CRAGE practice questions
EC-Council · 612-51 · 200 questions
Original practice questions for the EC-Council Certified Responsible AI Governance & Ethics Professional (CRAGE) exam (exam code 612-51), covering AI foundations for governance, ethical principles and responsible AI, AI strategy and planning, governance frameworks, regulatory compliance, AI risk and threat management, third-party and supply-chain AI risk, AI security architecture and controls, privacy trust and safety, AI incident response and business continuity, and AI assurance testing and auditing. Content is original practice material aligned to the official exam modules and is not a brain-dump of actual exam questions.
This course contains the use of artificial intelligence.
About the 612-51 exam
- Time allowed
- 3 hours
- Questions
- 100
- Format
- MCQ (multiple choice), not open book; ECC Exam Centre or EC-Council Remote Proctoring Service (page is inconsistent on delivery)
Exam details published by the vendor, checked 6 November 2026. Vendors change fees and formats without notice — confirm on the vendor's own page before you book.
Practice Quizzes
Test your knowledge with standard 20-question practice sets.
Quiz 1
Quiz 2
Quiz 3
Quiz 4
Quiz 5
Quiz 6
Quiz 7
Quiz 8
Quiz 9
Quiz 10
Browse by Domain
Study specific topics at your own pace.
AI Foundations and Technology Ecosystem · 20 questions
- A city CIO tells council that a 311 triage tool qualifies as AI. What criterion should the CIO emphasize?
- Public-works analysts want to classify pothole severity from labeled inspection photos and separately discover themes in unlabeled work-order notes. Which pairing correctly maps the learning approaches?
- A transit authority contrasts a fare-discount engine that applies fixed eligibility rules with a GenAI assistant that drafts rider-service replies. What distinction should governance emphasize?
- A county assessor briefs the board on how AI used for deed summarization evolved over decades. Which narrative best reflects that evolution for civic governance literacy?
- A housing authority compares two AI uses: scoring tabular eligibility fields and analyzing inspection photos with deep learning vision. What distinction should staff document?
- Emergency management reviews a flood-alert tool that chains multi-step actions versus a single static flood-risk classifier. What capability should leaders associate with the chained system?
- Library digital services maps three AI uses across modalities. Which mapping best illustrates real-world civic AI applications by type?
- A municipal open-data team shows that a permitting chatbot, a traffic-signal optimizer, and a benefits fraud-flag model share a common pattern. What pattern should governance recognize?
- A water utility diagrams governable stages for a leak-prediction project. Which sequence correctly reflects a typical AI project life cycle?
- A city MLOps lead briefs executives on practices that make civic models governable. Which set best captures governance-visible MLOps practices?
- A county DataOps team sets prerequisites before any resident-facing model ships. Which prerequisite best reflects DataOps’ role in trustworthy municipal AI?
- A public hospital district compares deployment options for a PHI-heavy triage assistant and a non-PHI drafting helper. Which deployment approach best matches governance needs?
- 311 product owners inventory components of their AI technology stack for governance. Which inventory best covers the stack layers leaders must track?
- A parks department chooses where litter-detection inference will run for trail cameras. What tradeoff should leaders weigh between edge and central cloud batch scoring?
- Courts IT documents system components for the AI inventory. How should foundation-model APIs, fine-tuned local classifiers, and classical models be treated?
- Fire/EMS contrasts nightly station risk scoring with streaming call-type prediction during active dispatch. Which statement correctly distinguishes the inference modes?
- An elections office compares two ways to help clerks answer procedure questions about municipal code. What contrast should governance understand between RAG and fine-tuning?
- An assessor’s office prepares to approve a valuation-assist model. Which artifacts most directly support governable documentation of how the AI system was built?
- City digital services explains why a code-enforcement intake that accepts text plus photos differs from a text-only chatbot. What capability is being highlighted?
- A utility cybersecurity board asks how to separate accountabilities in an AI outage predictor. Which separation best supports clear governance?
AI Concerns, Ethical Principles, and Responsible AI · 15 questions
- Housing caseworkers report that an AI eligibility screener shows higher denial rates in some neighborhoods after go-live. What concern should the AI ethics review prioritize?
- A public-health privacy officer objects to training a GenAI note summarizer on identifiable clinic visit text without minimization. What concern is the officer correctly raising?
- Transit riders lose trust when delay predictions stay opaque while one corridor is chronically late. Which ethical concern should the authority address first?
