An AI research team is developing a natural language processing model that relies on several open-source libraries. Which of the following is the team's BEST course of action to ensure the integrity of the software packages used?
Answer(s): C
Scanning open-source packages and libraries for malware before installation ensures software integrity and prevents the introduction of malicious code into the AI system. This step verifies that dependencies are safe and have not been tampered with, which is critical for maintaining trust and security in the development environment.
An organization plans to apply an AI system to its business, but developers find it difficult to predict system results due to lack of visibility to the inner workings of the AI model. Which of the following is the GREATEST challenge associated with this situation?
Answer(s): D
The inability to understand or explain how an AI model produces its results represents a lack of explainability and transparency. This is a major trust issue, as users and stakeholders need to comprehend the model’s reasoning to validate its reliability, fairness, and compliance with governance requirements.
Which of the following is MOST important to consider when validating a third-party AI tool?
When validating a third-party AI tool, the right to audit is most important because it allows the organization to independently verify the vendor’s compliance with security, privacy, and ethical standards. This ensures transparency in how data is handled and models are managed, reducing risks related to hidden vulnerabilities or misuse.
After implementing a third-party generative AI tool, an organization learns about new regulations related to how organizations use AI. Which of the following would be the BEST justification for the organization to decide not to comply?
An organization may justify limited or delayed compliance if the associated risk of noncompliance is assessed to be within its defined risk appetite. This reflects a formal risk management decision, balancing potential regulatory consequences against operational or strategic priorities. Compliance decisions should be risk-informed rather than based solely on popularity, audits, or undefined costs.
Which of the following is the MOST important consideration when deciding how to compose an AI red team?
The red team must have the right mix of technical and domain skills (ML, security testing, data/privacy, adversarial techniques, and relevant governance knowledge) so it can effectively identify and exploit weaknesses in the AI system; composing the team by capability ensures thorough, targeted evaluation.
Post your Comments and Discuss ISACA AAISM exam prep with other Community members: