100 Free AAISM Practice Questions and Answers

Why A is right

Reporting to the AI governance committee ensures the inconsistency is escalated through proper organizational channels for coordinated review, investigation, and decision-making before taking unilateral action. This is the manager's appropriate first step when quality issues emerge. Checking scorecards (B) and retraining (C) are technical interventions that may not address root causes. Reverting to a prior version (D) may mask the problem and avoid necessary investigation into what caused the degradation.

Why D is right

An email summarization plugin processes sensitive personal information. The greatest risk is inadequate controls over parameters, which could allow attackers to manipulate input parameters to extract sensitive data, bypass security controls, or cause the AI model to behave unexpectedly. This is a direct threat to the confidentiality and integrity of user emails. While the other options represent legitimate concerns, parameter control directly impacts how user data is processed and protected within the AI system.

Why B is right

Data poisoning attacks are designed to corrupt training data to manipulate model behavior during the development and training phases. By introducing malicious or incorrect data into the training dataset, attackers can cause the model to learn incorrect patterns and make biased or incorrect predictions. This primary goal is about influencing how the model is trained, not about stealing data (confidentiality) or only affecting outputs, but rather about fundamentally compromising the model's learning process.

Why B is right

Building trust for decisions and predictions made by AI models is a primary objective of responsible AI services because it addresses stakeholder confidence, transparency, and accountability. While data confidentiality (A) is important for security, autonomy (C) contradicts responsible oversight, and learning capability (D) is a technical feature rather than a responsibility objective, trust is foundational to ethical AI deployment and user acceptance.

Why A is right

The greatest benefit of implementing AI to safeguard sensitive data is timely initiation of incident response. AI can detect unauthorized access patterns in real-time and immediately trigger response procedures, minimizing dwell time and limiting damage. Early incident response is the most critical factor in preventing data compromise. While reducing false positives and analyzing endpoint activities are valuable, they are secondary to the ability to respond quickly when actual threats are detected.

Why B is right

Displaying model reasoning directly addresses transparency and explainability, which are the primary drivers of user trust in AI systems. When users understand why an AI system made a particular decision, they can assess its appropriateness and develop confidence in its outputs. This transparency enables informed decision-making and allows users to identify when the AI's reasoning is flawed. Showing the algorithm, multiple outputs, or bias percentages provides less actionable insight into the specific decision made.

Why A is right

A diverse team evaluating AI data brings varied perspectives, experiences, and domain expertise that help identify risks, biases, and limitations that a homogeneous team might overlook. This is the fundamental reason diversity improves evaluation quality. While thorough review and representative output matter, the best reason is reducing blind spots and omitted risks. Media perception (option C) is a secondary concern compared to actual risk identification.

Why A is right

A kill switch is best deployed to contain catastrophic scenarios like self-replication attempts, where the system exhibits unexpected autonomous behavior that could escalate exponentially. Self-replication represents an existential control loss requiring immediate system shutdown. Query completion time is a performance issue, model update failures are deployment issues, and GPU utilization changes are resource monitoring concerns: none warrant an emergency kill switch.

Why A is right

Training data poisoning through gradual modification will directly corrupt the model's learned patterns, resulting in biased or skewed decision-making. The model will optimize itself around the manipulated data, embedding those biases into predictions. This is the most direct and immediate consequence of undetected training data tampering, as the model's outputs are fundamentally determined by what it learns from its training data.

Why B is right

An adversarial attack on an AI model involves crafting specially designed inputs that exploit model vulnerabilities to cause incorrect predictions. These attacks work at the algorithmic/data level by finding weaknesses in how the model processes information, such as adversarial examples that fool image classifiers or prompt injection attacks on language models.

Why C is right

The validation dataset is the appropriate choice for hyperparameter tuning because it allows the model to optimize settings while remaining independent from both the training data (which the model learns from) and the test data (which provides the final unbiased performance estimate). Using the validation set prevents overfitting and ensures that final test results remain a reliable measure of true generalization performance.

Why B is right

Diverse data sourcing ensures that training data represents multiple populations, perspectives, and demographics, which directly counters the root cause of bias: skewed or homogeneous datasets. This is the most effective control for preventing bias from entering the model in the first place. Data reconciliation, access controls, and cryptographic functions do not directly address the data quality and representativeness issues that cause bias.

Why D is right

Approving AI-generated responses with mandatory human review is the best way to address hallucination risk. While generative AI models may produce plausible-sounding but false information (hallucinations), human review can catch and correct these errors before they reach users, ensuring accuracy and reliability.

Why B is right

Data lineage specifically refers to tracking and documenting the complete path of data as it flows through an AI system: from source through processing, transformation, storage, and output. This is the established term in data governance and AI explainability. Origin is a component of lineage but not the comprehensive term. Processing and transformation are steps within the lineage but not the documentation of the complete journey itself.

Why C is right

The best reason for inviting independent reviewers to evaluate AI application output is to mitigate internal bias. Internal teams often have blind spots and shared organizational biases that external reviewers are more likely to detect and challenge. Independent perspectives help identify unfair or biased outputs that internal stakeholders might normalize or overlook, directly addressing systemic bias issues.

Why C is right

When using a third-party AI system to make decisions with sensitive data, accuracy thresholds are the most critical metric because poor accuracy directly impacts decision quality and could harm individuals subject to those decisions. Accuracy determines whether the model reliably produces correct outcomes, which is essential for responsible decision-making, especially with sensitive data in contexts like hiring or credit decisions.

Why A is right

Model inversion is the attack technique where an adversary reconstructs original training data by querying a model and analyzing its outputs. The attacker feeds inputs and observes outputs to reverse-engineer the underlying training data, effectively inverting the model's learned function back to its inputs. This precisely matches the described scenario of retrieving original training data through input-output observation.

Why A is right

Enhancing training data to increase variance ensures the facial recognition system encounters diverse facial appearances, lighting conditions, angles, and alterations during training. This makes the model robust against adversarial alterations in facial appearance by teaching it to recognize faces despite variations, similar to how humans recognize friends despite changes in hairstyle, glasses, or makeup.

Why C is right

Implementing monitoring of agentic actions is the best way to secure AI agent deployment because it provides real-time visibility into what the agent is doing, detecting anomalies, unauthorized actions, and potential security incidents as they occur. This enables immediate response and prevents unauthorized or harmful behavior.

Why B is right

Risk tolerance is the specific threshold of acceptable risk exposure the organization can sustain; this directly determines how intensive monitoring must be to keep risks within acceptable bounds. Risk appetite is broader preference for risk overall, but tolerance is the more precise metric for determining monitoring frequency and depth. The number of users affects scope but not the fundamental level of monitoring required, and compensating controls are one possible response but not the primary determinant of monitoring intensity.

Why A is right

Accidental leakage of proprietary data is the greatest threat in shadow AI environments because unauthorized, unmonitored use of generative AI systems outside governance controls frequently results in employees inputting sensitive business information into public models without security controls or data loss prevention measures. Once proprietary data enters these systems, organizations lose control over it, creating immediate competitive and compliance risks.

Why A is right

A model card is the best documentation for supporting transparency and regulatory compliance in third-party AI audits. Model cards provide comprehensive information about the model's intended use, performance metrics, limitations, bias assessments, training data characteristics, and ethical considerations. This standardized format directly supports audit requirements and regulatory compliance.

Why B is right

When relying on third-party generative AI output, robust third-party contracts are essential to ensure accountability for code-level vulnerabilities, security standards, liability, and remediation responsibilities. Contracts establish legal and technical requirements that protect against vulnerabilities introduced by the vendor. While transparency, rights management, and provisioning are relevant governance elements, they do not directly address vulnerability protection like contractual obligations do.

Why D is right

The training phase presents the greatest inherent risk in the AI data lifecycle because it is where models learn patterns from data, including potentially biased, poisoned, or sensitive information. Compromised training data directly impacts model behavior, accuracy, fairness, and security. Problems introduced during training are difficult to detect and persist throughout the model's operational lifetime.

