. Securing data is important but comes after determining what the terms of use legally permit.
- C. Quality assessment is necessary but occurs after establishing legal rights and obligations through terms of use review.
Question 27
An artist has been using an AI tool to create digital art and would like to ensure that it has copyright protection in the United States. Which of the following is most likely to enable the artist to receive copyright protection?
Show answer and explanation
Correct answer: D. Update the images in a creative way to demonstrate that it is the artist’s.
Updating the images in a creative way to demonstrate that it is the artist's work is most likely to enable copyright protection. U.S. copyright law requires human authorship and creative contribution. While an AI generates initial outputs, the artist's creative modifications, edits, curation, and artistic judgment applied post-generation establish sufficient human authorship to qualify for protection. The training data sources, tool mechanics, and prompt logs do not demonstrate the artist's creative contribution, they document AI input rather than human creativity applied to the final work.
Why the other options are wrong
- A. Training data provenance does not establish the artist's copyright eligibility; the issue is human authorship of the final work.
- B. Understanding how the tool works does not demonstrate the artist's creative contribution to the output.
- C. A log of prompts alone does not establish sufficient human creativity; prompts are input instructions, not creative modification.
Question 28
CASE STUDY Please use the following to answer the next question: A local police department in the United States procured an AI system to monitor and analyze social media feeds, online marketplaces and other sources of public information to detect evidence of illegal activities (e.g., sale of drugs or stolen goods). The AI system works by surveying the public sites in order to identify individuals that are likely to have committed a crime. It cross-references the individuals against data maintained by law enforcement and then assigns a percentage score of the likelihood of criminal activity based on certain factors like previous criminal history, location, time, race and gender. The police department retained a third-party consultant to assist in the procurement process, specifically to evaluate two finalists. Each of the vendors provided information about their system’s accuracy rates, the diversity of their training data and how their system works. The consultant determined that the first vendor’s system has a higher accuracy rate and based on this information, recommended this vendor to the police department. The police department chose the first vendor and implemented its AI system. As part of the implementation, the department and consultant created a usage policy for the system, which includes training police officers on how the system works and how to incorporate it into their investigation process. The police department has now been using the AI system for a year. An internal review has found that every time the system scored a likelihood of criminal activity at or above 90%, the police investigation subsequently confirmed that the individual had, in fact, committed a crime. Based on these results, the police department wants to forego investigations for cases where the AI system gives a score of at least 90% and proceed directly with an arrest. During the procurement process, what is the most likely reason that the third-party consultant asked each vendor for information about the diversity of their datasets?
Show answer and explanation
Correct answer: B. To assess the fairness of the AI system.
Training data diversity is directly relevant to assessing fairness and bias in AI systems. A diverse dataset helps ensure the model performs equitably across different demographic groups and reduces the risk of discriminatory outcomes. Since this police system explicitly uses race and gender as factors, examining dataset diversity was crucial to evaluate whether the system would fairly treat different populations. Compliance, reliability, and explainability are separate concerns not directly addressed by dataset diversity metrics.
Why the other options are wrong
- A. Compliance with law is a legal matter; dataset diversity itself is not a legal compliance mechanism.
- C. Reliability refers to consistent performance, not specifically addressed by dataset diversity alone.
- D. Explainability concerns how the model's decisions are interpreted, not dataset composition characteristics.
Question 29
Which of the following typical approaches is a large organization least likely to use to responsibly train stakeholders on AI terminology, strategy and governance?
Show answer and explanation
Correct answer: A. Providing all technical employees education on AI development so they can retool and participate in the development of AI systems.
Organizations responsible for AI governance typically use role-specific, ethics-focused, and user education approaches tailored to different stakeholder needs. Providing technical AI development education to all technical employees is least likely because: (1) not all technical employees need to retool for AI development, (2) the focus should be on governance and responsible use rather than universal development capability, and (3) large organizations use specialized development teams. In contrast, training on ethics, role-specific governance, and customer education are standard responsible AI practices.
Why the other options are wrong
- B. Ethics-based training is a core component of building a responsible AI culture in large organizations.
- C. Role-specific training based on governance mode (centralized, federated, or decentralized) is a best practice for effective AI governance.
- D. Educating customers and users about AI tool capabilities and limitations is essential for transparent and responsible AI deployment.
Question 30
Which of the following use cases would be best served by a non-AI solution?
Show answer and explanation
Correct answer: A. A non-profit wants to develop a social media presence.
