TAISE Sample Questions

Test Yourself Before Taking the Exam

*The answer key, including justifications for each answer, begins on page 18

Module 1: Introduction to AI
Question M1-Q1

What is the historical significance of the 1956 Dartmouth Conference?

A.​ It standardized the transformer architecture for language tasks.

B.​ It debuted the first commercial neural network hardware.
C.​ It is recognized as the founding event that launched the field of Artificial Intelligence.
D.​ It introduced the first diffusion model for image generation.

Question M1-Q2

A team trains a model to label emails as ”malware” or “not malware.” What kind of model is this?

A.​ A discriminative model that learns to distinguish between classes in labeled data.
B.​ A diffusion model trained to reverse a noise process in images.
C.​ A generative model that creates new labeled emails for training.
D.​ A reinforcement model that learns solely from rewards without labels.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 1

Question M1-Q3

An organization wants to use AI tools without managing infrastructure or runtime. Which cloud model fits
best?

A.​ Platform as a Service (PaaS) requiring app runtime management.

B.​ Software as a Service (SaaS) that provides ready-to-use applications.
C.​ Infrastructure as a Service (IaaS) with full OS control.
D.​ On-premises deployment managed entirely by the organization.

Question M1-Q4

What is the main role of the attention mechanism in transformers?

A.​ It removes the need for tokenization in LLMs.

B.​ It generates images from pure noise.
C.​ It replaces GPUs by compressing model weights.
D.​ It learns which input elements are most important within the context window.

Question M1-Q5

A startup wants maximum flexibility to customize OS and applications for training an LLM, but does not
want to buy servers. Which option is the most appropriate trade-off?

A.​ Use PaaS to avoid runtime responsibilities while controlling hypervisors.

B.​ Use SaaS to avoid managing any part of the stack while keeping full control.
C.​ Use on-premises clusters to eliminate cloud costs entirely.
D.​ Use IaaS to rent compute while retaining control over OS and application layers.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 2

Module 2: Generative AI Architecture and Design
Question M2-Q1

Which of the following correctly distinguishes model architecture from services architecture?

A.​ Model architecture is only used for supervised learning; services architecture for unsupervised
learning.
B.​ Model architecture deals with internal design of AI models, while services architecture focuses on
external delivery systems.
C.​ Model architecture is about API routing; services architecture is about neural network layers.
D.​ Model architecture is maintained by DevOps teams; services architecture by researchers.

Question M2-Q2

Which model architecture introduced in 2017 replaced many RNN and CNN use cases in NLP?

A.​ GAN.
B.​ Transformer.
C.​ Diffusion model.
D.​ VAE.

Question M2-Q3

Which of the following best describes diffusion models?

A.​ They compress data into latent vectors and decode it probabilistically.
B.​ They progressively add noise and then learn to reverse it to generate new data.
C.​ They rely on adversarial training between two networks.
D.​ They predict the next token in a sequence left to right.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 3

Question M2-Q4

In the attention mechanism, which component represents the information being advertised or offered?

A.​ Query.
B.​ Key.
C.​ Value.
D.​ Embedding.

Question M2-Q5

Which architectural feature makes transformers faster to train than RNNs?

A.​ Larger weight matrices for deeper layers.

B.​ Reliance on convolutional filters across tokens.
C.​ Direct parallel token-to-token attention instead of step-by-step updates.
D.​ Sequential token processing with hidden states.

Module 3: AI Use Cases: GenAI, Multimodal, and AI

Agents
Question M3-Q1

Deepfakes are best defined as:

A.​ Compressed video files for storage efficiency.

B.​ Synthetic media created using AI to mimic real people in audio or video.
C.​ Preprocessing methods for multimodal feature extraction.
D.​ Standard bias mitigation techniques for model fairness.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 4

Question M3-Q2

What distinguishes AI safety from AI security in the module’s framing?

A.​ Safety focuses on legal policy only; security focuses on research ethics only.
B.​ Safety handles access control; security covers hallucinations.
C.​ Safety addresses unintended harms and behavior; security defends against deliberate attacks or
misuse.
D.​ Safety is about encryption; security is about empathy in chatbots.

