Free SAIA practice test: 30 questions with answers

Monitoring input distributions and output quality against thresholds surfaces drift or upstream changes soon after they happen. An invoice review is too slow and cost-focused, checking weight file size does not reveal behaviour, and extra replicas address load rather than answer quality.

Ownership creates accountability for lifecycle decisions such as patching, access reviews and retirement, which often go unowned without an inventory entry. Billing, automatic retraining and automatic access grants are not purposes of an owner field, and the last one would weaken access control.

The first priority is containment and evidence preservation, followed by notifying the people responsible under the incident plan. Retraining takes time and does not stop ongoing exposure, deleting transcripts destroys evidence, and a single leak of personal data is still an incident.

Documentation of intended use, limitations and responsibilities makes a system transparent, and version and approval records make its decisions traceable to accountable people. Concealing sources reduces transparency, adding features does not guarantee accuracy, and trusting a reputation instead of testing skips fairness checks.

Lifecycle governance includes a documented retirement that removes access, revokes keys and archives records according to policy. Keeping a retired endpoint live leaves an unmonitored attack surface, and deleting artefacts without records breaks auditability.

Prompt injection can arrive through any retrieved content, so untrusted data must be separated from instructions and outbound actions must be gated by policy or user approval. Changing temperature does not reliably block injected instructions, removing the system prompt does not remove the attack surface, and shortening a cache only reduces what is stored.

Model output is untrusted input to downstream components, so it must be encoded or sanitised for the target context to prevent script injection. Fine-tuning does not make output safe, shorter replies can still contain harmful markup, and caching spreads the same unsafe output to more users.

Rate limits and input and output caps bound how much compute any one caller can consume, which is the core of denial-of-service defence for models. Streaming, a larger context window and logging prompts do not limit consumption, and the last one only records abuse after it happens.

In RAG, retrieval is the point where access control must be applied, because any chunk returned to the model can be revealed in the answer. Embedding size, vector versus keyword choice and index compression are quality or cost decisions that do not address who may see the content.

Sanitising the training data removes the sensitive content at source, and testing confirms the model does not reproduce it. A vendor statement is not verification, temperature does not prevent memorisation, and moving files does not change what the model learned.

Threat modelling starts by understanding the system: what it protects and where untrusted input enters, so threats can be found and ranked. A bigger model does not remove security risk, disabling logs removes evidence rather than exposure, and a single late test is not threat modelling.

Data poisoning changes what the model learns by corrupting its training data, and a backdoor is a poisoning variant that stays dormant until a trigger appears. Model extraction copies behaviour through queries, membership inference tests whether data was used in training, and evasion manipulates inputs without changing the model.

Checking provenance and integrity at intake keeps unvetted or tampered data out of the training pipeline, which makes it a security control at the data stage. Load tests, release notes and key rotation are valid operations tasks, but they do not address data risk at this point in the lifecycle.

Risk-based selection focuses limited resources on the controls that reduce the most harmful outcomes for a specific use, here customer financial decisions. Applying everything everywhere wastes budget, waiting for a regulator leaves known risks open, and choosing tools by price ignores whether they address the risk.

Adversarial examples are crafted inputs with small perturbations that cause wrong outputs, and robustness testing uses them to measure sensitivity. Removing bad training samples is data cleaning, crafted inputs do not necessarily crash servers, and transfer and query-based attacks work without access to training data.

An AI BOM lists the components and their provenance, which supports supply chain review and vulnerability response. Hyperparameters, prompt templates and GPU cost tracking are useful records but are not the purpose of a BOM.

Immutable, checksummed versions with tightly controlled promotion ensure that a tag always refers to the artefact that was reviewed. Renaming versions breaks traceability, co-locating storage does nothing for integrity, and a shared login removes accountability.

Pinning to a digest and verifying before loading ensures the artefact that runs is the one that was reviewed, even if the source changes. Automatically taking the newest file, skipping verification or loading straight from an external URL each let an altered model reach production unnoticed.

Debug endpoints leak configuration and internal layout, so they should be removed or disabled in production, with serving access restricted to authenticated callers. Hiding links, comments or changing ports are obscurity measures that do not stop anyone who finds the endpoint.

Pinned, reviewed versions with vulnerability scanning give repeatable builds and catch known flaws before release. Automatic nightly upgrades can pull in untested changes, forking libraries without an update process leaves fixes unapplied, and dropping scanners removes the check that found the problem.

Lineage links each record to its origin and to every transformation applied, which allows bias and quality problems to be traced and corrected. Keeping one copy, using one file or deleting intermediates does not record where data came from or how it changed.

Role-based access, data minimisation and read logging limit exposure of personal data to those who need it, and make access reviewable. Shared copies, admin rights and emailed exports each widen access and create copies that are hard to control.

Pinning versions and verifying checksums detects silent changes, which is how tampered records are caught before training. Always taking the newest snapshot, trusting synthetic data to be tamper-free, or letting contributors write straight into training folders all remove that check.

Dataset licences and terms determine whether commercial use and redistribution are permitted, so this check comes before any build or release work. Resizing images, a credit line or assuming public domain do not establish the right to use the data commercially.

Bias and quality problems start with measuring representation and label accuracy, so the gaps are known before remediation is chosen. Replacing human labels with model output is circular, deleting a group removes its information, and assuming size equals representativeness ignores who is missing.

A model card documents the intended use, data, evaluation and limitations that a reviewer needs to judge fitness for a new purpose. A demo slide, hardware usage or a dashboard screenshot shows little about intended use or limits.

Measuring how often small crafted perturbations change predictions is a robustness test against adversarial examples. Throughput, augmentation gains and load time are performance or training metrics and do not test sensitivity to adversarial input.

Retaining the prior version and its configuration lets an operator shift traffic back in minutes without a rebuild. Deleting old files, overwriting weights or retraining under pressure each remove or delay the rollback path.

Least-privilege identities limit what a compromised job can reach, and integrity checks on code and inputs catch tampering before it shapes a model. Admin rights for everyone, unsigned images and logs on personal laptops each widen the attack surface or hide evidence.

Reproducing a model requires the exact code, data version, configuration and environment, so each run must record them. A release accuracy figure, a dashboard screenshot or a file size cannot recreate the training process.