A non-profit developing a social media presence can be best served by non-AI solutions such as standard social media platforms, content calendars, community management tools, and manual posting schedules. This use case does not require pattern detection, personalization, automation, or complex decision-making that would justify AI complexity and cost. Options B, C, and D inherently benefit from AI's capacity for pattern recognition, personalization, and automated decision-making.
Why the other options are wrong
- B. Business analysts developing advertising campaigns benefit significantly from AI-driven insights, audience segmentation, and campaign optimization.
- C. E-commerce personalized recommendations are a core AI application that learns customer preferences and improves through machine learning.
- D. Automating answers to common customer service questions is a standard and effective AI use case that reduces manual effort and improves response time.
Question 31
CASE STUDY Please use the following to answer the next question: A premier payroll services company that employs thousands of people globally, is embarking on a new hiring campaign and wants to implement policies and procedures to identify and retain the best talent. The new talent will help the company’s product team expand its payroll offerings to companies in the healthcare and transportation sectors, including in Asia. It has become time consuming and expensive for HR to review all resumes, and they are concerned that human reviewers might be susceptible to bias. To address these concerns, the company is considering using a third-party AI tool to screen resumes and assist with hiring. They have been talking to several vendors about possibly obtaining a third-party AI-enabled hiring solution, as long as it would achieve its goals and comply with all applicable laws. The organization has a large procurement team that is responsible for the contracting of technology solutions. One of the procurement team’s goals is to reduce costs, and it often prefers lower-cost solutions. Others within the company deploy technology solutions into the organization’s operations in a responsible, cost-effective manner. The organization is aware of the risks presented by AI hiring tools and wants to mitigate them. It also questions how best to organize and train its existing personnel to use the AI hiring tool responsibly. Their concerns are heightened by the fact that relevant laws vary across jurisdictions and continue to change. If the company does not deploy and use the AI hiring tool responsibly in the United States, its liability would likely increase under all of the following laws EXCEPT:
Show answer and explanation
Correct answer: B. Product liability laws.
Product liability laws are the exception. Product liability applies to tangible goods with manufacturing defects or design flaws that cause injury. An AI hiring tool is a service/software solution, not a consumer product sold to the public. In contrast, anti-discrimination laws directly prohibit biased hiring practices, accessibility laws require equal access for disabled applicants, and privacy laws govern collection and use of applicant data. All three of these would increase liability for irresponsible deployment, but product liability laws would not apply to this hiring service.
Why the other options are wrong
- A. Anti-discrimination laws directly apply to hiring and would increase liability if the AI tool discriminates.
- C. Accessibility laws require hiring processes to be accessible to individuals with disabilities.
- D. Privacy laws apply to how applicant data is collected, stored, and used by the AI tool.
Question 32
CASE STUDY Please use the following to answer the next question: A global marketing agency is adapting a large language model (“LLM”) to generate content for an upcoming marketing campaign for a client’s new product: a hard hat designed for construction workers of any gender to better protect them from head injuries. The marketing agency is accessing the LLM through an application programming interface (“API”) developed by a third-party technology company. They want to generate text to be used for targeted advertising communications that highlight the benefits of the hard hat to potential purchasers. Both the marketing agency and the technology company have taken reasonable steps to address AI governance. The marketing company has: Entered into a contract with the technology company with suitable representations and warranties. Completed an impact assessment on the LLM for this intended use. Built technical guidance on how to measure and mitigate bias in the LLM. Enabled technical aspects of transparency, explainability, robustness and privacy. Followed applicable regulatory requirements. Created specific legal statements and disclosures regarding the use of the AI on its client’s advertising. The technology company has: Provided guidance and resources to developers to address environmental concerns. Build technical guidance on how to measure and mitigate bias in the LLM. Provided tools and resources to measure bias specific to the LLM. Enabled technical aspects of transparency, explainability, robustness and privacy. Mapped and mitigated potential societal harms and large-scale impacts. Followed applicable regulatory requirements and industry standards. Created specific legal statements and disclosures regarding the LLM, including with respect to IP and rights to data. While the marketing agency took steps to mitigate its risks, the best additional step would be to:
Show answer and explanation
Correct answer: D. Establish a governance committee to oversee the project.
While the marketing agency has completed numerous individual risk mitigation measures (impact assessments, bias guidance, technical controls, legal disclosures), establishing a governance committee would provide ongoing oversight, decision-making authority, and accountability throughout the project lifecycle. A governance committee ensures coordinated review of AI outputs, manages emerging risks, facilitates cross-functional collaboration, and provides structured governance, something that existing individual measures do not collectively accomplish. This is a best practice for responsible AI deployment.
Why the other options are wrong
- A. IP indemnity addresses intellectual property risk but does not provide holistic governance oversight of AI project risks.
- B. Evaluating industry best practices is valuable but occurs too late; the agency should establish governance before or concurrent with implementation.
- C. Third-party procurement selection does not address the governance and oversight needed for an active AI project already underway.
Question 33
A company is working to develop a self-driving car that can independently decide the appropriate route to take the driver after the driver provides an address. If they want to make this self-driving car “strong” AI, as opposed to “weak,” the engineers would also need to ensure?
Show answer and explanation
Correct answer: A. That the AI has full human cognitive abilities that can independently decide where to take the driver.
Strong AI (also called Artificial General Intelligence or AGI) refers to AI systems that possess general cognitive abilities comparable to human intelligence across diverse domains. Option A correctly identifies that strong AI requires full human-level cognitive abilities that can independently reason and decide, not merely performing a specific task like route selection.
Why the other options are wrong
- B. IP licensing concerns relate to data usage rights and legal compliance, not to the distinction between strong and weak AI.
- C. Cybersecurity protections are important for any AI system but do not define the difference between strong and weak AI.
- D. The ability to differentiate ethnic backgrounds is neither necessary nor desirable for strong AI, and this raises ethical concerns rather than defining AI strength.
Question 34
CASE STUDY Please use the following to answer the next question: ABC Corp. is a leading insurance provider offering a range of coverage options to individuals. ABC has decided to utilize artificial intelligence to streamline and improve its customer acquisition and underwriting process, including the accuracy and efficiency of pricing policies. ABC has engaged a cloud provider to utilize and fine-tune its pre-trained, general purpose large language model (“LLM”). In particular, ABC intends to use its historical customer data, including applications, policies, and claims, and proprietary pricing and risk strategies to provide an initial qualification assessment of potential customers, which would then be routed to a human underwriter for final review. ABC and the cloud provider have completed training and testing the LLM, performed a readiness assessment, and made the decision to deploy the LLM into production. ABC has designated an internal compliance team to monitor the model during the first month, specifically to evaluate the accuracy, fairness, and reliability of its output. After the first month in production, ABC realizes that the LLM declines a higher percentage of women’s loan applications due primarily to women historically receiving lower salaries than men. What is the best strategy to mitigate the bias uncovered in the loan applications?
Show answer and explanation
Correct answer: A. Retrain the model with data that reflects demographic parity.
The best strategy to mitigate discovered bias is to retrain the model with data that reflects demographic parity or more balanced demographic representation. This addresses the root cause, that the training data reflected historical salary disparities by gender. Retraining with more representative data allows the model to learn fair decision patterns that do not perpetuate historical discrimination. While documentation, third-party tools, and data deletion have roles in bias management, retraining the model with better data is the most direct and effective mitigation strategy.
Why the other options are wrong
- B. Procuring a bias assessment tool helps identify bias but does not mitigate it; it only measures the problem.
- C. Documenting bias instances is necessary for compliance but does not fix the underlying model behavior.
- D. Simply deleting gender data may obscure the problem and prevent proper analysis; it does not address the root cause in the training data distribution.
Question 35
A company deploys an AI model for fraud detection in online transactions. During its operation, the model begins to exhibit high rates of false positives, flagging legitimate transactions as fraudulent. Which is the best step the company should take to address this development?
Show answer and explanation
Correct answer: C. Deactivate the model until an assessment is made.
When a deployed AI system begins exhibiting significant operational problems (high false positive rates causing legitimate transactions to be blocked), the best immediate action is to deactivate the model until a thorough assessment can be conducted. This prevents ongoing harm to users and business operations. Continuing to operate a malfunctioning model while taking secondary measures like additional monitoring or staff training would perpetuate the problem and damage customer trust.
Why the other options are wrong
- A. Monitoring alone does not address the underlying problem and allows the harmful behavior to continue affecting customers.
- B. Recording false positives is useful for analysis, but does not stop the immediate harm being caused by the malfunctioning model.
- D. Training customer service staff is a reactive measure that addresses symptoms rather than stopping the root cause of the operational failure.
Question 36
All of the following are obligations of providers under the EU AI Act EXCEPT:
Show answer and explanation
Correct answer: D. Ensuring human oversight in accordance with the instructions for use.