Question M3-Q3

Which of the following is NOT a bias category emphasized in the module?

A.​ Deployment bias.

B.​ Computational bias.
C.​ Algorithmic bias.
D.​ Sampling bias.

Question M3-Q4

In healthcare, what is a key benefit of multimodal AI?

A.​ Correlating diverse inputs like imaging, genomics, and clinical notes for better predictions.
B.​ Limiting data sources to simplify model explainability.
C.​ Replacing physicians with unsupervised model decisions.
D.​ Using only patient self-reported data to reduce bias.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 5

Question M3-Q5

What is the main purpose of a responsible AI life cycle?

A.​ To ensure ethics, transparency, fairness, and continuous monitoring across all stages.
B.​ To reduce GPU costs during model training only.
C.​ To speed up model training and deployment regardless of risks.
D.​ To limit AI deployment to healthcare use cases.

Module 4: Fairness, Accountability, and

Explainability in AI
Question M4-Q1

What is the main purpose of explainability techniques like SHAP and LIME?

A.​ To provide understandable justifications for model predictions.

B.​ To improve computational efficiency of models.
C.​ To create inherently interpretable models.
D.​ To reduce training data requirements.

Question M4-Q2

Why was the skin lesion classifier case significant in the context of explainability?

A.​ It proved that only larger datasets can remove bias.

B.​ It demonstrated that neural networks always outperform interpretable models.
C.​ It revealed the model was detecting rulers instead of medical features.
D.​ It showed explainability tools mislabel cancer cases.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 6

Question M4-Q2

Which fairness type ensures similar individuals are treated in similar ways by the model?

A.​ Group fairness.

B.​ Statistical parity.
C.​ Equalized odds.
D.​ Individual fairness.

Question M4-Q4

Which stakeholder group is most likely to need plain-language explanations and visual aids rather than
technical details?

A.​ Regulators and auditors.

B.​ Technical security reviewers.
C.​ Non-technical business leaders.
D.​ Data scientists and ML engineers.

Question M4-Q5

What is the key benefit of model cards for AI transparency?

A.​ They replace the need for stakeholder engagement.

B.​ They provide structured documentation of intended use, limitations, and performance.
C.​ They guarantee fairness across all demographic groups.
D.​ They reduce the computational cost of training.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 7

Module 5: AI Model Lifecycle and Threat Taxonomy
Question M5-Q1

An attacker inserts a hidden trigger phrase into many training samples so the model misclassifies any
input containing that phrase. What attack is this?

A.​ Logic bomb triggered by user identity.

B.​ Membership inference at evaluation time.
C.​ Backdoor attack during training.
D.​ Evasion attack against the deployed model.

Question M5-Q2

Which statement best defines concept drift?

A.​ Model weights are deliberately altered by an attacker.

B.​ The training set is replaced with adversarial data.
C.​ Two features are perfectly correlated in the dataset.
D.​ The relationship between inputs and outputs changes over time.

Question M5-Q3

Which NIST AI RMF function establishes organizational accountability, policies, and oversight for AI risk?

A.​ MANAGE.
B.​ GOVERN.
C.​ MAP.
D.​ MEASURE.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 8

Question M5-Q4

Which attack attempts to tell whether a specific record was included in the model’s training set?

A.​ Model manipulation.

B.​ Model extraction.
C.​ Membership inference.
D.​ Data poisoning.

Question M5-Q5

Which standard specifically provides guidance for AI risk management?

A.​ ISO/IEC 5338:2023.

B.​ ISO/IEC 23894:2023.
C.​ ISO/IEC 42001:2023.
D.​ ISO/IEC 27001:2022.

Module 6: Model Governance, Risk Management, and

Compliance
Question M6-Q1

The NIST AI Risk Management Framework is organized around which four core functions?

A.​ PLAN, BUILD, TEST, DEPLOY.

B.​ COLLECT, ANALYZE, REPORT, VERIFY.
C.​ IDENTIFY, PROTECT, DETECT, RESPOND.
D.​ GOVERN, MAP, MEASURE, MANAGE.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 9

Question M6-Q2

Under the EU AI Act’s phased enforcement, which category is prohibited immediately (Phase One)?

