Reviewing the system only after an incident occurs<\/span><\/li>\n<\/ol>\nCorrect Answer: 2. Defining a documented owner with decision-making authority<\/b><\/p>\n
Explanation:<\/b><\/p>\n
A clearly documented owner is essential for accountability because AI systems can affect business decisions, customers, employees, and regulatory obligations. The owner should have sufficient authority to approve use, accept or escalate risks, ensure controls are implemented, and coordinate remediation when problems occur. Assigning responsibility without decision-making authority can create gaps because individuals may be expected to manage risks they cannot actually control. Vendor responsibility can supplement, but should not replace, organizational accountability. Periodic reviews and incident management are also important, but they do not establish ownership by themselves. Effective AI governance therefore connects each important AI system to an identifiable business or functional owner with defined responsibilities and escalation paths.<\/span><\/p>\nQuestion 362. What is the PRIMARY purpose of documenting the approved purpose of an AI system?<\/b><\/h3>\n\n- <\/b> To establish boundaries for acceptable use and governance oversight<\/span>
\n<\/span>2.<\/b> To eliminate the need for monitoring<\/span>
\n<\/span>3.<\/b> To guarantee that model outputs are always accurate<\/span>
\n<\/span>4.<\/b> To prevent all future modifications to the model<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. To establish boundaries for acceptable use and governance oversight<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Documenting an AI system’s approved purpose establishes the boundaries within which the system has been assessed and authorized. This is important because a model that is acceptable for one business activity may create substantially different risks when reused for another purpose. The approved purpose provides a reference point for determining whether proposed changes require reassessment, additional controls, or new approval. It also helps auditors and governance personnel determine whether actual use matches authorized use. Documentation does not guarantee accuracy, prevent modifications, or eliminate monitoring requirements. Instead, it creates a clear governance baseline against which changes, exceptions, and operational behavior can be evaluated throughout the AI lifecycle.<\/span><\/p>\nQuestion 363. An organization discovers that an AI system is being used for a purpose outside its approved scope. What should management do FIRST?<\/b><\/h3>\n\n- <\/b> Delete the system immediately<\/span>
\n<\/span>2.<\/b> Ignore the deviation if performance remains acceptable<\/span>
\n<\/span>3.<\/b> Assess the unauthorized use and determine whether governance reassessment is required<\/span>
\n<\/span>4.<\/b> Transfer ownership to the system vendor<\/span><\/li>\n<\/ol>\nCorrect Answer: 3. Assess the unauthorized use and determine whether governance reassessment is required<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Use outside an approved purpose can introduce new risks because the original risk assessment, controls, testing, privacy analysis, and approval may not cover the new activity. The appropriate first response is to assess the deviation and determine its materiality. Depending on the circumstances, the organization may need to pause the expanded use, perform a new risk assessment, update documentation, introduce additional controls, and obtain appropriate approval. Immediate deletion may be unnecessary, while ignoring the issue creates governance exposure. Transferring ownership to a vendor does not resolve the organization’s accountability. A structured assessment allows management to determine the appropriate corrective action based on the actual risk and impact of the changed use.<\/span><\/p>\nQuestion 364. Which control BEST supports traceability of AI model changes over time?<\/b><\/h3>\n\n- <\/b> Periodic employee surveys<\/span>
\n<\/span>2.<\/b> Unrestricted administrator access<\/span>
\n<\/span>3.<\/b> Manual verbal approvals<\/span>
\n<\/span>4.<\/b> Version-controlled model artifacts with documented change records<\/span><\/li>\n<\/ol>\nCorrect Answer: 4. Version-controlled model artifacts with documented change records<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Version control provides a reliable method for identifying which model artifact was deployed, when it changed, who authorized the change, and what modifications were introduced. This traceability is particularly important when investigating unexpected model behavior, validating production results, or demonstrating compliance with governance requirements. Documented change records can connect model versions with associated datasets, validation evidence, approvals, and deployment activities. Verbal approvals and unrestricted access provide weak accountability and are difficult to audit. Employee surveys are unrelated to technical model traceability. A controlled version-management process therefore provides stronger evidence that AI model changes were authorized, tested, and appropriately documented before or during deployment.<\/span><\/p>\nQuestion 365. Why should AI governance include monitoring for material changes in model performance after deployment?<\/b><\/h3>\n\n- <\/b> Because a model can behave differently as data, environments, or usage patterns change<\/span>
