Test your practical AI control choices across the lifecycle

Q1. A project team is building an AI system inventory. Which item belongs in the inventory according to the NIST sources?
- A list of the system's artifacts, such as incident response plans, data dictionaries, source code links, and AI actor contact information
- A marketing summary of the model's business value
- A weekly calendar of team meetings
- A list of unrelated office software licenses
Answer: A list of the system's artifacts, such as incident response plans, data dictionaries, source code links, and AI actor contact information
Q2. During an AI incident, which ownership and response element should the incident response plan define?
- Who is involved in response activities, who makes decisions during the incident, and who is accountable for those activities
- Only the final incident press release language
- A purchase approval workflow for new hardware
- The annual vacation schedule for the AI team
Answer: Who is involved in response activities, who makes decisions during the incident, and who is accountable for those activities
Q3. A model is being retired because a replacement is ready. What is the best decommissioning approach?
- Treat decommissioning as a managed transition, plan for migration to a replacement if appropriate, and decide where related systems and artifacts will be stored and for how long
- Delete the model immediately and discard all related records
- Keep the old model running indefinitely without review
- Retire the model only after removing every dependency without planning backups or retention
Answer: Treat decommissioning as a managed transition, plan for migration to a replacement if appropriate, and decide where related systems and artifacts will be stored and for how long
Q4. A team is offboarding an AI vendor and needs to avoid gaps in service. What additional decommissioning planning should it include?
- Plan for dependencies, backup plans, and what happens after vendor or service relationships end
- Ignore downstream effects if the model is no longer used
- Keep only the user interface and discard all other records
- Focus only on retraining and skip transition planning
Answer: Plan for dependencies, backup plans, and what happens after vendor or service relationships end
Q5. An incident coordinator asks what the response process should preserve and report. Which choice best matches the NIST sources?
- It should define reporting and documentation, keep records of errors, incidents, near-misses, and negative impacts, and preserve logs and provenance
- It should only track employee attendance during the incident
- It should document only the final executive decision
- It should avoid recording near-misses to reduce paperwork
Answer: It should define reporting and documentation, keep records of errors, incidents, near-misses, and negative impacts, and preserve logs and provenance

decrease the organization\u2019s trustworthiness.

future legal, regulatory, security or forensic investigations

Migration to the replacement system, if appropriate.

and support future AI-driven response actions

guardrails and backup plans are established and implemented

Test your practical AI control choices across the lifecycle

Explore related topics