A.​ Every AI application deployed in public sector organizations.

B.​ All general-purpose foundation models regardless of risk level.
C.​ Only systems involving any biometric data collection, without exception.
D.​ Systems using subliminal techniques or biometric categorization of sensitive attributes.

Question M6-Q3

What is the main purpose of a RACI matrix in AI governance programs?

A.​ Classify AI systems into prohibited, high-risk, or minimal-risk categories.

B.​ Score AI models for fairness using quantitative metrics only.
C.​ Define security controls at each infrastructure layer for cloud services.
D.​ Clarify accountability by assigning who is Responsible, Accountable, Consulted, and Informed for
key activities.

Question M6-Q4

Which U.S. jurisdiction has Automated Decision-Making Technology (ADMT) rules attached to its privacy
law?

A.​ California, via CCPA ADMT regulations requiring notices, rights, and risk assessments.
B.​ Texas, under a statewide AI licensing board that oversees all models.
C.​ Washington, with a blanket ban on automated decisions across industries.
D.​ New York, through a federal mandate that preempts state privacy statutes.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 10

Question M6-Q5

Which trustworthiness characteristic is emphasized by the NIST AI RMF?

A.​ Lowest possible cost regardless of impact.

B.​ Unlimited model complexity to improve accuracy.
C.​ Valid and reliable performance under expected conditions.
D.​ Fastest deployment speed without testing.

Module 7: Introduction to AI Safety and Security

Question M7-Q1

What is the primary distinction between AI safety and AI security?

A.​ Safety focuses on cost reduction; security focuses on compliance only.

B.​ Safety prevents unintended harm; security protects against intentional attacks.
C.​ Safety applies only to physical systems; security applies only to digital systems.
D.​ Safety is regulated in all cases; security is voluntary in most jurisdictions.

Question M7-Q2

In the enterprise architecture framework, monitoring for hallucinations and documenting low-confidence
outputs primarily belongs to which layer?

A.​ Application/Model layer.

B.​ Governance layer.
C.​ Data and Information layer.
D.​ Operation layer.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 11

Question M7-Q3

Which option best defines AI alignment?

A.​ Ensuring AI models remain within budget constraints.

B.​ Automating safety checks without human oversight.
C.​ Mapping AI outputs to enterprise architecture layers.
D.​ Keeping AI goals and behavior consistent with human values and intended outcomes.

Question M7-Q4

Which pillar of the Four Pillars of AI Security addresses data poisoning and privacy leakage risks?

A.​ Vulnerability Management.

B.​ Data Security & Privacy Protection.
C.​ Model Security.
D.​ Governance & Compliance.

Question M7-Q5

Which scenario best illustrates “AI for security” (as opposed to “security for AI”)?

A.​ Implementing Zero Trust access controls for model APIs.

B.​ Using AI to detect anomalies in network traffic logs across the enterprise.
C.​ Running prompt injection detection on LLM inputs.
D.​ Encrypting data within AI training pipelines.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 12

Module 8: Cloud and AI Security
Question M8-Q1

In the shared responsibility model, who is primarily responsible for securing data at rest in an IaaS
environment?

A.​ Customer only.

B.​ Both provider and customer equally.
C.​ Third-party auditors.
D.​ Cloud service provider only.

Question M8-Q2

Why is automatic key rotation in a Key Management Service (KMS) important for AI workloads?

A.​ It reduces model latency during inference.

B.​ It ensures encryption keys are regularly updated to limit exposure risk.
C.​ It eliminates the need for access policies.
D.​ It simplifies API integration with AI pipelines.

Question M8-Q3

During an AI model breach, logs show repeated abnormal queries with slight input variations. Which type
of attack does this indicate?

A.​ Policy misconfiguration.

B.​ Hardware failure.
C.​ Evasion attack.
D.​ Data poisoning.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 13

Question M8-Q4

In a secure MLOps pipeline, what is the primary role of dependency pinning and lockfiles?