Why B is right

Validating AI model outputs by team members directly restores end user trust by demonstrating human oversight and quality assurance of the system's decisions. This shows that outputs are being checked for accuracy and appropriateness before affecting users, rebuilding confidence in the system. While remediation addresses the root cause and improves the system, validation of outputs provides immediate assurance that the system is being monitored and controlled, which is what directly rebuilds user trust post- incident.

Why A is right

For a medical AI chatbot assisting patients with medical devices, selecting appropriate training data is the highest priority because the quality, relevance, and appropriateness of training data directly determines whether the model will provide safe and accurate medical guidance. Using inappropriate or biased training data cannot be remedied by larger networks, more data, or better tuning. In healthcare contexts, data quality is foundational to safety and efficacy.

Why D is right

Model owners are responsible for implementing recommendations from external AI compliance audits. As the parties closest to the AI systems and accountable for their performance, security, and compliance, model owners have the authority and responsibility to drive remediation of identified deficiencies and ensure the organization meets required standards.

Why C is right

Annotation is the specific process of tagging, labeling, and marking raw data with metadata or classifications to create supervised training datasets. This human-curated process transforms raw data into structured training material that machine learning models can learn from.

Why C is right

Differential privacy during model training is the most effective technical defense against model inversion attacks because it mathematically limits what an attacker can learn about individual training data by adding controlled noise to the learning process. This prevents attackers from reconstructing sensitive training data even with full model access, which is exactly what model inversion attacks attempt to do.

Why A is right

The scenario describes supervised learning: a data scientist creates predefined categories (labels) and trains the algorithm on large datasets where inputs are paired with correct outputs. The algorithm learns from this labeled training data to make predictions on new data. This is the defining characteristic of supervised learning, where the learning process is guided by known correct answers.

Why D is right

Requiring an additional method of identity verification is the most direct and effective mitigation against deepfake-based social engineering. When multiple verification channels are required (such as combining video/audio verification with a second factor like code verification or knowledge-based authentication), it becomes significantly harder for deepfakes alone to compromise access, as the attacker would need to defeat multiple independent authentication mechanisms.

Why A is right

Integrating multiple detection mechanisms is the best technique for addressing model evasion attacks because adversaries typically craft attacks to bypass single detection systems. Ensemble approaches using diverse detection mechanisms make it exponentially harder for attackers to craft inputs that evade all detectors simultaneously. This defense-in-depth strategy is proven effective against adversarial ML attacks.

Why B is right

Embedding responsible practices throughout the life cycle is the most comprehensive approach to ensuring ethical AI results. This encompasses model design, training data selection, testing, deployment, and ongoing monitoring: addressing ethics at every stage rather than as an afterthought. Single-point measures like proprietary algorithms or specific data choices cannot guarantee ethical outcomes without systemic integration across the entire AI development and operational lifecycle.

Why D is right

Industrial control systems directly manage physical infrastructure, machinery, and production lines. Downtime can cause safety hazards, equipment damage, environmental risks, and significant economic losses. While health support systems are also critical, industrial control systems typically require the most stringent RTO because their failure can immediately threaten worker safety and cause cascading infrastructure damage. The physical consequences of extended outages are more severe and less forgiving than in other domains.

Why D is right

The percentage of AI projects in compliance is the most relevant KRI for evaluating risk management program effectiveness because it directly measures whether the organization's AI initiatives are adhering to established governance policies, regulatory requirements, and risk management standards. This metric provides a clear indication of control effectiveness and organizational capability to manage AI-related risks.

Why B is right

Output filtering and moderation directly addresses the risk of offensive or biased content by inspecting and blocking harmful outputs before they reach users. Static prompt templates cannot prevent harmful outputs, logging minimization doesn't prevent harm, and rate limiting only controls access frequency rather than content safety.