Providers under the EU AI Act must maintain records (A), conduct post-market monitoring (B), and establish quality management systems (C). However, the obligation for human oversight is specifically tied to instructions for use and system capabilities, it is not an absolute obligation for all providers in all contexts, making this the exception to standard provider obligations.
Why the other options are wrong
- A. Record keeping is an explicit obligation for AI system providers.
- B. Post-market monitoring is a mandatory obligation for providers.
- C. Quality management systems are required for providers of high-risk AI systems.
Question 37
What is the most significant risk of deploying an AI model that can create realistic images and videos?
Show answer and explanation
Correct answer: C. Downstream harms.
The most significant risk of deploying AI that creates realistic images and videos is downstream harms, the broad category of negative consequences that can result from misuse of this technology. This includes deepfakes used for misinformation, fraud, harassment, election interference, and other societal harms. While copyright infringement (option A) is a real concern, downstream harms represents the more extensive and significant risk category that encompasses copyright issues plus a much broader range of potential abuses and societal impacts.
Why the other options are wrong
- A. Copyright infringement is a legitimate concern but is a narrower issue compared to the broader category of downstream harms.
- B. Security breaches are possible but are not the most significant risk specific to realistic image/video generation.
- D. Output protection relates to managing generated content but is not the most significant risk compared to downstream harms.
Question 38
The use of paid generative AI public tools is appealing because? (Choose three.)
Show answer and explanation
Correct answer: A, B, C. They are convenient to adopt; They have additional privacy and security controls; They have frequent enhancements of new features.
Paid generative AI public tools are appealing because they are convenient to adopt (no infrastructure build), have additional privacy and security controls compared to free versions, and receive frequent enhancements of new features. These three factors address ease of use, risk mitigation, and continuous improvement. Options D and E are incorrect: these tools typically do not provide full transparency into proprietary models and decision-making processes, and they do not eliminate concerns about training data, many such tools have faced scrutiny over data sourcing and copyright issues.
Why the other options are wrong
- D. Paid tools generally maintain proprietary models and do not fully disclose decision-making mechanisms.
- E. Paid tools do not eliminate data concerns; questions remain about training data sources and usage rights.
Question 39
You are a privacy program manager at a large e-commerce company that uses an AI tool to deliver personalized product recommendations based on visitors’ personal information that has been collected from the company website, the chatbot and public data the company has scraped from social media. A user submits a data access request under an applicable US state privacy law, specifically seeking a copy of their personal data, including information used to create their profile for product recommendations. What is the most challenging aspect of managing this request?
Show answer and explanation
Correct answer: D. Some of the data subject’s data is unstructured data and you cannot untangle it from the other data, including information about other individuals.
The most challenging aspect is that some of the data subject's data is unstructured and cannot be untangled from other data, including information about other individuals. When AI systems create profiles using scraped social media data, chatbot interactions, and website behavior, the resulting datasets are often intermingled and unstructured. Extracting only one user's data without exposing or inadvertently sharing other users' information is technically and logistically difficult. This directly impacts the company's ability to fulfill the access request. The other options are incorrect: synthetic data arguments are weaker legally, structured data is easier to search, and public data does not exempt disclosure obligations under most US state privacy laws.
Why the other options are wrong
- A. Synthetic data arguments are not well-established in privacy law; disclosure obligations typically still apply.
- B. Structured data is actually easier to search, compile, and review than unstructured data.
- C. Public source origin does not exempt the company from providing the data subject's personal information under state privacy laws.
Question 40
In the context of AI governance, which of the following best describes the roles and responsibilities of a developer of a proprietary model? (Choose three.)
Show answer and explanation
Correct answer: A, B, C. Joint responsibility for record keeping; Primary responsibility for ethical design; Primary responsibility for ethical testing.
Developers of proprietary models bear primary responsibility for ethical design and ethical testing, these are core development activities where ethical principles must be embedded throughout. Joint responsibility for record keeping is shared because multiple parties (developers, deployers, operators) must document decisions, testing results, and outcomes. Developers also have primary responsibility for regulatory compliance regarding their model development practices, ensuring the model meets legal and regulatory standards before handoff. Technical performance responsibility is typically joint between developers and deployers. Developers create the model, but deployers implement it in specific contexts.
Why the other options are wrong
- D. Technical performance is a shared responsibility between developer and deployer based on deployment context, not solely the developer's primary responsibility.
- E. While developers have some regulatory compliance responsibility for their development practices, broader regulatory compliance for deployment and use is typically joint responsibility with the organization deploying the system.
