1.0 AI Governance Overview

IBM Certified watsonx Governance Lifecycle Advisor v1 - Associate · 63 questions

• A data scientist at a financial institution is building a loan approval model. The compliance team requires the model to articulate the specific reasons why each loan application was denied. Which IBM Responsible AI pillar directly addresses this requirement?
• A healthcare organization is building predictive models using patient records and wants to ensure that data used in AI model training cannot be re-identified or traced back to individual patients. Which IBM Responsible AI pillar governs this requirement?
• An enterprise AI team must capture metadata for every model in production—including training datasets, hyperparameters, performance benchmarks, and data lineage—to satisfy internal and regulatory audit requirements. Which watsonx.governance component is specifically designed to fulfill this lifecycle tracking function?
• A risk management team must automate compliance workflow approvals, track policy violations, and integrate AI governance activities with existing enterprise Governance, Risk, and Compliance (GRC) processes. Which watsonx.governance component should they primarily leverage?
• An organization runs production ML models on Amazon SageMaker, Google Vertex AI, and Microsoft Azure ML and wants a single governance platform to monitor all models for data drift and bias without migrating them to IBM infrastructure. Which statement best describes watsonx.governance's capability in this scenario?
• During a vendor evaluation for an enterprise AI governance platform, the procurement team asks which external cloud ML platforms watsonx.governance officially supports for model monitoring alongside IBM's own watsonx.ai. Which answer is most complete and accurate?
• A national defense agency is subject to strict data sovereignty mandates prohibiting all AI governance metadata, model scores, and audit logs from being processed or stored outside its own data centers. Which watsonx.governance deployment option best satisfies this requirement?
• A Series A startup wants to deploy watsonx.governance as rapidly as possible without procuring hardware or managing infrastructure and prefers pay-as-you-go pricing. They have no regulatory requirements prohibiting shared cloud infrastructure. Which deployment option is most suitable?
• A municipal government proposes using an AI system that performs real-time biometric identification of individuals in public spaces to identify persons of interest during routine law enforcement operations without any individualized suspicion or prior authorization. Under the EU AI Act, how is this system classified?
• An AI governance specialist is reviewing mandatory compliance obligations for high-risk AI systems under the EU AI Act. Which of the following is NOT a mandatory obligation specifically required of high-risk AI systems under the Act?
• The EU AI Act establishes phased compliance deadlines for different categories of AI. By which specific deadline must providers of general-purpose AI (GPAI) models determined to pose systemic risk achieve full compliance with their applicable obligations?
• A risk analyst working on a credit-scoring AI system is cataloging all stakeholder groups who could be affected, documenting the operational context and intended use cases, identifying potential harms, and mapping societal impacts. Which NIST AI RMF function do these activities fall under?
• Following a MEASURE phase that quantified bias and reliability risks in a deployed AI recommendation engine, the operations team is now prioritizing which risks require immediate treatment, implementing threshold adjustments and re-weighting controls, and creating an incident response playbook for residual risks. Which NIST AI RMF function best characterizes these activities?
• An enterprise AI division wants to obtain internationally recognized third-party certification demonstrating it has implemented a comprehensive AI management system covering governance policies, risk management, performance evaluation, and continual improvement for all AI activities. Which standard provides the basis for this certification?
• A business analyst at a regional bank identifies the need for an AI model to predict loan defaults and submits a formal use case request documenting the business problem and expected outcomes. Which governance role does this person fulfill?
• After a credit scoring model is deployed to production it produces outputs that adversely affect a protected class. Regulators demand to know who bears ultimate accountability for the model's outcomes throughout its entire lifecycle. Which governance role is accountable?
• An insurance company requires that a new underwriting model be reviewed by someone who had no involvement in its development before it can advance to production. Which governance role performs this independent review?
• A healthcare company deploys a large language model to assist physicians with clinical documentation. A specialist is hired to craft test and iteratively refine the input prompts to optimize the model's medical accuracy. Which governance role describes this specialist?
• A hiring algorithm rejects candidates based on zip code. Analysis reveals that in this city zip codes strongly correlate with race due to historical housing segregation even though race is not a feature in the model. Which type of AI bias does this scenario illustrate?
• A data scientist evaluates a loan approval model and finds the approval rate for Group A is 70% while Group B's approval rate is 50%. The resulting value of 0.20 is used to flag the model for a fairness review. Which fairness metric did the data scientist calculate?
• After deploying an AI fraud detection system two distinct concerns emerge: production model performance is degrading and needs continuous monitoring and senior leadership needs an enterprise-wide report on AI risk exposure. Which pairing of roles correctly addresses each concern?
• A financial services firm tracks their credit scoring model from development through deployment in watsonx.governance. A risk officer needs an internal artifact that auto-captures lifecycle metadata and serves as a structured nutritional label for governance review. Which artifact should the data scientist provide?
• An AI oversight committee classifies three activities: (1) establishing enterprise-wide AI policies and accountability structures; (2) ensuring models meet SR 11-7 requirements for independent validation; (3) identifying and mitigating potential harms from model failures. Which answer correctly maps each activity to its discipline?