\n<\/span>2.<\/b> Because monitoring eliminates the need for model validation<\/span>
\n<\/span>3.<\/b> Because every performance change automatically means the model is defective<\/span>
\n<\/span>4.<\/b> Because models cannot be modified after deployment<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. Because a model can behave differently as data, environments, or usage patterns change<\/b><\/p>\n
Explanation:<\/b><\/p>\n
AI performance can change after deployment because real-world conditions may differ from the conditions present during development and validation. Changes in input distributions, business processes, user behavior, external data, or system dependencies can cause performance deterioration or unexpected behavior. Continuous monitoring helps organizations identify these changes and determine whether corrective action or reassessment is necessary. Monitoring does not replace formal validation and does not mean that every change indicates a defect. Some variation may be expected, while other changes may exceed established thresholds and require investigation. Governance should therefore define meaningful performance indicators, thresholds, escalation procedures, and responsibilities so that material deterioration can be detected and addressed promptly.<\/span><\/p>\nQuestion 366. Which evidence would BEST demonstrate that a high-risk AI system received appropriate approval before production deployment?<\/b><\/h3>\n\n- <\/b> A general statement from the development team<\/span>
\n<\/span>2.<\/b> A documented approval record linked to the risk assessment and validation evidence<\/span>
\n<\/span>3.<\/b> A screenshot of the system interface<\/span>
\n<\/span>4.<\/b> A vendor marketing document<\/span><\/li>\n<\/ol>\nCorrect Answer: 2. A documented approval record linked to the risk assessment and validation evidence<\/b><\/p>\n
Explanation:<\/b><\/p>\n
For a high-risk AI system, approval should be supported by evidence demonstrating that appropriate governance activities were completed before production deployment. A strong approval record can identify the system, responsible owner, assessed risks, required controls, validation results, approval authority, date, and applicable conditions. Linking the approval to the risk assessment and validation evidence establishes traceability between the identified risks, the controls designed to address them, and the decision to authorize production use. A developer statement, interface screenshot, or vendor marketing material does not provide sufficient governance evidence. Maintaining complete approval records also supports future audits, reassessments, incident investigations, and accountability when the system or its operating environment changes.<\/span><\/p>\nQuestion 367. What is the PRIMARY governance concern when an AI provider automatically changes a production model without prior organizational notification?<\/b><\/h3>\n\n- <\/b> Increased employee training costs<\/span>
\n<\/span>2.<\/b> Reduced storage capacity<\/span>
\n<\/span>3.<\/b> Loss of traceability and inability to confirm continued validation status<\/span>
\n<\/span>4.<\/b> Slower user interface performance<\/span><\/li>\n<\/ol>\nCorrect Answer: 3. Loss of traceability and inability to confirm continued validation status<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Automatic provider changes can create governance risk because the organization may no longer know exactly which model version is operating in production or whether the changed model remains within the scope of its original validation and approval. This can affect performance, security, fairness, privacy, and regulatory compliance. The organization should establish contractual and technical mechanisms to obtain change notifications, version information, testing opportunities, and appropriate rollback or reassessment capabilities. Storage capacity and user-interface performance may be operational concerns, but they are not the primary governance issue. Maintaining traceability is critical because organizations need evidence that the production system continues to meet approved requirements after material changes by an external provider.<\/span><\/p>\nQuestion 368. Which practice BEST reduces the risk of unauthorized access to sensitive AI training data?<\/b><\/h3>\n\n- <\/b> Applying least-privilege access with periodic access reviews<\/span>
\n<\/span>2.<\/b> Giving all developers administrator privileges<\/span>
\n<\/span>3.<\/b> Storing training data in shared public repositories<\/span>