- A city ethics board reviews a 311 bot that tells residents it “feels” their frustration. What ethical concern should the board flag?
- County counsel warns that a courts GenAI assistant could expose sealed case notes if hostile prompts manipulate it. Which concern is counsel correctly highlighting?
- A city library board wants standing ethics principles for any public-facing AI service. Which set best matches fundamental AI ethics principles for municipal policy?
- A mayor’s AI council wants city procurement checklists to reflect globally recognized trustworthy-AI expectations. What should the council primarily map into those checklists?
- A permitting director learns an AI tool may recommend denying small-business permits that affect livelihoods. What responsible-AI usage practice should be required?
- A county workforce-training center wants to use GenAI to score certificate exams. Which practice best reflects safe and accountable AI usage?
- Emergency management is building an alert-prioritization model. How should ethics review be integrated into a responsible AI development lifecycle?
- A city attorney discovers parking-enforcement computer vision may be expanded to sidewalk-vending detection without a new purpose statement. What ethical control should be required first?
- 311 leadership deploys an AI drafting assistant for resident replies. What responsible usage practice should staff training emphasize?
- A parks department proposes training a trail-camera litter model using scraped social-media faces without a consent basis. What is the sound ethical response?
- A utility board reviews a credit-risk-adjacent shutoff predictor. What responsible-AI analysis should be documented before approval?
- County GRC wants responsible AI to be operational rather than a post-hoc slide. Where should responsible-AI checklists be integrated?
AI Strategy and Planning · 18 questions
- A city manager is drafting the municipality’s AI vision. What should the vision primarily tie AI investments to?
- A county pauses new AI pilot funding until readiness is scored. Which dimensions should a municipal AI readiness assessment typically cover?
- A transit authority must place AI ideas on a crowded roadmap. Which prioritization criteria set is most appropriate?
- A housing authority plans an 18-month AI roadmap. What does sound roadmap development emphasize?
- Before funding a predictive code-enforcement model, the open-data office proposes a modernization step. Which investment best reflects data modernization as an AI strategy prerequisite?
- A public-works CIO wants legacy work-order systems to support governable AI tools safely. Which modernization priority best enables that strategy?
- 311 plans a citywide chatbot expansion. What pilot design practice should precede that expansion?
- Fire/EMS wants to scale a call-type assist model across stations. What scaling strategy is most appropriate?
- A library plans to offer catalog GenAI to the public. What culture and workforce step should leadership fund first in the AI strategy?
- A city performance office wants KPIs for AI initiatives. Which metric set best fits municipal performance management?
- County digital services wants lifecycle gates on the AI portfolio. Which stage sequence best reflects a civic AI adoption roadmap?
- A water utility is excited about a GenAI customer-care bot but meter-data quality scores are poor. What readiness-driven sequencing decision is appropriate?
- An elections office is sequencing AI use cases under high public trust requirements. Which approach is most risk-aware?
- A public hospital district is setting AI strategy. Who should be aligned beyond IT alone?
- An assessor’s office completes an AI maturity self-assessment. How should the results primarily inform planning?
- A parks department is sequencing AI roadmap funding. How should it align initiative timing?
- A city CAIO is building the AI roadmap. When should product owners, model stewards, and ethics reviewers be defined?
- A county board reviews AI business cases. What should each case include to support value-driven prioritization?
AI Governance and Frameworks · 17 questions
- A city is establishing an AI governance board. Which composition best supports a municipal operating model?
- A county charter is clarifying AI accountability. What ownership arrangement best supports governance?
- A 311 office is writing AI use policy. What scope control should the policy define?
- A municipal court is setting AI decision rights for docket work. Which arrangement is appropriate?
- A water utility wants to structure AI controls using NIST AI RMF. What is the sound approach?
- A city is aligning to ISO/IEC 42001 for AI management. What should the AIMS-oriented adoption emphasize?
- A housing authority is hardening lifecycle governance for production AI. Which documentation set is most appropriate?
- A transit agency is building an AI system inventory. Which fields best support asset management?
- A public-health department uses AI that can influence outbreak response messaging. What oversight requirement is most appropriate?
- A county wants to operationalize AI oversight beyond ad-hoc spreadsheets. What should it select?
- A public library is adding GenAI services. Which control-catalog coverage is most appropriate?
- Emergency management is embedding AI into its RACI. Which lifecycle practice strengthens governance?