A.​ Accelerating GPU utilization.

B.​ Improving CI/CD performance metrics.
C.​ Reducing infrastructure costs.
D.​ Preventing unauthorized or unexpected third-party code updates.

Question M8-Q5

You are designing access policies for an AI inference service. Which strategy BEST reflects Zero Trust
principles?

A.​ Apply dynamic, per-session access policies that evaluate identity, context, and risk before
granting access.
B.​ Reduce monitoring to minimize overhead.
C.​ Provide static keys that never expire.
D.​ Grant persistent access.

Module 9: Data Security & Privacy in AI Systems

Question M9-Q1

Which of the following best describes data lineage in AI systems?

A.​ Tracking the origin, transformations, and usage of data throughout its lifecycle.
B.​ Creating synthetic datasets to mimic real data.
C.​ Restricting access to data through RBAC policies.
D.​ Encrypting sensitive data before storage.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 14

Question M9-Q2

Why is anonymization critical in AI systems that handle healthcare data?

A.​ It guarantees data completeness.

B.​ It eliminates the need for encryption.
C.​ It improves model speed.
D.​ It protects individual identities and ensures compliance with laws like HIPAA.

Question M9-Q3

What distinguishes a backdoor attack from other poisoning attacks?

A.​ It embeds a hidden trigger that causes targeted misclassification.

B.​ It only occurs in image datasets.
C.​ It always requires access to metadata.
D.​ It increases training speed.

Question M9-Q4

What is one advantage of using synthetic data in training AI systems?

A.​ It guarantees zero bias in the dataset.

B.​ It reduces privacy risks by avoiding direct use of sensitive records.
C.​ It improves query response speed.
D.​ It eliminates the need for governance policies.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 15

Question M9-Q5

During an audit, a regulator requests proof that sensitive features were flagged and removed before
model training. Which governance control provides this evidence?

A.​ Secure API logging.

B.​ Imputation of missing values.
C.​ PCA dimensionality reduction.
D.​ Metadata management with sensitive field tagging.

Module 10: Continuous Learning and Adaptation

Question M10-Q1

What is the main purpose of continuous learning in AI systems?

A.​ To ensure models adapt to new data while retaining prior knowledge.
B.​ To maximize training speed regardless of accuracy.
C.​ To reduce model size for faster inference.
D.​ To eliminate the need for monitoring or updates.

Question M10-Q2

Which scenario best illustrates prediction drift?

A.​ The training dataset becomes corrupted.

B.​ The outputs of a model shift significantly compared to historical predictions.
C.​ Input features of a fraud detection system change over time.
D.​ New features are added to a dataset mid-deployment.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 16

Question M10-Q3

What is catastrophic forgetting in continuous learning?

A.​ When a model loses prior knowledge after retraining on new data.
B.​ When a system’s database becomes corrupted.
C.​ When bias testing is skipped during validation.
D.​ When model weights cannot be updated due to hardware limits.

Question M10-Q4

Why would a healthcare consortium adopt federated learning instead of centralizing data?

A.​ To eliminate the need for monitoring.

B.​ To increase training speed by pooling data centrally.
C.​ To reduce compute costs.
D.​ To protect patient privacy while still enabling collective model training.

Question M10-Q5

Which feedback mechanism ensures expert input is weighted more heavily than casual user input?

A.​ Contextual feedback analysis.

B.​ Random sampling of feedback.
C.​ Batch updates every quarter.
D.​ Consensus by majority voting.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 17

Answer Key & Justifications
Module 1: Introduction to AI
Question M1-Q1

What is the historical significance of the 1956 Dartmouth Conference?

A.​ It standardized the transformer architecture for language tasks.

B.​ It debuted the first commercial neural network hardware.
C.​ It is recognized as the founding event that launched the field of Artificial Intelligence. ✓
D.​ It introduced the first diffusion model for image generation.

Justifications:

A.​ Transformers were introduced in 2017, not in 1956.

B.​ No commercial neural network hardware was launched at that conference.
C.​ Module history notes the Dartmouth conference as the point where AI emerged as a formal
research field.
D.​ Diffusion models are modern; they were not introduced in 1956.

