Which risk statement is most useful for an AI risk register?

A statement linking the AI use case, risk event, business impact, and accountable owner

Before accepting residual AI risk, what should management confirm?

The residual exposure is assessed against documented risk appetite and acceptance authority

A third-party model provider changes a core component. What is the best risk-management response before relying on the changed service?

Require change notice, reassess relevant risks and controls, then update monitoring evidence

Advanced in AI Risk (AAIR) Practice Test: 3 Free Questions

Exam-specific sample

Questions, answers, and option-by-option explanations

Each explanation identifies why the correct option fits and why the distractors do not.

Easy AI risk governance

Question 1

Which risk statement is most useful for an AI risk register?
1. A statement linking the AI use case, risk event, business impact, and accountable owner
2. A statement that AI is risky in general
3. A list of the model team members
4. A copy of the project budget
Correct answer: A. A statement linking the AI use case, risk event, business impact, and accountable owner
Review option explanations
- A. Correct. It makes the exposure specific, decision-ready, and assignable.
- B. A broad assertion does not support assessment or treatment.
- C. Team membership does not describe the risk event or impact.
- D. Budget information does not define the risk.
Medium AI risk treatment

Question 2

Before accepting residual AI risk, what should management confirm?
1. The residual exposure is assessed against documented risk appetite and acceptance authority
2. The engineering team prefers no additional controls
3. The model is popular with users
4. The vendor has announced a future feature
Correct answer: A. The residual exposure is assessed against documented risk appetite and acceptance authority
Review option explanations
- A. Correct. Risk acceptance requires an accountable decision against approved tolerance.
- B. Engineering preference alone is not risk acceptance authority.
- C. User popularity does not change residual risk tolerance.
- D. A future feature does not establish current treatment adequacy.
Hard AI supply chain risk

Question 3

A third-party model provider changes a core component. What is the best risk-management response before relying on the changed service?
1. Require change notice, reassess relevant risks and controls, then update monitoring evidence
2. Assume the change is safe because the provider is established
3. Wait for a user complaint before reviewing the change
4. Remove all controls to avoid duplicated work
Correct answer: A. Require change notice, reassess relevant risks and controls, then update monitoring evidence
Review option explanations
- A. Correct. A controlled reassessment keeps third-party changes within the organization risk process.
- B. Provider reputation is not a substitute for change assessment.
- C. Reactive review leaves unassessed exposure in production.
- D. Removing controls increases rather than manages the risk.

More

Advanced in AI Risk (AAIR) Practice Test: 3 Free Questions

Questions, answers, and option-by-option explanations

Question 1

Question 2

Question 3

Continue with the full exam-prep cluster

How can I help?