- City council policy addresses AI inventory integrity. Which executive ritual best supports governance?
- A permitting office uses AI that can conflict with zoning code interpretation. What control is most needed?
- A utility GRC team is adopting global AI governance themes. What should it do next?
- A parks department is clarifying AI operating-model roles. What should model stewards be responsible for?
- A county auditor reviews high-risk AI go-lives. What evidence best demonstrates decision rights?
AI Regulatory Compliance · 15 questions
- City counsel is classifying municipal AI for regulatory readiness. Which approach reflects risk-tiered thinking?
- A county privacy office reviews GenAI that logs resident chat transcripts. What should it primarily align?
- A public hospital district runs AI on patient-adjacent administrative data. What compliance capability should it track?
- A housing authority deploys an eligibility model with city staff and a vendor. What should documentation clarify?
- A transit agency is preparing for AI regulatory scrutiny. Which evidence pack best supports audit readiness?
- An elections office wants ongoing assurance that AI tools supporting voter-roll maintenance stay within legal limits. What practice best fits continuous compliance monitoring?
- City legal is reviewing biometric CCTV analytics in public spaces. What should the compliance lead track first?
- A 311 service uses automated decision assistance for some tickets. Which action best upholds resident user rights and transparency?
- County risk counsel reviews staff treating AI zoning recommendations as binding orders. What legal risk management step is most appropriate?
- A municipal utility uses AI that can influence credit and shutoff-adjacent decisions. What operational practice best supports reporting obligations?
- A library considers sending EU resident library-use data to an unapproved overseas model trainer. What compliance stance is correct?
- Fire/EMS evaluates a vendor tool advertised as “AI Act ready.” What should municipal buyers demand?
- An assessor’s office wants to expand valuation AI into appeals recommendations. What should happen before the expansion?
- Public works is drafting AI procurement clauses. Which alignment best supports civil-rights and accessibility compliance?
- City GRC wants AI controls to stay current when guidance shifts. What practice best supports continuous legal-risk management?
AI Risk and Threat Management · 24 questions
- A city SOC briefs the AI board on threats to the 311 GenAI assistant. Which governance-level recognition is most appropriate?
- County threat briefings cover fraud models trained partly on public form submissions. What AI threat should leaders recognize?
- Transit security reviews a proprietary ridership predictor hosted with a vendor. Which risk belongs on the AI threat register?
- Housing analysts build an AI risk taxonomy for an eligibility screener. What category should sit alongside cybersecurity risks?
- A water utility is formalizing AI risk management. Which artifact best captures identified risks?
- Emergency management must prioritize AI risks under limited resources. Which prioritization approach best fits civic public-safety outcomes?
- Courts IT assesses GenAI that drafts clerk responses citing municipal code. Which operational AI risk should be explicitly assessed?
- A library scores risks for a RAG assistant over patron-related corpora. Which risk belongs in the assessment?
- City GRC wants framework structure for AI risks already identified. What mapping best applies NIST AI RMF thinking?
- A county adopts ISO/IEC 42001-aligned AI risk treatment. Which set of options should decision records support?
- Public health threat-models a triage chatbot before launch. Which oversight-level coverage is most appropriate?
- A permitting office analyzes AI system attack surface for governance review. Which inventory is most complete?
- Fire/EMS evaluates risks to computer-vision fire-spotting cameras. Which threat recognition is appropriate at governance level?
- A 311 product risk workshop adapts structured threat modeling to AI. Which approach best fits?
- A utility risk team reviews AI dependencies beyond traditional app CVEs. Which systemic AI risk should they add?
- An elections office rates threats to public communications integrity before election season. Which AI-related risk belongs on the register?
- An assessor’s office evaluates what happens if valuation AI systematically skews one district. Which impact dimensions should the risk assessment capture?
- A parks department still sees known false positives from trail-cam AI after controls. What governance outcome should be logged?
- City GRC adds human review and rate limits to a GenAI service desk. How should risk scores be compared?
- County ERM wants AI risks visible to executives alongside other enterprise risks. What practice best fits?
- A public hospital district ranks AI risks across clinical and administrative tools. Which prioritization is most appropriate?
- Transit reviews what happens if one GenAI vendor outage blocks rider-facing chat. Which risk should be assessed?
- Code enforcement notices construction patterns changing after a new zoning code. Which AI risk should they flag?