\n<\/span>4.<\/b> Removing access logs to reduce storage requirements<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. Applying least-privilege access with periodic access reviews<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Least-privilege access limits users and systems to the permissions necessary for their assigned responsibilities. For sensitive AI training data, this reduces the likelihood that unauthorized individuals can view, modify, copy, or extract information. Periodic access reviews help ensure that permissions remain appropriate as employees change roles, projects end, or responsibilities evolve. Administrative access for all developers creates unnecessary exposure, while public repositories may cause direct disclosure of sensitive information. Removing access logs also weakens accountability and makes investigations more difficult. Effective governance combines access restrictions with authentication, authorization, monitoring, logging, and periodic review so that access to training data remains controlled throughout the AI development and operational lifecycle.<\/span><\/p>\nQuestion 369. An AI governance committee notices that several high-risk remediation items are repeatedly overdue. What should it do FIRST?<\/b><\/h3>\n\n- <\/b> Close the overdue items to improve reporting statistics<\/span>
\n<\/span>2.<\/b> Increase the number of committee meetings without analyzing the cause<\/span>
\n<\/span>3.<\/b> Remove the remediation deadlines<\/span>
\n<\/span>4.<\/b> Analyze the recurring delays and identify their root causes**<\/span><\/li>\n<\/ol>\nCorrect Answer: 4. Analyze the recurring delays and identify their root causes<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Repeatedly overdue remediation indicates that the organization may have a systemic weakness rather than isolated missed deadlines. The governance committee should first analyze why remediation is not being completed. Possible causes include unclear ownership, insufficient resources, unrealistic deadlines, ineffective escalation, inadequate prioritization, or dependencies on other teams. Closing items without remediation would weaken governance reporting, while removing deadlines would reduce accountability. Additional meetings may help later but do not address the underlying problem by themselves. Root-cause analysis allows management to determine whether changes are needed to ownership, resources, risk prioritization, escalation mechanisms, or control processes. Governance metrics should therefore drive corrective action rather than simply improving the appearance of compliance.<\/span><\/p>\nQuestion 370. Which activity BEST supports responsible use of AI-generated information in a high-impact decision process?<\/b><\/h3>\n\n- <\/b> Allowing the AI output to determine the decision automatically<\/span>
\n<\/span>2.<\/b> Requiring appropriate human review and verification before the decision<\/span>
\n<\/span>3.<\/b> Disabling all logging of AI outputs<\/span>
\n<\/span>4.<\/b> Allowing users to bypass established approval procedures<\/span><\/li>\n<\/ol>\nCorrect Answer: 2. Requiring appropriate human review and verification before the decision<\/b><\/p>\n
Explanation:<\/b><\/p>\n
High-impact decisions can have significant consequences for individuals or the organization, so AI-generated information should not automatically be treated as authoritative. Appropriate human review allows qualified personnel to evaluate whether the output is relevant, accurate, complete, and consistent with applicable policies and decision criteria. The level of review should be proportionate to the potential impact and risk of the AI application. Automatic acceptance of AI outputs can amplify errors, bias, or unsupported conclusions. Disabling logs removes important evidence, while bypassing approval procedures weakens governance. Human oversight should be supported by defined responsibilities, escalation procedures, documented decision criteria, and sufficient information for reviewers to challenge or override AI-generated recommendations when necessary.<\/span><\/p>\nQuestion 371. What is the PRIMARY purpose of maintaining an enterprise-wide AI system inventory?<\/b><\/h3>\n\n- <\/b> To identify, classify, and govern AI systems throughout the organization<\/span>
\n<\/span>2.<\/b> To replace all individual system documentation<\/span>
\n<\/span>3.<\/b> To guarantee that every AI system uses the same model<\/span>
\n<\/span>4.<\/b> To eliminate the need for risk assessments<\/span><\/li>\n<\/ol>\nCorrect Answer: 1. To identify, classify, and govern AI systems throughout the organization<\/b><\/p>\n
Explanation:<\/b><\/p>\n
