Test your practical AI control choices across the lifecycle

Q1. A project team is building an AI system inventory. Which item belongs in the inventory according to the NIST sources?
- A list of the system's artifacts, such as incident response plans, data dictionaries, source code links, and AI actor contact information
- A marketing summary of the model's business value
- A weekly calendar of team meetings
- A list of unrelated office software licenses
Answer: A list of the system's artifacts, such as incident response plans, data dictionaries, source code links, and AI actor contact information[[cite:1]][[cite:2]]
Q2. During an AI incident, which ownership and response element should the incident response plan define?
- Who is involved in response activities, who makes decisions during the incident, and who is accountable for those activities
- Only the final incident press release language
- A purchase approval workflow for new hardware
- The annual vacation schedule for the AI team
Answer: Who is involved in response activities, who makes decisions during the incident, and who is accountable for those activities[[cite:3]][[cite:4]]
Q3. A model is being retired because a replacement is ready. What is the best decommissioning approach?
- Treat decommissioning as a managed transition, plan for migration to a replacement if appropriate, and decide where related systems and artifacts will be stored and for how long
- Delete the model immediately and discard all related records
- Keep the old model running indefinitely without review
- Retire the model only after removing every dependency without planning backups or retention
Answer: Treat decommissioning as a managed transition, plan for migration to a replacement if appropriate, and decide where related systems and artifacts will be stored and for how long[[cite:5]][[cite:6]][[cite:7]][[cite:8]][[cite:9]][[cite:10]]
Q4. A team is offboarding an AI vendor and needs to avoid gaps in service. What additional decommissioning planning should it include?
- Plan for dependencies, backup plans, and what happens after vendor or service relationships end
- Ignore downstream effects if the model is no longer used
- Keep only the user interface and discard all other records
- Focus only on retraining and skip transition planning
Answer: Plan for dependencies, backup plans, and what happens after vendor or service relationships end[[cite:11]][[cite:12]][[cite:13]][[cite:14]]
Q5. An incident coordinator asks what the response process should preserve and report. Which choice best matches the NIST sources?
- It should define reporting and documentation, keep records of errors, incidents, near-misses, and negative impacts, and preserve logs and provenance
- It should only track employee attendance during the incident
- It should document only the final executive decision
- It should avoid recording near-misses to reduce paperwork
Answer: It should define reporting and documentation, keep records of errors, incidents, near-misses, and negative impacts, and preserve logs and provenance[[cite:15]][[cite:16]][[cite:17]][[cite:18]][[cite:19]][[cite:20]]

decrease the organization\u2019s trustworthiness.

future legal, regulatory, security or forensic investigations

Migration to the replacement system, if appropriate.

and support future AI-driven response actions

guardrails and backup plans are established and implemented

Test your practical AI control choices across the lifecycle

Explorer des sujets liés