Why C is right

Elevated frequency of detected adversarial input attempts is a direct KRI for malicious manipulation of AI models. Adversarial inputs are specifically designed to deceive or degrade model performance, making their increased detection a clear indicator of attack attempts. This metric directly measures threats to model integrity, whereas the other options measure different operational or security concerns unrelated to model manipulation.

Why C is right

Synthetic data derived from real records significantly reduces re-identification risk because the synthetic records do not directly correspond to actual individuals, preventing privacy attacks like record linkage or attribute inference. This is the primary security advantage of synthetic training data in a sensitive context.

Why A is right

Clearing in-memory state at the end of each session directly prevents residual data from persisting in memory where it could be exfiltrated by attackers or exposed through memory dumps. This practice ensures sensitive information processed during a session is not retained after the session ends, mitigating the risk of unauthorized data access.

Why D is right

Adversarial training is the BEST mechanism to protect an AI system against evasion attacks. Adversarial training involves deliberately exposing the model to adversarial examples (inputs designed to fool the model) during training, allowing the model to learn robustness against such manipulations. This approach strengthens the model's decision boundaries and makes it resistant to carefully crafted inputs intended to cause misclassification. This is a fundamental defense-in-depth technique specific to evasion attack mitigation.

Why D is right

Model inversion and membership inference attacks directly target the training data itself: attackers can reconstruct sensitive customer records or determine whether specific individuals were in the training set. This directly compromises the sensitive personal and financial data the model was trained on. While data poisoning and bias are concerns, they affect model behavior rather than directly exposing the underlying sensitive data at scale.

Why B is right

Verifying and sanitizing both inputs and outputs is the most direct control for protecting confidential data when using a pre-trained AI solution. This prevents sensitive information from being sent to the model and ensures that any confidential data inadvertently included doesn't leak through outputs. Input/output filtering acts as a critical barrier protecting proprietary or sensitive data from exposure through an external or untrusted AI solution.

Why A is right

Leadership accountability for AI initiatives is the foundational governance principle. Without clear executive ownership and responsibility for AI system performance, risks, and compliance, no other control (training, funding, data quality) can be effectively enforced or escalated. This establishes the governance structure needed to manage all other AI- related concerns.

Why D is right

The number of system overrides by cyber analysts is a key risk indicator (KRI) for an AI- based threat detection system. High override rates indicate that the AI model is generating false positives or missing detections that analysts must correct, suggesting degraded model performance or reduced trust in the system. This metric directly reflects the operational effectiveness and reliability of the AI system. The other options are technical implementation details that don't indicate risk or performance quality.

Why C is right

Data classification is the most appropriate answer for addressing CISO security and privacy concerns when procuring training data from multiple sources. It involves categorizing data by sensitivity level, ownership, and regulatory requirements, enabling the organization to understand what data they have, where it came from, and how to handle it appropriately. This foundational step allows the CISO to apply appropriate protections, identify compliance risks, and make informed decisions about data usage.

Why B is right

Monitoring AI outputs against policy is the most direct and practical control for strengthening information security around generative AI. This enables real-time detection of policy violations, inappropriate content, or security risks in AI-generated output. While exceeding benchmarks sounds rigorous and validating training data matters, monitoring outputs provides continuous oversight that catches actual security incidents. A kill switch is too reactive and doesn't prevent misuse proactively.

Why A is right

Out-of-distribution (OOD) detection is the most appropriate assessment method for evaluating whether an AI model will be compromised by inputs not represented in the training data. OOD detection specifically identifies when inputs fall outside the distribution the model was trained on, flagging situations where the model may behave unpredictably or be vulnerable to novel attacks.

Why A is right

Data validation is the most direct and effective control against data poisoning attacks. It involves verifying the integrity, accuracy, and legitimacy of training data before it enters the model pipeline. Data validation includes checking for anomalies, unexpected patterns, malicious modifications, and inconsistencies that would indicate poisoned samples. This preventive approach stops corrupted data from ever reaching the model, making it the best mitigation.

Why D is right

Social engineering tactics are most enhanced by AI capabilities: chatbots and deepfakes powered by generative AI can make phishing, pretexting, and impersonation attacks far more convincing and scalable. Employees need updated awareness training on AI-driven social engineering risks. Malicious insider threats, clean desk policy, and authentication controls are not specifically amplified by AI in the way that social engineering attacks are, as AI directly enables more sophisticated impersonation and manipulation.

Why C is right

Before developing any acceptable use policy, the organization must first establish what it is trying to accomplish: the scope and intended use of the AI system. This clarity drives all subsequent decisions about appropriate uses, restrictions, and requirements. Only after understanding the scope and intended use can the organization effectively consult with risk management and legal, review regulatory requirements, and align with existing policies, all of which should be tailored to the specific AI use cases in question.

Why C is right

Sampling bias occurs when the training dataset is not representative of the broader population. Using only local community volunteers creates a non-representative sample that may not include diverse facial features, ages, ethnicities, and characteristics present in the general population. This directly limits the model's ability to generalize and perform accurately on diverse faces outside the training community.

Why C is right

Transparent disclosure and informed consent directly address user trust by ensuring stakeholders understand how generative AI systems work, what data is used, and what limitations exist. Users who are fully informed about AI capabilities and constraints can make educated decisions about relying on outputs, which is foundational to maintaining confidence in AI systems.

Why D is right

A dedicated AI management system policy's primary purpose is to establish a comprehensive framework for setting AI objectives and governance. While compliance, accuracy optimization, and environmental impact are all important considerations, the foundational purpose is to provide the overarching structure that guides all other AI initiatives and ensures alignment with organizational goals.

Why D is right

Maintaining a complete inventory with data lineage records is most important for security throughout the AI data lifecycle because it provides full visibility and traceability of all data assets from collection through processing to model usage. This enables organizations to understand what data exists, where it is used, how it flows, and who accesses it: all critical for identifying vulnerabilities, enforcing access controls, and responding to incidents. While the other options provide value, none offer the comprehensive governance foundation that lineage records provide.

Why D is right

Data flow diagrams are best for detecting issues throughout an AI system's entire lifecycle because they visually map how data moves from collection through processing, storage, model training, inference, and deletion. This comprehensive view identifies data quality, privacy, security, and integrity issues at every stage. Data quality requirements only address validation standards; user access logs show who accessed data but not how it flows; retention policies cover only one aspect of the lifecycle.

Why C is right

Anomalous high-frequency writes to memory is the pattern most indicative of a memory poisoning attack in an agentic AI system. Memory poisoning involves malicious modification of model parameters or state data stored in memory; high-frequency writes would represent the attacker injecting or modifying data at an abnormal rate, which would be detectable as unusual write patterns.

Why A is right

Confidence scores are most effectively used to quantify uncertainty in model predictions, enabling organizations to identify which outputs require human review or additional verification. This directly supports risk management by classifying results based on reliability levels. While confidence scores relate to accuracy, their PRIMARY use is managing uncertainty rather than just setting expectations, and they don't assign probabilities to training data patterns or test resilience to tampering.

Why C is right

Robust data validation techniques and anomaly detection directly identify and prevent poisoned or corrupted data from entering the model. This defensive approach detects anomalies, outliers, and suspicious patterns that indicate compromised data before they influence model training. Using diverse data sources does not inherently detect poisoning. Increasing model complexity and adding more features without validation actually makes systems more vulnerable to poisoned data by expanding the attack surface.

Why A is right

When a deployed AI model exhibits output drift outside expected ranges, the best course of action is to return to an earlier phase in the AI life cycle to investigate root causes, retrain, validate, and retest the model before redeployment. This systematic approach ensures the underlying issue is properly identified and resolved rather than applying quick fixes or taking emergency actions without understanding the problem.

Why B is right

Human-in-the-loop deployment provides the greatest benefit of enhanced safety by enabling human oversight to catch errors, bias, anomalies, and dangerous predictions before they cause harm. This control mechanism is critical for AI systems with high-stakes consequences (healthcare, finance, legal decisions), as humans can intervene, escalate, or reject unsafe recommendations. While it may improve other metrics, safety is the paramount and most defensible benefit.

Why A is right

Verification is the phase where models are assessed against specifications and security requirements, including checks for malicious manipulations, backdoors, and poisoning. This phase focuses on confirming the model meets defined security criteria before deployment. Validation assesses whether the model solves the intended problem, testing and evaluation measure performance and accuracy, but verification specifically encompasses the security assessment for freedom from malicious manipulations.

Why D is right

Repetitive API calls sending inputs to an AI solution is the hallmark signature of a model extraction attack, where an attacker systematically queries the model to reverse-engineer its functionality, architecture, or learned parameters. Model extraction involves probing the model's behavior through multiple queries to replicate its decision-making process, which is exactly what repetitive API calls would accomplish.

Why C is right

Human-in-the-loop controls are the most effective approach to reduce hallucination risks in high-stakes domains like pharmaceutical treatment development. By requiring human review and validation of AI-generated recommendations before they are acted upon, the organization can catch factually incorrect or nonsensical outputs before they cause harm. This is especially critical when real-world data is introduced, as it can trigger unexpected model behaviors. Penetration testing targets security vulnerabilities, data validation improves data quality but not output accuracy, and impact analysis assesses consequences rather than preventing hallucinations.

Why D is right

The primary purpose of a Privacy Impact Assessment is to systematically analyze how personal data flows through an AI system, identifying potential privacy risks and how that data is collected, used, stored, and protected. This foundational analysis of data handling practices informs all other privacy considerations. While identifying regulations, building confidence, and data quality are related concerns, the core purpose of a PIA is to thoroughly examine personal data handling to mitigate privacy risks.

Why B is right

Validating the provenance of data sources is the most effective foundational defense against deepfakes because it establishes authenticity and chain-of-custody before content is processed or distributed. This preventive approach stops manipulated content at the source rather than attempting detection after creation, making it the most robust mitigation strategy.

Why B is right

Threat modeling and integrity checks directly address the risk of hidden backdoors in third- party components by identifying vulnerabilities in the fine-tuning process and verifying the authenticity and safety of components before integration. This proactive security approach is specifically designed to detect and prevent malicious code injection during model development.

Why C is right

Data bias in machine learning algorithms is fundamentally caused by training data that does not represent the full population or contains skewed distributions. Diversifying the training data to include representative samples from all relevant groups directly addresses the root cause of bias by ensuring the model learns from a balanced and comprehensive dataset. Simplified models may reduce overfitting but not bias, unstructured data does not inherently reduce bias, and data security does not address bias.

Why D is right

Cybersecurity should be embedded earliest in the model design phase to establish security and threat models from inception. This shift-left approach enables security considerations to inform architectural decisions, threat identification, and risk mitigation strategies before resources are invested in development. Early involvement prevents security issues from being retrofitted later.

Why C is right

Model inversion attacks specifically aim to extract and reconstruct sensitive training data from a model, directly compromising confidentiality and privacy. This attack reverses the model's function to infer private information about individuals in the training dataset. Data poisoning corrupts training data but doesn't primarily target confidentiality extraction; DoS attacks target availability; adversarial attacks aim to cause misclassification rather than data extraction.

Why C is right

White box testing is the technique specifically designed to examine the internal workings and decision-making processes of a system. In the context of AI models, white box testing allows analysis of the model's structure, weights, algorithms, and decision pathways to understand how conclusions are reached. This direct visibility into the model's internals makes it the best choice for determining how an AI model makes decisions.

Why C is right

Decision trees are inherently interpretable and transparent models where the reasoning path from input to output can be easily visualized and explained. This is crucial for HR pre- screening tools where candidates need to understand why they were rejected and the organization needs to justify decisions to avoid discrimination claims. Decision trees provide clear, human-understandable logic without the 'black box' nature of other algorithms.