- City counsel reviews who must own residual risk statements on the AI risk register. What accountability rule fits?
Third-Party AI Risk Management and Supply Chain Security · 20 questions
- City procurement drafts due diligence for an AI vendor RFP. Which questionnaire coverage best fits AI-specific risk?
- County legal is hardening contracts for a GenAI case-note summarizer. Which clause set best supports AI vendor governance?
- Transit evaluates reliance on one GenAI API for all rider communications. Which third-party risk should leadership prioritize?
- A housing authority learns its chatbot vendor fine-tunes on customer tickets. Which third-party AI risk category is in play?
- A water utility maps AI supply-chain threats before adopting pretrained components. Which threat set belongs in the review?
- A library requires assurance before buying GenAI for staff research support. What evidence mix best fits?
- Public health reviews a vendor model that may process clinic admin data. Which regulatory-aligned vendor check is most appropriate?
- 311 operations want ongoing insight into an AI vendor after go-live. Which monitoring set best fits continuous vendor oversight?
- Courts IT is preparing to renew a legal-research GenAI contract. What assurance step best fits the vendor lifecycle?
- An elections office ends a GenAI pilot that held civic corpora. Which offboarding actions are most responsible?
- Fire/EMS learns a CAD assist vendor added a new model host. What supply-chain review should follow?
- An assessor’s office decides whether to renew an AI valuation-assist vendor. What decision basis best fits?
- Parks staff propose a free consumer GenAI for official trail guidance. What evaluation outcome best fits civic controls?
- City GRC maps how privacy and AI obligations reach vendors. Which flow-down expectation is most appropriate?
- County GRC shares a case study after a biased vendor screening tool shipped without local fairness testing. What oversight lesson fits?
- A utility negotiates SLAs for a vendor-hosted AI outage predictor. Which commitment best fits change control?
- Public works finds open-source model components in a vendor stack. What supply-chain step should come first?
- 311 updates its incident playbook for AI outages that affect residents. What vendor expectation belongs in the contract?
- Housing legal drafts an AI eligibility-tool contract. How should liability for discriminatory outcomes be addressed?
- A city AI board wants executive visibility into vendor AI risk. Which dashboard content best fits?
AI Security Architecture and Controls · 18 questions
- A city CISO sets architecture principles for municipal AI. Which secure-by-design trio best fits?
- County IT maps defense-in-depth for a civic AI stack. Which layer set best fits?
- Transit hardens model-serving APIs used by rider apps. Which pattern best fits?
- Housing IT prepares eligibility models for production. Which control best protects model integrity before go-live?
- A water utility deploys leak-prediction services in containers. Which runtime control set best fits?
- 311 places controls in front of GenAI backends. Which API gateway capability set best fits?
- Courts deploy a public chatbot tier near sealed-case systems. What architecture control best fits?
- A library builds custom microservices that wrap GenAI models. Which expectation best fits secure delivery?
- Fire/EMS threat-models camera training pipelines. Which control focus best fits?
- A public hospital district reviews AI architecture diagrams. Which approach best strengthens the review?
- An elections office integrates vendor model APIs. Which credential practice best fits?
- The assessor’s office maintains valuation-model wrappers. Which secure coding practice best fits?
- Parks enables detection for a booking GenAI assistant. Which monitoring focus best fits abuse?
- City security rejects a proposal for a public-facing AI tool. Which sole control is inadequate?
- County defines inference-time controls for GenAI and predictive APIs. Which set best fits?
- A utility exposes AI endpoints for customer self-service. Which availability protection best fits?
- 311 reviews security logging for a GenAI assistant. Which practice best balances forensics and privacy?
- Public works designs AI environments for a resident-facing predictor. Which separation rule best fits?
Building Privacy, Trust, and Safety in AI Systems · 17 questions
- A county privacy office prepares 311 transcripts for GenAI fine-tuning. Which practice best fits?
- Public health wants to publish AI-assisted aggregate clinic wait-time insights. Which PET approach best fits?
- A housing authority prepares case notes for vendor model evaluation. Which privacy step best fits?
- A city library logs GenAI chat sessions with patrons. What privacy control should leadership set first for those logs?
- A city proposes facial analytics on public plaza cameras. What privacy step should precede go-live?
- Transit riders ask why AI-estimated arrival times jump. What trust mechanism should the agency publish?
- Residents distrust terse 311 bot replies. Which trust-building UX should the city add?
