Free Trusted AI Safety Expert (TAISE) practice test: 30 questions with answers

Recorded repayment outcomes act as labels, so the task is supervised learning. Clustering works without labels and does not predict a known outcome, reinforcement learning needs an interactive reward signal, and PCA reduces dimensionality without predicting anything.

A large gap between training and validation performance is the classic sign of overfitting, where the model memorizes details that do not carry over to new data. Underfitting would show poor results on the training data too, while label drift and vanishing gradients describe different problems that do not explain the train-validation gap.

Deep learning sits inside machine learning, which sits inside artificial intelligence, and machine learning systems learn from data. The other options reverse that hierarchy, claim deep learning needs no training data, or misdescribe expert systems, which encode explicit rules rather than learned weights.

Retrieval-augmented generation keeps knowledge in an external store that can be updated without retraining, and the retrieved passages ground the answer at query time. Nightly full retraining is impractical, temperature only changes randomness in token selection rather than adding knowledge, and a fixed decision tree does not use a generative model at all.

Self-attention computes weighted relationships between positions in a sequence, so each token's representation depends on its context. The lookup-table description, the image captioning step, and the random neuron dropping (a training regularization technique) do not describe what self-attention does.

Diffusion models are trained to reverse a gradual noising process by denoising in many steps, which matches the scenario. GANs rely on a generator-discriminator contest, VAEs use an encoder-decoder with a latent distribution, and RNNs process sequences rather than denoising images.

Condensing a long report into a short paragraph is a summarization task, which is a common generative AI use case. Image generation, anomaly detection, and speech synthesis solve different problems and do not match the input and output described.

Generated code can look plausible while being wrong, so human review and execution of the tests is the control that keeps the output trustworthy. Automatic acceptance, skipping review, and replacing hand-written tests all remove the check that makes the assistant safe to use.

Generative models learn the distribution of their training data and sample new artifacts from it, while classifiers map inputs to labels. The other options reverse the roles of the two model types or invent a rules-engine requirement that generative models do not have.

Local attribution methods estimate how much each input feature contributed to one prediction, which is what a per-decision reason needs. Overall accuracy describes the model globally, publishing code does not explain a specific outcome, and adding layers makes a network harder to interpret, not easier.

Group-level evaluation reveals disparate impact that an overall score hides, and dataset documentation exposes representation gaps before they cause harm. Dropping sensitive attributes leaves proxy variables in place, fairness metrics do not reduce performance by definition, and a vendor certificate does not transfer the organization's accountability for its own testing.

Transparency is about disclosing a system's purpose, data, design, and governance, whereas explainability is about giving a human-understandable reason for a particular output. The other options treat the two terms as synonyms or tie each one to a single lifecycle stage, which is inaccurate.

Release gates, monitoring plans, and rollback criteria belong in pre-deployment validation, before the model serves live traffic. Labeling, retirement, and tuning are real lifecycle activities, but they do not set the conditions for a safe release.

MITRE ATLAS is a knowledge base of adversary tactics and techniques against AI systems, modeled on ATT&CK. NIST SP 800-53 is a control catalog, OWASP ASVS covers web application verification, and ISO/IEC 27005 gives risk management guidance, so none of them is a threat taxonomy for AI.

Poisoning targets the data that will train the model, and extraction targets a model that is already serving queries in deployment. Prompt injection, adversarial evaluation during cleaning, and drift as a decommissioning-only threat each attach the threat to a stage where it does not occur or does not matter.

ISO/IEC 42001 is the standard that sets requirements for an AI management system, and organizations can be certified against it. ISO/IEC 27001 covers information security rather than AI management, ISO/IEC 22989 is a terminology reference, and ISO/IEC 23894 is risk-management guidance rather than a certifiable AI management standard.

The NIST AI Risk Management Framework is organized around the GOVERN, MAP, MEASURE, and MANAGE functions. The other options are real security resources, but none of them uses those four functions as its organizing structure.

The EU AI Act treats AI used for recruitment and candidate selection as high-risk, which brings obligations such as risk management, data governance, and human oversight. Minimal, unacceptable, and limited risk describe other categories, and none of them fits a ranking tool used in hiring.

The attacker's instructions arrive inside untrusted content that the model treats as commands, which is indirect prompt injection. Model inversion, data poisoning, and resource exhaustion are real attack categories, but none of them involves injected instructions that redirect the model's actions.

Least-privilege tool scopes and human approval for risky actions bound what a hijacked agent can do even after an injection succeeds. Broad credentials raise the impact, disabling logs removes visibility, and temperature does not control whether the model obeys injected instructions.

Red teaming is adversarial testing in which evaluators act like attackers to find unsafe or insecure behavior before real users do. Latency benchmarks, licensing reviews, and satisfaction surveys are useful activities but do not try to break the system.

Scoped access, encryption, and private networking with rate limits and logs are standard controls for a cloud AI endpoint that handles sensitive data. Embedding root credentials and publishing weights publicly both expose the account or the model, which is the opposite of what the controls are meant to achieve.

Under shared responsibility for managed AI services, the provider runs the infrastructure and platform, while the customer governs identities, the data sent to the service, and the use of its outputs. The other options describe provider-operated layers such as hypervisors, runtimes, and data center facilities.

Some serialized model formats can run code when they are loaded, so a malicious or altered artifact can compromise the serving process, which is why signing and integrity checks matter. The other options contain false claims about default encryption, query storage, or the inability to hash and sign artifacts.

Federated learning keeps raw data at each site and aggregates only model updates centrally, which satisfies the locality requirement. Oversampling and augmentation address class balance or data volume, and the dimensionality reduction option still moves the records to a central server.

Differential privacy adds calibrated randomness so that any single individual's data has a provably limited effect on the results. It does not promise that outputs never resemble training records, it does not encrypt data, and it is not the same as removing identifiers.

Data minimization limits shared data to what the stated purpose requires and reduces how identifiable people are. Sending the full database, relying only on a contract, or sharing everything with a later deletion request all expose more personal data than the test needs.

Drift monitoring detects that the relationship between inputs and outcomes has changed, and retraining on recent validated data restores accuracy under controlled release. Freezing the model leaves it stale, lowering thresholds hides the problem, and adding noise degrades learning instead of adapting to the change.

Feedback loops let attackers or biased users shift future model behavior, which is why learning from feedback needs validation and access controls. The other options are either not caused by continuous learning or overstate its effects, such as claiming total loss of learned behavior, automatic audit exemption, or latency caused only by checkpoints.

Shadow scoring compares the new model with live traffic without exposing customers to its decisions, and a small canary limits the impact before full rollout. Skipping live evaluation, cutting over everyone at once, and deleting the rollback path all increase risk.