Question M1-Q2

A team trains a model to label emails as ”malware” or “not malware.” What kind of model is this?

A.​ A discriminative model that learns to distinguish between classes in labeled data. ✓
B.​ A diffusion model trained to reverse a noise process in images.
C.​ A generative model that creates new labeled emails for training.
D.​ A reinforcement model that learns solely from rewards without labels.

Justifications:

A.​ The task uses labeled data to separate classes, which matches the definition of discriminative
(predictive) ML.
B.​ Diffusion models target image/video synthesis, not email classification per se.
C.​ Generative models create new data; here the goal is classification, not generation.
D.​ Reinforcement learning optimizes actions via rewards; this scenario is supervised classification.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 18

Question M1-Q3

An organization wants to use AI tools without managing infrastructure or runtime. Which cloud model fits
best?

A.​ Platform as a Service (PaaS) requiring app runtime management.

B.​ Software as a Service (SaaS) that provides ready-to-use applications. ✓
C.​ Infrastructure as a Service (IaaS) with full OS control.
D.​ On-premises deployment managed entirely by the organization.

Justifications:

A.​ PaaS reduces but does not eliminate platform responsibilities.

B.​ SaaS delivers complete applications with minimal customer management burden.
C.​ IaaS requires managing OS and application layers.
D.​ On-premises maximizes management effort rather than minimizing it.

Question M1-Q4

What is the main role of the attention mechanism in transformers?

A.​ It removes the need for tokenization in LLMs.

B.​ It generates images from pure noise.
C.​ It replaces GPUs by compressing model weights.
D.​ It learns which input elements are most important within the context window. ✓

Justifications:

A.​ Transformers still operate over tokens; attention does not replace them.
B.​ Image generation from noise describes diffusion, not attention itself.
C.​ Attention does not replace hardware; GPUs enable parallel training.
D.​ Attention weighs relevance of tokens to improve representation and generation.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 19

Question M1-Q5

A startup wants maximum flexibility to customize OS and applications for training an LLM, but does not
want to buy servers. Which option is the most appropriate trade-off?

A.​ Use PaaS to avoid runtime responsibilities while controlling hypervisors.

B.​ Use SaaS to avoid managing any part of the stack while keeping full control.
C.​ Use on-premises clusters to eliminate cloud costs entirely.
D.​ Use IaaS to rent compute while retaining control over OS and application layers. ✓

Justifications:

A.​ PaaS abstracts runtime; control over low-level components is limited.

B.​ SaaS minimizes control and customization; it does not grant full control.
C.​ On-premises contradicts the constraint of not purchasing servers.
D.​ IaaS offers virtualized infrastructure with customer control of OS/apps matching the stated need.

Module 2: Generative AI Architecture and Design

Question M2-Q1

Which of the following correctly distinguishes model architecture from services architecture?

A.​ Model architecture is only used for supervised learning; services architecture for unsupervised
learning.
B.​ Model architecture deals with internal design of AI models, while services architecture
focuses on external delivery systems. ✓
C.​ Model architecture is about API routing; services architecture is about neural network layers.
D.​ Model architecture is maintained by DevOps teams; services architecture by researchers.

Justifications:

A.​ Both architectures apply broadly, not tied to supervised/unsupervised only.

B.​ Model architecture = internal neural design; services = external delivery, APIs, scaling.
C.​ This inverts responsibilities; API routing is part of services.
D.​ Both DevOps and researchers can influence both; division is inaccurate.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 20

Question M2-Q2

Which model architecture introduced in 2017 replaced many RNN and CNN use cases in NLP?

A.​ GAN.
B.​ Transformer. ✓
C.​ Diffusion model.
D.​ VAE.

Justifications:

A.​ GANs are adversarial generative architectures, not NLP-focused replacements.

B.​ Transformers revolutionized NLP with parallelism and self-attention.
C.​ Diffusion models are for generative image/video tasks.
D.​ VAEs compress and decode; they did not replace RNNs in NLP.

Question M2-Q3

Which of the following best describes diffusion models?

A.​ They compress data into latent vectors and decode it probabilistically.
B.​ They progressively add noise and then learn to reverse it to generate new data. ✓
C.​ They rely on adversarial training between two networks.
D.​ They predict the next token in a sequence left to right.

Justifications:

A.​ Latent vector probabilistic decoding matches VAEs.

B.​ Diffusion models learn a reverse denoising process for content generation.
C.​ Adversarial training describes GANs, not diffusion models.
D.​ Autoregressive models predict tokens sequentially.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 21

Question M2-Q4

In the attention mechanism, which component represents the information being advertised or offered?

A.​ Query.
B.​ Key. ✓
C.​ Value.
D.​ Embedding.

Justifications:

A.​ Queries ask about relevance, they don’t advertise info.

B.​ Keys advertise what a token contains; queries match against them.
C.​ Values are the actual content returned, not the advertised property.
D.​ Embeddings represent tokens numerically, not their attention role.

Question M2-Q5

Which architectural feature makes transformers faster to train than RNNs?

A.​ Larger weight matrices for deeper layers.

B.​ Reliance on convolutional filters across tokens.
C.​ Direct parallel token-to-token attention instead of step-by-step updates. ✓
D.​ Sequential token processing with hidden states.

Justifications:

A.​ Deeper layers increase compute but don’t explain faster training.
B.​ Convolutions apply to CNNs, not transformer speed advantage.
C.​ Transformers apply self-attention in parallel unlike RNN sequential bottlenecks.
D.​ Sequential token processing describes RNNs, not transformers.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 22

Module 3: AI Use Cases: GenAI, Multimodal, and AI
Agents
Question M3-Q1

Deepfakes are best defined as:

A.​ Compressed video files for storage efficiency.

B.​ Synthetic media created using AI to mimic real people in audio or video. ✓
C.​ Preprocessing methods for multimodal feature extraction.
D.​ Standard bias mitigation techniques for model fairness.

Justifications:

A.​ Compression is unrelated to synthetic media generation and deception.

B.​ Deepfakes are AI-generated or manipulated media that convincingly imitate real individuals.
C.​ Preprocessing for multimodal learning is different from fabricating media content.
D.​ Deepfakes are an ethical challenge, not a mitigation technique.

Question M3-Q2

What distinguishes AI safety from AI security in the module’s framing?

A.​ Safety focuses on legal policy only; security focuses on research ethics only.
B.​ Safety handles access control; security covers hallucinations.
C.​ Safety addresses unintended harms and behavior; security defends against deliberate
attacks or misuse. ✓
D.​ Safety is about encryption; security is about empathy in chatbots.

Justifications:

A.​ Both domains span technical and governance measures; the option is an oversimplification.
B.​ Hallucinations are a safety issue; access control is a security mechanism—this reverses roles.
C.​ Safety ensures systems behave as intended and avoid harm; security protects systems from
adversaries and misuse.
D.​ Encryption is a security control; empathy is not the defining focus of security versus safety.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 23

Question M3-Q3

Which of the following is NOT a bias category emphasized in the module?

A.​ Deployment bias.

B.​ Computational bias. ✓
C.​ Algorithmic bias.
D.​ Sampling bias.

Justifications:

A.​ Deployment bias is explicitly included and defined.

B.​ The module highlights sampling, deployment, algorithmic, historical, evaluation, and label
bias—not 'computational bias' as a category.
C.​ Algorithmic bias is explicitly included and defined.
D.​ Sampling bias is explicitly included and defined.

Question M3-Q4

In healthcare, what is a key benefit of multimodal AI?

A.​ Correlating diverse inputs like imaging, genomics, and clinical notes for better
predictions. ✓
B.​ Limiting data sources to simplify model explainability.
C.​ Replacing physicians with unsupervised model decisions.
D.​ Using only patient self-reported data to reduce bias.

Justifications:

A.​ Multimodal fusion across radiology, pathology, and EHRs enables richer, more accurate clinical
insights.
B.​ Reducing modalities sacrifices context and can harm performance.
C.​ Systems augment clinicians; responsible use keeps humans in the loop.
D.​ Exclusive reliance on self-reports ignores other valuable modalities and may increase bias.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 24

Question M3-Q5

What is the main purpose of a responsible AI life cycle?

A.​ To ensure ethics, transparency, fairness, and continuous monitoring across all stages. ✓
B.​ To reduce GPU costs during model training only.
C.​ To speed up model training and deployment regardless of risks.
D.​ To limit AI deployment to healthcare use cases.

Justifications:

A.​ Responsible AI spans from problem framing through monitoring to manage harms, governance,
and accountability.
B.​ Cost control is not the primary aim; governance and safety are.
C.​ Rushing deployment without governance contradicts responsible AI principles.
D.​ Responsible AI applies across sectors, not just healthcare.

Module 4: Fairness, Accountability, and

Explainability in AI
Question M4-Q1

What is the main purpose of explainability techniques like SHAP and LIME?

A.​ To provide understandable justifications for model predictions. ✓

B.​ To improve computational efficiency of models.
C.​ To create inherently interpretable models.
D.​ To reduce training data requirements.

Justifications:

A.​ SHAP and LIME are post-hoc methods that explain complex models’ behavior to users, auditors,
and regulators.
B.​ They may be computationally costly; efficiency is not their primary purpose.
C.​ They explain black-box models; they do not turn them into inherently interpretable ones.
D.​ They do not affect the amount of training data required.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 25

Question M4-Q2

Why was the skin lesion classifier case significant in the context of explainability?

A.​ It proved that only larger datasets can remove bias.

B.​ It demonstrated that neural networks always outperform interpretable models.
C.​ It revealed the model was detecting rulers instead of medical features. ✓
D.​ It showed explainability tools mislabel cancer cases.

Justifications:

A.​ Dataset size alone doesn’t address spurious correlations; explainability is needed to detect them.
B.​ The case does not claim universal superiority of neural networks.
C.​ Explainability exposed a spurious correlation: the model used rulers as a proxy for malignancy.
D.​ The issue was the model’s shortcut, not the explainability tools.

Question M4-Q3

Which fairness type ensures similar individuals are treated in similar ways by the model?

A.​ Group fairness.

B.​ Statistical parity.
C.​ Equalized odds.
D.​ Individual fairness. ✓

Justifications:

A.​ Group fairness focuses on aggregate parity across demographics, not individuals.
B.​ Statistical parity is an outcome rate constraint across groups.
C.​ Equalized odds constrains TPR and FPR parity across groups.
D.​ Individual fairness aims for person-level equivalence for similar cases.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 26

Question M4-Q4

Which stakeholder group is most likely to need plain-language explanations and visual aids rather than
technical details?

A.​ Regulators and auditors.

B.​ Technical security reviewers.
C.​ Non-technical business leaders. ✓
D.​ Data scientists and ML engineers.

Justifications:

A.​ Regulators need structured evidence like model cards and audits, not only high-level visuals.
B.​ Security reviewers need detailed technical and threat information.
C.​ Non-technical stakeholders benefit from high-level summaries, visuals, FAQs, and practical
limitations.
D.​ Technical teams require model internals, metrics, and error analysis.

Question M4-Q5

What is the key benefit of model cards for AI transparency?

A.​ They replace the need for stakeholder engagement.

B.​ They provide structured documentation of intended use, limitations, and performance.
✓
C.​ They guarantee fairness across all demographic groups.
D.​ They reduce the computational cost of training.

Justifications:

A.​ They do not replace stakeholder communication—they complement it.

B.​ Model cards standardize key information to support auditing, governance, and communication.
C.​ Documentation cannot guarantee fairness; it enables assessment and improvement.
D.​ Model cards do not affect training compute.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 27

Module 5: AI Model Lifecycle and Threat Taxonomy
Question M5-Q1

An attacker inserts a hidden trigger phrase into many training samples so the model misclassifies any
input containing that phrase. What attack is this?

A.​ Logic bomb triggered by user identity.

B.​ Membership inference at evaluation time.
C.​ Backdoor attack during training. ✓
D.​ Evasion attack against the deployed model.