- A court clerk AI assists administrative case routing. What rights-oriented control should leadership require?
- A water utility prioritizes leak crews with an AI model. What fairness practice should operations monitor?
- An elections office will process volunteer contact data in an AI scheduling tool. What privacy practice is required?
- Fire/EMS hosts a public GenAI widget. What safety control should block harmful outputs?
- Property owners dispute AI-assisted valuation flags. What trust mechanism should the assessor add?
- Parks runs AI cameras for trail safety analytics. What public trust artifact should the department issue?
- A county ethics board reviews new civic AI builds. What design practice should it certify?
- A public hospital district wants periodic confidence in its clinical AI aids. What monitoring approach fits?
- After deploying a city permitting assistant, what ongoing trust practice should GRC enable?
- A utility trains customer-usage models on sensitive meter histories. What data-protection control should it adopt?
AI Incident Response and Business Continuity · 18 questions
- A 311 GenAI bot begins leaking internal knowledge snippets. What IR artifact should the city write?
- County IR must triage AI failures consistently. How should AI incidents be classified?
- Transit sees anomalous GenAI answers in rider chat. What containment action fits while preserving service?
- A housing authority finds a poisoned training batch. What eradication and recovery step should follow?
- After a utility AI outage, what post-incident metrics should the review capture?
- Library AI logs expose patron contact data. What external action should the IR plan require?
- A court AI event may involve sealed data. What escalation path should IR define?
- Emergency management wants readiness for AI outages affecting public info. What exercise should it run?
- Fire/EMS reviews IR coverage for model drift and hallucination crises. What limitation should the plan document?
- 311 designs business continuity for its AI assistant. What BC planning step comes first?
- An assessor’s office depends on valuation AI. What DR practice should IT and GRC establish?
- A parks department depends on a vision pipeline for trail advisories during peak season. Which continuity action best prepares for pipeline failure?
- A water utility’s customer GenAI assistant depends on a third-party API. Which BCP element best addresses supply-chain continuity?
- An elections office will use AI-assisted communications tools before election season. Which readiness step best strengthens AI incident response?
- After an AI misinformation incident in outbreak messaging, what should public health do to improve continuous readiness?
- A city PIO must brief media after a resident-facing bot gaffe. Which communications approach best fits AI incident response?
- A county wants proof its AI continuity plan works. Which testing mix best covers municipal AI disaster recovery?
- Transit maps AI dependencies for recovery. Which prioritization best reflects continuity tiers?
AI Assurance, Testing, and Auditing · 18 questions
- A city assurance lead briefs council on AI oversight. Which definition best captures AI assurance?
- A county builds an AI assurance program. Which mapping best reflects an assurance governance model?
- A 311 team plans pre-release tests for a multilingual chatbot. Which approach best reflects risk-based AI testing?
- Before an eligibility model go-live, what testing scope best fits housing-authority AI assurance?
- Transit reviews an ETA model used across corridors. Which assurance activity best addresses fairness?
- A water utility prepares a leak-prediction model for production. Which assurance practice best pairs validation with sustainment?
- Courts gate a GenAI clerks’ tool into pre-prod. Which assurance test type best belongs in that gate?
- A library prepares a public catalog GenAI launch. Which testing combination best fits public-facing assurance?
- Fire/EMS evaluates a dispatch-assist AI. Which testing approach best fits emergency workflow assurance?
- A public hospital district prepares for an AI audit. Which evidence set best supports assurance?
- An elections office assures voter-support AI. Which artifact best demonstrates audit traceability?
- An assessor’s office runs internal AI audits. Which practice best completes the assurance cycle?
- Parks leadership wants stronger oversight of camera analytics AI. Which audit approach best fits governance reporting?
- A city CAIO reviews an AI audit package. Which report content best supports executive governance decisions?
- County GRC reviews a permitting AI system. Which distinction best separates validation from verification?
- A utility sustains AI assurance after go-live. Which practice best keeps assurance current?
- 311 completes abuse testing on a resident chatbot. How should results enter the assurance file?
- Public works wants assurance practices to keep pace with rules and tooling. Which action best shows continuous improvement?
These questions are original practice material and are NOT actual exam questions or brain-dump content. This site is not affiliated with, endorsed by, or sponsored by EC-Council. All EC-Council, CRAGE, C|RAGE, and related marks are trademarks of their respective owners.