Question 41
What is the key feature of Graphical Processing Units (GPUs) that makes them well-suited to running AI applications?
Show answer and explanation
Correct answer: A. GPUs run many tasks concurrently, resulting in faster processing.
GPUs are well-suited for AI applications primarily because they can run many computational tasks concurrently through their massively parallel architecture. Unlike CPUs which have a few powerful cores, GPUs have thousands of smaller cores optimized for parallel processing. This parallel processing capability allows GPUs to handle the large-scale matrix operations and computations required by deep learning algorithms much faster than CPUs, making them ideal for training and inference in AI workloads.
Why the other options are wrong
- B. While memory bandwidth is important, latency difference between GPU and CPU memory access is not the primary reason GPUs excel at AI applications.
- C. GPUs are specialized for parallel computation and are not designed to run every task on a computer; they are not more robust than CPUs for general computing.
- D. This describes Moore's Law regarding chip transistor density, which applies to both GPUs and CPUs generally, not the specific feature that makes GPUs suited to AI.
Question 42
Decreasing the complexity of a machine learning model reduces variance and:
Show answer and explanation
Correct answer: A. Increases bias.
Reducing model complexity decreases variance (lower overfitting) but increases bias (underfitting), as the simpler model has less capacity to capture true patterns in data. This is a fundamental tradeoff in machine learning. Accuracy may not increase with reduced complexity; tolerance and interpretability are not directly related to this primary tradeoff.
Why the other options are wrong
- B. Decreasing complexity typically reduces accuracy due to underfitting, not increases it.
- C. Tolerance is not a standard machine learning metric affected by model complexity.
- D. Simpler models are generally more interpretable, so complexity reduction would increase interpretability, not decrease it.
Question 43
A US hospital plans to develop an AI that will review available patient data in order to propose an initial diagnosis to licensed physicians. The hospital will implement a policy that requires physicians to consider the AI proposal, but conduct their own physical examinations prior to making a final diagnosis. An important ethical concern with this plan is:
Show answer and explanation
Correct answer: B. Whether the AI was trained on a representative dataset.
The most important ethical concern is whether the AI was trained on a representative dataset. If the training data does not adequately represent the diverse patient populations the hospital serves (by demographics, medical conditions, etc.), the AI may produce biased or inaccurate diagnoses for underrepresented groups, leading to disparities in care quality. This directly impacts patient safety and fairness. While options C and D address related quality concerns, representativeness of training data is the foundational ethical issue that determines whether the system can safely serve all patients equitably.
Why the other options are wrong
- A. Economic benefit to patients, while desirable, is not the primary ethical concern in diagnostic AI safety and fairness.
- C. Physician understanding of the AI is important for appropriate use but is secondary to ensuring the AI itself is fair and accurate across populations.
- D. Comparable error rates to human physicians, while important, do not address whether those errors are distributed equitably across patient populations.
Question 44
Which of the following situations would be least likely to raise concerns under existing consumer protection laws?
Show answer and explanation
Correct answer: D. An online platform offering recommendations to its users by displaying user specific content and targeted advertisements.
Offering personalized recommendations and targeted advertising to users based on their behavior is a standard, well-established e-commerce and digital marketing practice that has long been permitted under consumer protection laws. While it raises privacy considerations, it does not inherently raise novel consumer protection concerns. In contrast, AI in credit decisions, false claims about AI accuracy, and using scraped content all trigger specific consumer protection, fair lending, unfair competition, or copyright concerns.
Why the other options are wrong
- A. AI in credit decisions raises serious fair lending and discrimination concerns under consumer protection and financial regulation laws.
- B. Making false or unsubstantiated claims that AI is as accurate as humans constitutes deceptive advertising under consumer protection laws.
- C. Using scraped digital content to generate summaries raises copyright infringement and intellectual property concerns under consumer and content protection laws.
Question 45
CASE STUDY Please use the following to answer the next question: A premier payroll services company that employs thousands of people globally, is embarking on a new hiring campaign and wants to implement policies and procedures to identify and retain the best talent. The new talent will help the company’s product team expand its payroll offerings to companies in the healthcare and transportation sectors, including in Asia. It has become time consuming and expensive for HR to review all resumes, and they are concerned that human reviewers might be susceptible to bias. To address these concerns, the company is considering using a third-party AI tool to screen resumes and assist with hiring. They have been talking to several vendors about possibly obtaining a third-party AI-enabled hiring solution, as long as it would achieve its goals and comply with all applicable laws. The organization has a large procurement team that is responsible for the contracting of technology solutions. One of the procurement team’s goals is to reduce costs, and it often prefers lower-cost solutions. Others within the company deploy technology solutions into the organization’s operations in a responsible, cost-effective manner. The organization is aware of the risks presented by AI hiring tools and wants to mitigate them. It also questions how best to organize and train its existing personnel to use the AI hiring tool responsibly. Their concerns are heightened by the fact that relevant laws vary across jurisdictions and continue to change. Which of the following measures should the company adopt to best mitigate its risk of reputational harm from using the AI tool?