Why C is right

A confusion matrix is the fundamental tool for analyzing all four classification outcomes: true positives, true negatives, false positives, and false negatives. It organizes these outcomes in a grid format that enables comprehensive evaluation of model performance across all classification categories. While precision and recall derive from confusion matrix values, they only capture specific aspects rather than providing the complete analysis.

Why A is right

Anonymizing personal data provides the strongest protection because it removes the ability to identify individuals from the data, thereby eliminating privacy risks at the source. True anonymization renders data incapable of being linked back to identifiable individuals, fundamentally protecting privacy rather than merely obscuring or temporarily protecting the data.

Why B is right

Validation is the TEVV phase that ensures the proposed AI solution meets business needs and requirements as expected. Validation answers the question 'Are we building the right thing?' by confirming the solution solves the intended business problem. Testing verifies technical correctness, verification ensures specifications are met, and evaluation assesses overall suitability, but validation specifically focuses on meeting business objectives.

Why A is right

Identification of environmental and societal consequences is a core MUST-conduct element of AI impact assessment frameworks (as defined by leading standards and regulatory guidance). This evaluation identifies broader effects of AI deployment on society, the environment, and stakeholder communities beyond technical performance. While testing and verification are important, they are evaluation activities rather than impact assessment scope. Model reproducibility is a technical concern. Security control self-assessment is a control validation activity, not an impact assessment component.

Why A is right

Conformity assessment for self-driving vehicles is primarily needed to assess compliance against AI regulations and frameworks (such as ISO standards, EU AI Act, and safety regulations). This ensures the system meets legal and regulatory requirements before deployment. While reliability verification, security testing, and fairness are important, conformity assessment as a formal process specifically targets regulatory and standards compliance.

Why D is right

An accountability model is the primary consideration for managing liabilities from agentic AI systems because it establishes clear responsibility for decisions, actions, and outcomes produced by the system. With autonomous or semi-autonomous AI agents that can take unforeseen actions, organizations need to define who is accountable for those actions: whether the AI vendor, the organization, specific personnel, or some combination. This accountability framework is foundational to managing legal and operational liability. Model dependencies, approved base models, and risk levels are important but secondary to establishing who bears responsibility.

Why A is right

Weak controls for access to AI models represent the most easily exploited vulnerability because they provide direct pathways for unauthorized users to gain control of, modify, or misuse the model. Poor access controls are a fundamental security weakness that requires minimal technical sophistication to exploit compared to more complex attack vectors, making them the lowest-hanging fruit for adversaries.

Why B is right

The right to audit gives the organization ongoing contractual authority to verify the vendor's handling, processing, and protection of training data throughout the engagement. This is the most critical protective mechanism because it enables the organization to enforce compliance and detect misuse or breaches. Pseudonymization reduces privacy risk but doesn't give oversight; independent certification provides limited ongoing assurance; and continuous monitoring is the vendor's responsibility, not primarily contractual.

Why A is right

When forming an AI steering committee, the CISO must first understand what AI systems are already in use within the organization. Identifying the types of AI currently deployed provides the essential baseline inventory needed before any framework selection, benchmarking, or gap analysis can be meaningfully conducted. This discovery phase is the logical foundation upon which all subsequent governance activities depend.

Why D is right

When a backdoor is discovered in a model through actual fraudulent activity, the immediate and most appropriate action is to revert to a prior known-good version of the model. This stops the exploitation immediately while investigations proceed. Reverting removes the compromised model from production and prevents further fraud. Inspecting source code, filtering inputs, and reviewing access are important follow-up activities, but do not address the active threat as directly or quickly as reversion.

Why D is right

Privacy-preserving methods such as differential privacy, federated learning, and secure computation directly address the root cause of model inversion attacks by protecting the underlying training data. Model inversion attacks reconstruct sensitive training data from model outputs; privacy-preserving techniques mathematically limit what can be inferred about individual training instances. Regular retraining, input monitoring, and access controls are secondary measures that don't fundamentally prevent the attack mechanism.