An enterprise-wide AI inventory provides visibility into the organization’s AI landscape. It can identify systems in development, testing, production, retirement, or external service environments and associate them with owners, purposes, risk classifications, providers, data types, and governance requirements. This visibility supports risk prioritization and helps management identify systems that may otherwise operate without appropriate oversight. An inventory does not replace detailed system documentation or eliminate the need for risk assessments. It also does not require every system to use the same technology. Instead, it provides a centralized governance foundation that enables organizations to determine which systems require enhanced controls, monitoring, validation, approval, or periodic reassessment based on their characteristics and risks.<\/span><\/p>\nQuestion 372. What should an organization do when an AI system’s risk classification changes from moderate to high?<\/b><\/h3>\n\n- <\/b> Continue operating without modification<\/span>
\n<\/span>2.<\/b> Remove the system from the inventory<\/span>
\n<\/span>3.<\/b> Apply the governance requirements associated with the higher risk classification<\/span>
\n<\/span>4.<\/b> Transfer all responsibility to the end users<\/span><\/li>\n<\/ol>\nCorrect Answer: 3. Apply the governance requirements associated with the higher risk classification<\/b><\/p>\n
Explanation:<\/b><\/p>\n
A change from moderate to high risk indicates that the system’s potential impact or exposure has materially changed. The organization should reassess the system against the requirements applicable to high-risk AI and implement any additional controls, approvals, validation, human oversight, monitoring, documentation, or escalation procedures that are required. Continuing under the previous control level could leave significant risks insufficiently addressed. Removing the system from the inventory would reduce visibility, while transferring responsibility to users would not satisfy organizational governance obligations. Risk classification should therefore drive proportional governance. When the classification changes, management should document the reason for the change, reassess relevant risks, confirm control effectiveness, and obtain any required approval before continuing or expanding use.<\/span><\/p>\nQuestion 373. Which metric would provide the MOST useful indication that AI governance remediation is becoming less effective?<\/b><\/h3>\n\n- <\/b> Number of employees attending unrelated training sessions<\/span>
\n<\/span>2.<\/b> Number of AI systems purchased during the year<\/span>
\n<\/span>3.<\/b> Number of AI models stored in development repositories<\/span>
\n<\/span>4.<\/b> Increasing age and recurrence of unresolved high-risk findings<\/span><\/li>\n<\/ol>\nCorrect Answer: 4. Increasing age and recurrence of unresolved high-risk findings<\/b><\/p>\n
Explanation:<\/b><\/p>\n
The age and recurrence of unresolved high-risk findings provide direct insight into whether governance weaknesses are being addressed effectively. If high-risk findings remain open for extended periods or repeatedly reappear after remediation, the organization may have problems with ownership, root-cause analysis, resource allocation, control design, or management escalation. A useful governance metric should help decision-makers identify deteriorating control effectiveness rather than merely measure activity. Employee training attendance, procurement volume, and the number of development models do not directly demonstrate whether governance deficiencies are being resolved. Combining remediation aging with recurrence trends can provide stronger insight into whether corrective actions are sustainable and whether management needs to intervene.<\/span><\/p>\nQuestion 374. Which control is MOST appropriate for protecting the integrity of AI governance records?<\/b><\/h3>\n\n- <\/b> Allowing all users to edit records<\/span>
\n<\/span>2.<\/b> Using controlled access, audit logging, and change tracking<\/span>
\n<\/span>3.<\/b> Deleting historical approval records periodically<\/span>
\n<\/span>4.<\/b> Storing governance records without ownership information<\/span><\/li>\n<\/ol>\nCorrect Answer: 2. Using controlled access, audit logging, and change tracking<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Governance records can include risk assessments, approvals, validation results, exceptions, remediation evidence, and other information needed to demonstrate accountability. Protecting their integrity requires controls that restrict who can modify records and provide evidence of changes. Controlled access limits unauthorized modifications, while audit logging and change tracking help identify who made a change, when it occurred, and what was changed. Deleting historical approval records weakens traceability and may remove evidence required for audits or investigations. Records without ownership information also create accountability gaps. Effective governance therefore treats critical records as controlled evidence, with appropriate retention, access, versioning, monitoring, and protection against unauthorized alteration or deletion.<\/span><\/p>\nQuestion 375. Why is third-party AI concentration risk important to enterprise governance?<\/b><\/h3>\n\n- <\/b> Multiple critical systems may depend on the same provider or underlying model<\/span>
\n<\/span>2.<\/b> It guarantees lower procurement costs<\/span>
\n<\/span>3.<\/b> It eliminates the need for contingency planning<\/span>