Show answer and explanation
Correct answer: A. Test the AI tool pre- and post-deployment.
Testing the AI tool pre- and post-deployment is the best measure to mitigate reputational harm. Pre-deployment testing identifies bias, errors, and fairness issues before the tool affects real hiring decisions. Post-deployment testing monitors ongoing performance and detects any emerging problems. This directly addresses the company's stated concern about bias and demonstrates responsible stewardship, protecting reputation. Indemnification shifts liability but does not prevent harm; stakeholder agreement alone does not ensure responsible use; and manually screening all applicants defeats the purpose of the tool and is not practical for the company's scale.
Why the other options are wrong
- B. Indemnification transfers financial risk but does not prevent reputational harm from biased or unfair outcomes.
- C. Team agreement on selection does not ensure responsible deployment or mitigate reputational risk.
- D. Manual screening of all applicants is impractical, expensive, and contradicts the stated goal of the AI tool.
Question 46
What is the main purpose of accountability structures under the Govern function of the NIST AI Risk Management Framework?
Show answer and explanation
Correct answer: A. To empower and train appropriate cross-functional teams.
Under the NIST AI Risk Management Framework's Govern function, accountability structures are designed to empower and train appropriate cross-functional teams to take responsibility for AI governance activities. This ensures that teams have the authority, skills, and resources needed to manage AI risks effectively across the organization.
Why the other options are wrong
- B. While diversity and inclusion are important values, they are not the main purpose of accountability structures.
- C. Budgetary allocation is a resource management concern, not the primary purpose of establishing accountability.
- D. External stakeholder participation is beneficial but is not the main purpose of internal accountability structures.
Question 47
A company launched an AI model last year. One year later, the company was acquired and the entire team that developed, deployed and oversaw the model left. How can the company best maintain the model from a governance perspective going forward?
Show answer and explanation
Correct answer: A. Create a library of all documentation created during the AI lifecycle.
When a development team departs, comprehensive documentation of the entire AI lifecycle becomes critical institutional knowledge. A library of all documentation ensures continuity of governance, allows new teams to understand model design decisions, deployment considerations, and oversight procedures. This is the only option that preserves organizational knowledge independent of personnel changes.
Why the other options are wrong
- B. Non-compete clauses don't guarantee these employees will return or maintain the model effectively.
- C. An oversight committee cannot function without proper understanding of the model's history and design principles.
- D. A trust center describes public ethical principles but doesn't address internal governance and operational maintenance of the specific model.
Question 48
All of the following apply to enforcement of the EU AI Act EXCEPT:
Show answer and explanation
Correct answer: C. Rules on General Purpose AI will be enforced 6 months after the Act comes into force.
The EU AI Act's enforcement provisions include warnings for violations (A), proportionally capped fines for SMEs and startups (B), and significant fines up to €35 million or 7% of global turnover for banned AI applications (D). However, rules on General Purpose AI will be enforced 12 months (not 6 months) after the Act comes into force, making option C the exception.
Why the other options are wrong
- A. Warnings are explicitly allowed as enforcement measures for violations.
- B. SMEs and startups do receive proportional caps on fines under the Act.
- D. The €35 million or 7% turnover fine threshold is correct for banned AI applications.
Question 49
Which of the following best defines an “AI model”?
Show answer and explanation
Correct answer: D. A program that has been trained on a set of data to find patterns within the data.
An AI model is best defined as a program that has been trained on a set of data to find patterns within that data. This definition captures the essence of modern machine learning and AI: a mathematical or computational structure that has learned from training data to recognize patterns and make predictions or decisions. This distinguishes AI models from simple rule-based systems, governance frameworks, or raw datasets, as an AI model represents the learned parameters and patterns extracted during the training process.
Why the other options are wrong
- A. Defined rule-based systems describe traditional logic systems, not AI models that learn from data.
- B. A system of controls governs how an AI algorithm is used, but it is not itself an AI model.
- C. A corpus of data is the input to training, not the AI model itself; the model is created from analyzing the data.
Question 50
CASE STUDY Please use the following to answer the next question: A global marketing agency is adapting a large language model (“LLM”) to generate content for an upcoming marketing campaign for a client’s new product: a hard hat designed for construction workers of any gender to better protect them from head injuries. The marketing agency is accessing the LLM through an application programming interface (“API”) developed by a third-party technology company. They want to generate text to be used for targeted advertising communications that highlight the benefits of the hard hat to potential purchasers. Both the marketing agency and the technology company have taken reasonable steps to address AI governance. The marketing company has: Entered into a contract with the technology company with suitable representations and warranties. Completed an impact assessment on the LLM for this intended use. Built technical guidance on how to measure and mitigate bias in the LLM. Enabled technical aspects of transparency, explainability, robustness and privacy. Followed applicable regulatory requirements. Created specific legal statements and disclosures regarding the use of the AI on its client’s advertising. The technology company has: Provided guidance and resources to developers to address environmental concerns. Build technical guidance on how to measure and mitigate bias in the LLM. Provided tools and resources to measure bias specific to the LLM. Enabled technical aspects of transparency, explainability, robustness and privacy. Mapped and mitigated potential societal harms and large-scale impacts. Followed applicable regulatory requirements and industry standards. Created specific legal statements and disclosures regarding the LLM, including with respect to IP and rights to data. Which stakeholder is responsible for lawful collection of data for the training of the foundational AI model?
Show answer and explanation
Correct answer: C. The data aggregator.
In the AI supply chain, the data aggregator is responsible for lawful collection of data used to train foundational models. The data aggregator is the entity that sources, curates, and provides training data, and must ensure that collection complies with applicable data protection, intellectual property, and other legal requirements. The technology company (who builds the model) and the marketing agency (who adapts it) rely on the aggregator's lawful data sourcing.
Why the other options are wrong
- A. The marketing agency adapts the model but does not bear responsibility for the original training data collection.
- B. While the tech company may provide guidance, the data aggregator is the party responsible for actual data collection practices.
- D. The client uses the final advertising output but has no role in the foundational model's training data procurement.
Question 51
During the development of semi-autonomous vehicles, various failures occurred as a result of the sensors misinterpreting environmental surroundings, such as sunlight. These failures are an example of:
Show answer and explanation
Correct answer: B. Brittleness.
Brittleness refers to AI systems that fail or perform poorly when faced with inputs that differ slightly from their training conditions, such as unexpected environmental conditions (sunlight affecting sensors). This fragility under real-world variations is the defining characteristic of brittleness. Hallucination refers to generating false outputs; forgetting involves loss of previously learned information; uncertainty is about confidence levels in predictions, none describe the failure mode of misinterpreting environmental surroundings due to unexpected conditions.
Why the other options are wrong
- A. Hallucination is generating plausible but false information, not misinterpreting sensor data due to environmental variations.
- C. Forgetting is the loss of previously learned patterns, not failure under new environmental conditions.
- D. Uncertainty refers to model confidence levels, not systematic failures from environmental variations like sunlight.
Question 52
To assist its internal recruiters with filtering job applications, a company decides to develop in-house an AI model for the screening and ranking of job applicants’ resumes. Which of the following is a unique issue this company might face compared to using a third-party AI service?
Show answer and explanation
Correct answer: D. The company is solely responsible for compliance with relevant regulations and standards of its AI model.
When a company develops an AI model in-house for resume screening, it assumes full responsibility for ensuring compliance with all relevant regulations, employment laws, anti-discrimination statutes, and industry standards. This is unique to in-house development because third-party services typically share or assume some compliance burden. Options A and C describe challenges that exist for both in-house and third-party solutions, while option B is actually the opposite, in-house development gives the company MORE control over decisions.
Why the other options are wrong
- A. Both in-house and third-party solutions require technical expertise for deployment and maintenance.
- B. In-house development actually gives the company greater control over model decisions, not less.
- C. Cost differences exist but are not unique to in-house solutions; third-party services also have substantial costs.
Question 53
What is the best method to apply to an AI model so that it is statistically unlikely that a specific piece of training data can be identified from a model’s output?
Show answer and explanation
Correct answer: C. Differential privacy.
