AI Risk Management

AAISM · 62 questions

• A city risk office must approve a generative benefits chatbot. Which action best defines AI risk thresholds before go-live?
• Public-health plans to deploy an outbreak-summary model on clinic notes. Which risk action should occur before deployment?
• Transit identifies bias risk in an on-time prediction model that varies by route. Which management action best selects an AI risk treatment?
• Courts assess risk that a drafting assistant could disclose confidential case material. Which assessment approach best frames that AI risk?
• A housing authority tracks AI risks for tenant tools. Which practice best oversees AI risk within the enterprise risk lifecycle?
• 311 leadership learns of a deepfake robocall campaign targeting the city’s phone tree. Which risk action best responds to that external AI-related factor?
• A water utility compares AI that can recommend valve changes with FAQ chatbots. Which threshold practice best reflects decision criticality?
• Emergency management evaluates harms from an AI public-messaging assistant. Which assessment practice best includes AI-specific harm categories?
• A school-district risk team sets an agreed hallucination-rate limit for student-facing AI. Which practice best links that threshold to treatment?
• A library board reviews a low-stakes catalog recommender with limited resident harm potential. Which risk treatment is most appropriate when residual risk is within appetite?
• An assessor’s office learns of a statute change requiring greater algorithmic transparency for valuation helpers. Which risk action best follows?
• Parks adds human review before publishing AI-generated trail-closure posters. Which comparison best shows the control’s effect on AI risk?
• County IT is offered an AI vendor contract that claims privacy risk is fully transferred to the vendor. Which conclusion best reflects sound AI risk treatment?
• Fire/EMS leadership must prioritize AI risk treatment across several assistants. Which use case should receive treatment first?
• A permitting office relies heavily on AI plan-check suggestions. Which risk scenario should the assessment document and treat?
• City finance asks security for AI risk statements suitable for insurance and audit committees. Which approach best meets that governance need?
• Public works evaluates an AI that could autonomously issue stop-work orders at job sites. Which risk treatment best matches unacceptable autonomy?
• Elections risk officers learn the vendor changed the underlying foundation model mid-election cycle. What should they do next for AI risk management?
• Housing caseworkers paste tenant details into unsanctioned public AI chatbots. How should the AI risk assessment treat this condition?
• Transit monitoring shows a scheduling model’s fairness metrics worsened after a service change. Which AI risk action is most appropriate?
• A city CISO needs to allocate limited AI control investment across departments. Which assessment approach best supports that prioritization?
• A city SOC must improve threat coverage for the permitting chatbot. Which action best addresses the AI threat landscape?
• Public-health staff notice suspicious document uploads into a RAG knowledge base. What vulnerability-management action should security take?
• Transit security wants assurance that an operations assistant will not leak driver PII under adversarial prompts. Which threat-testing approach is most appropriate?
• Courts IT trains helpers on sets that may include sensitive opinion text. Which AI-specific vulnerability class should the threat assessment include?
• During storm season, 311 experiences oversized prompt floods against its resident assistant. Which AI threat concern should vulnerability management address?
• A housing authority finds an agent plugin that can update case records with excessive privileges. What is the appropriate vulnerability-management response?
• Emergency management worries adversaries could deepfake the emergency manager during a crisis. How should this appear in AI threat work?
• A water utility operates a leak-prediction model in production. Which vulnerability-management practice best sustains assurance over time?
• School-district security finds an assistant inventing disciplinary policy that staff might follow. How should this be treated in AI vulnerability management?
• Library IT learns a base-model update channel may have been compromised. Which threat perspective should vulnerability management apply?
• An assessor’s office sees model skew after parcel data quality drops post-migration. What should AI vulnerability management recognize?
• Parks security finds users can circumvent guardrails to obtain unsafe trail advice from a visitor assistant. What should be done?
• Fire/EMS evaluates an LLM assistant that returns clickable links in replies. Which threat should vulnerability management emphasize?
• County IT discovers a vector database holding complaint embeddings lacks access controls. How should AI vulnerability management prioritize this?
• Permitting security learns of new prompt-firewall bypass techniques in industry advisories. What is the correct threat-management response?
• Public works suspects a model reveals details from underground infrastructure maps used in training. Which threat class should drive treatment?
• An elections office uses RAG over voter-guide PDFs. Which AI threat should testing specifically target?
• City incident response needs a structured way to classify an attack on a municipal LLM gateway. Which approach best supports AI threat assessment?
• Housing chatbot capacity collapses after scrapers flood token-heavy requests. Which vulnerability-management response best addresses this AI threat?
• Transit security wants richer prompt logging for an AI assistant but worries the logs become a new exposure. What should management require?
• Courts plan major case-management releases that include AI features. Which testing practice best fits AI vulnerability management?
• A city is issuing an RFP for a 311 generative platform. Which action best embeds AI security into vendor selection?
• Public-health leadership is contracting an AI vendor that will process clinic-related content. Which supply-chain due diligence step is most appropriate?
• Transit depends on a vendor foundation model for safety-related assistant claims. What contractual control best manages model-change risk?
• Courts evaluate a legal-research AI vendor. Which evaluation criterion best reflects AI supply-chain assurance?
• A housing authority has live SLAs with a case-management AI vendor. Which practice best verifies ongoing AI security commitments?
• Emergency management adopts a SaaS AI drafting tool. Which supply-chain action best addresses hidden dependencies?
• School-district procurement is scoring an edtech AI vendor. Which assurance artifact best supports AI supply-chain evaluation?
• A library consortium wants consistent AI vendor reviews across branches. Which approach best standardizes supply-chain due diligence?
• A niche water-utility leak-detection AI vendor is being acquired. Which supply-chain concern should management prioritize?
• Permitting IT will upload city documents into a vendor fine-tuning pipeline. Which vendor security requirement is most critical?
• An assessor’s office buys AI valuation assistance. Which contractual right best supports ongoing vendor oversight?
• Parks staff find a free consumer AI plugin silently enabled inside landscaping SaaS. How should security treat it?
• Fire/EMS is selecting a CAD AI vendor for sensitive call types. Which requirement best reflects data-sovereignty needs?
• County IT scores vendors for AI that influences benefit decisions. Which capability should weigh heavily in selection?
• City security reviews an LLM gateway SaaS before adoption. Which technical requirements are most appropriate?
• An elections office is offboarding a chatbot vendor. Which control best protects AI-related civic data at exit?
• Public works compares open-weight self-host versus closed API AI vendors. How should security requirements be applied?
• Housing counsel finds a vendor’s AI training opt-in is enabled by default. What should management require?
• Transit discovers a known OWASP LLM vulnerability in a vendor gateway before go-live. What is the appropriate supply-chain response?
• 311 operations relies on an AI SaaS platform. Which monitoring approach best manages ongoing vendor AI control risk?