Free Artificial Intelligence Governance Professional (AIGP) practice test: 30 questions with answers

Without lineage and provenance, the organization cannot verify its rights to use the data, trace errors back to their source or respond to audits. The other gaps are real quality issues, but they do not create the legal and accountability exposure described in the scenario.

A selection rate ratio below 80 percent, the four-fifths guideline, is a standard signal of potential adverse impact that requires investigation. Similar overall accuracy does not rule out unequal outcomes, and latency and loss comparisons say nothing about the approval disparity.

Prompt injection testing specifically probes whether instructions embedded in untrusted content can hijack the model or its tools. Regression, load and usability testing are valuable, but none of them is designed to find this class of attack.

A model card is a standard documentation artifact for intended use, performance across conditions and limitations. The other artifacts document security findings, contractual data handling and change approval, which serve different purposes.

Release decisions should rest on tests measured against predefined criteria, documented risk acceptance and known limitations. A demonstration on hand-picked examples, the popularity of a library and verbal assurance do not show that the system meets its requirements.

Trade-offs between performance and fairness should be recorded, escalated to someone accountable, and decided with documented rationale rather than resolved silently. The other responses hide the issue, leave it unmanaged, or defer a known risk until after deployment.

Monitoring input distributions against a baseline with agreed alert thresholds detects data drift early. Storing datasets, relying on annual vendor reports and disabling logging each leave the organization unable to see how current inputs compare with what the model was built on.

Documenting sources and transformations and keeping lineage let the organization trace inputs and show lawful use. Freezing a version despite known errors and copying personal data into test environments without controls are poor practices that create accuracy and privacy risks.

The impact of errors on individuals in the decision context is the key deployment risk factor, and it determines how strict oversight, testing and appeal rights must be. Vendor brand, pretraining volume and front-end language do not measure the harm a wrong decision would cause.

On-premises or private hosting keeps data and processing inside the organization's controlled environment, which is what residency rules require. The other options send data to shared or third-party infrastructure, which conflicts with the stated constraint.

An explicit data use restriction, paired with clear terms about retention and training, directly controls whether customer data can feed the vendor's models. The liability cap, marketing duty and renewal term matter for other reasons but do not govern how the vendor may use the data.

Open-weight models come with licenses that can limit commercial use, derivative works or redistribution, and these terms must be checked for the intended use. Parameter count, leaderboard rank and support responsiveness do not determine whether the license allows the product to be sold.

Incident response starts with containing the harm, alerting the accountable owner and preserving evidence so the cause can be investigated. Waiting for a quarterly review, deleting logs and retraining without testing each delay containment or destroy evidence.

Decommissioning should preserve the records needed to answer questions about past decisions and dispose of personal data in line with retention rules. Deleting documentation, reusing data without review and leaving an endpoint live all create accountability, privacy or security gaps.

Drift and expansion to under-represented populations change the conditions under which the model was validated, so retraining or reassessment is warranted. A marketing brochure and a formatting-only review do not change model behaviour or the evidence supporting it.

A model validated on one task and population cannot be assumed to perform safely in a different clinical context, so the use case needs a new risk assessment and validation. File format, interface theme and storage size are practical issues, but they do not address whether the triage output is reliable.

Reusing data for a new purpose such as model training requires a compatibility assessment or a new lawful basis under purpose limitation. Minimization, storage limitation and accuracy are real principles, but none of them governs whether a new purpose is permitted.

Under GDPR, a lawful basis must be established for each purpose, and consent bundled into terms is usually not freely given or specific. Health data is special category data that needs an additional condition, and pseudonymized data remains personal data, so anonymization alone does not settle the analysis.

The Act bans a defined list of practices, such as certain manipulative techniques and certain social scoring practices, because the risk is considered unacceptable. The other tiers are regulated rather than banned: high risk requires conformity assessment, limited risk requires transparency, and minimal risk is largely unregulated.

Employment uses, including systems that filter applications or evaluate candidates, appear in the Act's high-risk list even when a human makes the final call. Processing personal data does not by itself make a system prohibited, and notice alone understates the conformity and oversight duties that apply to high-risk systems.

ISO/IEC 42001 specifies requirements for an AI management system and can be certified by an accredited body. ISO/IEC 22989 defines terminology, ISO/IEC 23894 gives risk management guidance rather than certifiable requirements, and ISO/IEC 27001 covers information security.

The NIST AI RMF 1.0 is built on four functions: Govern, Map, Measure and Manage. Identify through recover belongs to the NIST cybersecurity framework, and the other two sets are general life cycle or quality models that the AI RMF does not use.

The OECD AI Principles are non-binding recommendations that adherents commit to promote, and they include value-based principles such as transparency and explainability. Calling them binding treaty obligations or saying they replace national law misstates their legal status and scope.

Machine learning infers patterns from training data, while rule-based systems apply if-then logic that developers encode directly. The other options are wrong: learned models are often harder to interpret than explicit rules, rule-based systems are routinely used for individual decisions, and the description of learning and reprogramming is reversed.

The deploying organization remains responsible for risks in its own context, and generic vendor testing does not establish performance for its customers, data or channels. The other options treat vendor testing as sufficient, reduce governance to audit compliance, or wrongly exclude vendor-hosted systems from scope.

Hallucination describes confident, fluent output that is unsupported by facts or sources, which matches invented citations. Drift, membership inference and data poisoning are real risks, but none of them describes fabricated content generated during use.

A systematic approval gap between groups that remains after legitimate factors are considered is a fairness and nondiscrimination concern. Safety, transparency and human oversight are relevant principles, but they do not address the unequal outcome described in the scenario.

Intended purpose, users and scope are set early so that later development, testing and oversight can be measured against them. Drift tracking, archiving at retirement and complaint investigation all occur after the system is built and deployed.

A responsibility matrix and a cross-functional committee with escalation paths make ownership and decision rights explicit. Independent thresholds produce inconsistent controls, and a vendor's account manager cannot carry the organization's own accountability for high-impact uses.

Erosion of trust in shared information and its effect on public deliberation is harm to society as a whole rather than to one person or one company. Individual distress, revenue loss and physical injury are real harms, but the scenario describes a diffuse effect on the broader information environment.