Differential privacy is a mathematical framework specifically designed to ensure that the presence or absence of any individual's data in a training dataset cannot be reliably determined from the model's output. It adds controlled noise during training to provide statistical guarantees about privacy. Homomorphic encryption protects data in transit/storage but doesn't prevent membership inference; data sharding and compartmentalization are organizational strategies that don't provide statistical privacy guarantees.
Why the other options are wrong
- A. Homomorphic encryption protects data confidentiality but does not prevent inference attacks that identify specific training records.
- B. Data sharding distributes data across systems but provides no statistical guarantee against membership inference attacks.
- D. Data compartmentalization is an organizational practice that does not mathematically prevent identification of training data from model outputs.
Question 54
Which of the following is a subcategory of AI and machine learning that uses labeled datasets to train algorithms?
Show answer and explanation
Correct answer: D. Supervised learning.
Supervised learning is the machine learning subcategory that uses labeled datasets to train algorithms. In supervised learning, each training example includes input features paired with the correct output label, allowing the algorithm to learn the mapping between inputs and outputs. This contrasts with unsupervised learning (which works with unlabeled data) and reinforcement learning (which uses reward signals). The labeled data is fundamental to how supervised learning algorithms function.
Why the other options are wrong
- A. Segmentation is a task or technique within machine learning, not a primary subcategory of AI and machine learning.
- B. Generative AI is a category focused on generating new content, not specifically on the use of labeled training data.
- C. Expert systems are rule-based AI systems, not a machine learning subcategory defined by labeled datasets.
Question 55
After completing model testing and validation, which of the following is the most important step that an organization takes prior to deploying the model into production?
Show answer and explanation
Correct answer: A. Perform a readiness assessment.
A readiness assessment is the critical final step that verifies the model, processes, infrastructure, and organizational capabilities are prepared for production deployment. It's a holistic gate that confirms all preceding work (testing, validation, documentation) is complete and appropriate. Option B occurs during model development, not post-testing. Option C is important but is part of preparation, not the primary gate. Option D is valuable but represents ongoing monitoring strategy, not the pre-deployment readiness check.
Why the other options are wrong
- B. Model-validation methodology is defined during development phases, before testing completion.
- C. Documenting maintenance processes is part of preparation activities, not the primary deployment gate.
- D. Identifying edge cases for post-deployment monitoring is a risk management activity, not the readiness assessment itself.
Question 56
CASE STUDY Please use the following to answer the next question: A global marketing agency is adapting a large language model (“LLM”) to generate content for an upcoming marketing campaign for a client’s new product: a hard hat designed for construction workers of any gender to better protect them from head injuries. The marketing agency is accessing the LLM through an application programming interface (“API”) developed by a third-party technology company. They want to generate text to be used for targeted advertising communications that highlight the benefits of the hard hat to potential purchasers. Both the marketing agency and the technology company have taken reasonable steps to address AI governance. The marketing company has: Entered into a contract with the technology company with suitable representations and warranties. Completed an impact assessment on the LLM for this intended use. Built technical guidance on how to measure and mitigate bias in the LLM. Enabled technical aspects of transparency, explainability, robustness and privacy. Followed applicable regulatory requirements. Created specific legal statements and disclosures regarding the use of the AI on its client’s advertising. The technology company has: Provided guidance and resources to developers to address environmental concerns. Build technical guidance on how to measure and mitigate bias in the LLM. Provided tools and resources to measure bias specific to the LLM. Enabled technical aspects of transparency, explainability, robustness and privacy. Mapped and mitigated potential societal harms and large-scale impacts. Followed applicable regulatory requirements and industry standards. Created specific legal statements and disclosures regarding the LLM, including with respect to IP and rights to data. All of the following results would be considered biased outputs from this AI system EXCEPT:
Show answer and explanation
Correct answer: A. The generated ads are sent to construction companies, not individual workers.
Sending ads to construction companies rather than individual workers is a targeting and distribution decision, not a bias in the AI system's outputs. The product is designed for all construction workers regardless of gender, so targeting by company is a legitimate marketing channel choice. The other options (B, C, D) all represent problematic biases: insufficient content for minorities, sexualized imagery, and gendered messaging both represent discriminatory AI outputs.
Why the other options are wrong
- B. Generating insufficient content for minority workers is discriminatory bias in output quality.
- C. Hyper-sexualized images of female workers represent objectifying and biased outputs.
- D. Focusing on color and style for female audiences while presumably emphasizing protection for others is gender-based bias in messaging.
That was 56 of 222.
The full IAPP AIGP pack has all 222 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 111 free as one PDF by email. Get the Half Pack →