AI Governance & Risk Demo Exam — Express Operations

Question 1 :

An enterprise discovers that Microsoft Copilot, several AI-enabled SaaS applications, browser extensions, and departmental chatbots have been operating for months without a formal AI governance program. Leadership asks the governance team to begin remediation immediately. Which action should provide the BEST foundation for the program?

Options

Issue an enterprise AI policy immediately and require business units to certify compliance within 30 days.

Suspend every AI-enabled application until individual security assessments have been completed.

Establish an authoritative AI inventory that identifies use cases, owners, data exposure, integrations, decision impact, users, and applicable obligations, then risk-tier the identified systems.

Conduct adversarial testing against the most widely used generative AI platform before examining less frequently used systems.

Select a recognized AI governance standard and require every AI application to implement an identical control set.

Question 2 :

An AI governance team has documented an AI system's intended use, stakeholders, affected populations, foreseeable misuse, and operating environment. Independent testing then identifies unacceptable failure patterns under several realistic conditions. Under the logic of the NIST AI RMF, what should occur NEXT?

Options

Return exclusively to GOVERN because any measurable failure indicates insufficient governance structure.

Repeat MAP until all identified risks can be expressed quantitatively rather than qualitatively.

Continue MEASURE indefinitely because treatment decisions should not occur until uncertainty has been completely removed.

Transfer the issue to conventional enterprise cybersecurity because measurable failures are no longer AI governance matters.

Use the assessment results to prioritize and treat the risks, including determining whether deployment should proceed, be modified, restricted, or discontinued.

Question 3 :

An organization has an AI acceptable-use policy prohibiting confidential data from being entered into unauthorized generative AI systems. Six months later, DLP telemetry repeatedly identifies employees attempting to submit restricted information to unapproved AI services. Which conclusion is MOST defensible?

Options

The organization has a documented control, but evidence suggests that the control is not sufficiently effective by itself and requires stronger preventive, detective, enforcement, training, or monitoring mechanisms.

The governance objective has been achieved because documented policy establishes employee responsibility for violations.

The DLP events should primarily be treated as training failures because governance controls are concerned with policy rather than technical enforcement.

The acceptable-use policy should be withdrawn because technical controls provide stronger evidence of risk reduction than administrative controls.

The residual risk should automatically be accepted because the organization has both policy and DLP monitoring in operation.

Question 4 :

A vendor states contractually that customer prompts are not used to train its foundation model. During an assessment, however, the practitioner discovers that the service supports AI agents, third-party plugins, external retrieval sources and several downstream subprocessors. What additional evidence is MOST important before concluding that information-security risk is adequately controlled?

Options

Evidence that the foundation model achieved competitive benchmark scores for accuracy and reasoning.

Evidence that the vendor's security awareness training specifically includes generative AI terminology.

Confirmation that all users accessing the platform authenticate through enterprise single sign-on.

Verified data flows, integration permissions, subprocessor handling, retention paths, logging behavior, tool scopes, and controls governing information transmitted outside the primary model boundary.

Confirmation that the vendor has publicly documented principles concerning trustworthy and responsible artificial intelligence.

Question 5 :

A chatbot was approved to answer general service questions. It now retrieves from a new knowledge base, can initiate account changes, and is used by people seeking urgent assistance. The model itself has not changed. Which decision is best?

Options

Preserve approval because the model version, the original subject of testing, is unchanged.

Repeat the original answer-quality test and retain the existing authorization if it passes.

Reassess the changed context, tool authority, affected users, failures, and safeguards before expansion.

Allow the expansion while monitoring complaints for evidence that a new assessment is needed.

Require a vendor certification but defer review of the new knowledge base and account tool.

Question 6 :

A multinational organization purchases a third-party AI system for employment-related decision support in Europe. Management argues that all AI compliance responsibility belongs to the vendor because the organization did not develop the model. What should an international AI governance practitioner conclude FIRST?

Options

The argument is correct because organizations consuming externally developed AI systems normally fall outside AI-specific obligations.

The organization's legal and governance responsibilities depend on its role and use of the system; being a customer does not automatically remove deployer responsibilities or other applicable obligations.

Responsibility depends primarily on whether the vendor's foundation model was trained using data originating inside the European Union.

The organization assumes provider’s responsibilities automatically once its employees use model output in an employment process.

Vendor certification to an international AI management standard transfers operational accountability from the customer to the certified provider.

Question 7 :

A Rwanda-based controller holds a valid registration certificate for its current personal-data operations. It proposes moving the storage of AI-service records to a provider outside Rwanda. Which conclusion is best supported by Rwanda’s supervisory authority?

Options

Registration automatically permits foreign storage if the cloud provider signs a security agreement.

Foreign storage requires the applicable supervisory authorization; existing registration alone is insufficient.

Consent eliminates any requirement to address foreign storage authorization.

Encryption converts foreign storage into domestic storage for regulatory purposes.

The controller can move the records first if it updates the certificate at its next renewal.

Question 8 :

A group company wants to transfer personal data from Kenya to an overseas AI provider. Counsel has prepared EU standard contractual clauses but has not assessed Kenya’s transfer rules or the planned recipient relationship. What is the strongest next step?

Options

Adopt the EU clauses as written because contractual protection is sufficient in every jurisdiction.

Obtain consent from one representative data subject to cover the entire transfer program.

Transfer the data first and document the Kenyan legal basis during the next compliance audit.

Determine the applicable Kenyan transfer basis and safeguards, then document the recipient arrangement.

Prohibit the transfer because Kenya does not permit personal data to be processed abroad, document and report to the appropriate authorities.

Question 9 :

A Nigerian company proposes sending personal data to an overseas AI processor. Its project owner says the transfer is automatically lawful because the processor has a strong security certification. Which response best reflects the Nigerian regulator’s published guidance?

Options

Security certification may inform assurance, but the company must establish an applicable transfer basis and protection.

Certification is enough if the provider also agrees not to retain prompts.

No additional review is needed unless the information is classified as sensitive.

The transfer is prohibited unless the data is first stored in an EU member state and other due diligence is done in a timely manner.

An internal AI policy substitutes for the cross-border assessment if it names the processor as an in-scope stakeholder.

Question 10 :

A multinational company wants one AI governance baseline for operations involving US, EU, Kenyan, Nigerian, Ghanian and Rwandan personal data. A director argues that applying whichever country has the strictest-sounding rule will automatically resolve every local obligation. Which strategy is best?

Options

Use the EU rule globally because it necessarily includes every African transfer condition.

Use the strictest retention period and let the vendor address remaining local differences.

Adopt a shared baseline and maintain documented jurisdiction- and use-specific obligations.

Delay all jurisdictional analysis until the company has observed real-world incidents.

Write separate policies without a common baseline to avoid conflicts between jurisdictions.