• A U.S. bank's model risk team receives examination findings from federal regulators citing inadequate independent validation and insufficient ongoing monitoring of credit decision models. Which regulatory guidance is the examiner most likely citing?
• A New York City staffing agency uses an automated tool to screen and rank job candidates for client positions. Legal counsel advises the agency must commission annual third-party bias audits and notify candidates that an automated decision tool is being used. Which law creates these specific obligations?
• An enterprise AI governance team has just deployed watsonx.governance and wants to immediately monitor models against established regulatory frameworks without building custom rule sets from scratch. Which feature provides this out-of-the-box capability?
• A multinational bank operates three AI models: one built with IBM AutoAI on IBM Cloud, one trained in Amazon SageMaker, and one built with open-source Python tools deployed on-premises. The Chief AI Officer requires unified governance of all three under consistent policies. Which watsonx.governance concept directly supports this multi-origin requirement?
• A model governance analyst must: (1) explain to a specific loan applicant why their application was denied, and (2) produce an executive report on which features most influence the model's decisions across the entire customer portfolio. Which approach satisfies both requirements?
• A design review raises the question of how AI risk should be identified before deployment. What is the right approach?
• A team preparing a production rollout wants to avoid inconsistent governance across departments. What should the organisation define to prevent that?
• Governance activities in the current plan are not linked to any external requirement. What should the plan instead map those activities to?
• A customer wants a scalable framework for governing AI systems across many teams. Which set of pillars should the framework be organised around?
• Converting a proof of concept into a governed production system, the team plans to run its first formal risk assessment only once a regulator requests documentation. What is wrong with this plan?
• An administrator troubleshooting a pilot deployment discovers that each team involved followed a different approval process before the model was allowed to proceed. What underlying problem does that reveal?
• An AI system is set to operate in more than one jurisdiction. What should the team do to match good practice?
• A team preparing a production rollout wants to avoid gaps in their governance coverage. Which pillar addresses whether the model performs consistently under unexpected or adversarial inputs?
• Every AI use case on the intake list has been marked low risk, including a new generative model used to draft customer-facing correspondence. What should the engineer reviewing the list flag?
• A customer wants its AI governance to scale smoothly as it adds more teams and more models. What should a consultant recommend it establish first?
• A governed production system rollout needs to prepare for a future audit. What should be preserved from the governance process?
• An administrator troubleshooting a pilot deployment finds that stakeholders cannot get a clear answer for why the model rejected a particular application. Which governance pillar was not adequately addressed?
• A customer support chatbot's risk register conflates operational risk with reputational risk. What is the correct distinction between the two?
• A team preparing a production rollout is asked to store its model approvals in a private messaging channel to move faster. Why should the team avoid that shortcut?
• Documentation is being trimmed from the current plan to speed up delivery. Why is removing documentation to move faster a poor trade-off in AI governance?
• A customer asks whether relying on their AI vendor's certifications is enough to satisfy accountability requirements. What should the consultant explain?
• With budget for only one risk-identification pass before launch, a proof of concept is being converted into a governed production system. What should that pass cover?
• An administrator finds that a pilot deployment proceeded because 'everyone involved meant well and trusted each other', with no documented control gating the release. What does this situation call for?
• A new privacy regulation needs to be incorporated into an existing AI governance framework. What is the correct approach?
• Which of the following best illustrates the transparency pillar in practice?
• The risk plan for a generative AI writing assistant contains no entry for ethical or reputational risk, only a security checklist. What gap does this reveal?
• A customer already has policies written down, yet each team applies them differently in practice. What is most likely missing?
• A governed production system is set to operate in a regulated industry. Which task should be completed as part of governance mapping?
• An administrator notices that a pilot model performs well on average but produces systematically worse outcomes for one customer segment. Which pillar has been violated, and what should be checked first?
• Timing becomes a point of contention: when should risk identification for a new AI system happen relative to deployment?
• Which combination of elements allows an AI governance operating model to scale across many teams without breaking down?
• A senior engineer is asked to confirm regulatory alignment for a deployed AI system. What evidence would best support that confirmation?
• A customer asks for one sentence summarising how the five governance pillars work together. Which answer best captures it?
• As a proof of concept moves toward becoming a governed production system, stakeholders question why reputational risk needs its own line item separate from regulatory risk. What is the best justification?
• Why does effective AI governance require ownership, policies, workflows and evidence to be defined together, rather than any one of them alone?
• Which statement best summarises good practice for mapping AI governance activities to external requirements?
• A governance lead is designing a checklist for new AI projects and wants exactly one question per pillar. Which question belongs under 'accountability'?
• Which statement best summarises how AI risk identification should be approached across a system's lifecycle?
• A customer wants its AI governance programme to work the same way in five years, regardless of staff turnover. What should the programme rely on?
• Documentation was removed earlier to hit a delivery deadline, and that gap has just surfaced while formalising governance. What is the most appropriate next step?