Justifications:

A.​ Logic bombs embed malicious logic but not necessarily via a learned trigger phrase in data.
B.​ Membership inference aims to detect if records were in training data, not to misclassify via
triggers.
C.​ Backdoors cause specific inputs with a trigger to bypass normal behavior.
D.​ Evasion crafts inputs at inference; here the training set was altered.

Question M5-Q2

Which statement best defines concept drift?

A.​ Model weights are deliberately altered by an attacker.

B.​ The training set is replaced with adversarial data.
C.​ Two features are perfectly correlated in the dataset.
D.​ The relationship between inputs and outputs changes over time. ✓

Justifications:

A.​ Deliberate weight changes describe model manipulation, not drift.

B.​ Replacing training data is a poisoning scenario, not drift.
C.​ Perfect correlation refers to multicollinearity, not drift.
D.​ Concept drift is a shift in the underlying mapping, degrading performance.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 28

Question M5-Q3

Which NIST AI RMF function establishes organizational accountability, policies, and oversight for AI risk?

A.​ MANAGE.
B.​ GOVERN. ✓
C.​ MAP.
D.​ MEASURE.

Justifications:

A.​ MANAGE implements responses and continuous improvement.

B.​ GOVERN creates culture, policies, roles, and accountability across the lifecycle.
C.​ MAP focuses on context, stakeholders, and impacts.
D.​ MEASURE is about testing and monitoring risks.

Question M5-Q4

Which attack attempts to tell whether a specific record was included in the model’s training set?

A.​ Model manipulation.

B.​ Model extraction.
C.​ Membership inference. ✓
D.​ Data poisoning.

Justifications:

A.​ Model manipulation alters weights or logic rather than inferring membership.
B.​ Model extraction steals functionality via queries but not membership status.
C.​ Membership inference probes model outputs to infer training membership.
D.​ Poisoning corrupts training data; it is not an inference attack.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 29

Question M5-Q5

Which standard specifically provides guidance for AI risk management?

A.​ ISO/IEC 5338:2023.

B.​ ISO/IEC 23894:2023. ✓
C.​ ISO/IEC 42001:2023.
D.​ ISO/IEC 27001:2022.

Justifications:

A.​ 5338 covers AI engineering lifecycle practices rather than risk guidance focus.
B.​ 23894 gives AI-specific risk management guidance across the lifecycle.
C.​ 42001 is a certifiable AI management system standard, not risk guidance per se.
D.​ 27001 addresses information security management systems, not AI-specific risk.

Module 6: Model Governance, Risk Management, and

Compliance
Question M6-Q1

The NIST AI Risk Management Framework is organized around which four core functions?

A.​ PLAN, BUILD, TEST, DEPLOY.

B.​ COLLECT, ANALYZE, REPORT, VERIFY.
C.​ IDENTIFY, PROTECT, DETECT, RESPOND.
D.​ GOVERN, MAP, MEASURE, MANAGE. ✓

Justifications:

A.​ These steps describe a generic delivery lifecycle, not the AI RMF.
B.​ These activities do not match the AI RMF structure.
C.​ Those are NIST Cybersecurity Framework functions, not the AI RMF core functions.
D.​ NIST AI RMF defines four functions that span culture, context, assessment, and risk response.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 30

Question M6-Q2

Under the EU AI Act’s phased enforcement, which category is prohibited immediately (Phase One)?

A.​ Every AI application deployed in public sector organizations.

B.​ All general-purpose foundation models regardless of risk level.
C.​ Only systems involving any biometric data collection, without exception.
D.​ Systems using subliminal techniques or biometric categorization of sensitive attributes.
✓

Justifications:

A.​ Public sector deployments are not categorically banned; obligations depend on risk classification.
B.​ General-purpose models face obligations later; they are not universally banned in Phase One.
C.​ Biometric use is not blanket-banned; prohibitions target specific biometric categorization
practices.
D.​ The Act bans unacceptable-risk systems such as subliminal manipulation and certain biometric
categorization from the outset.

Question M6-Q3

What is the main purpose of a RACI matrix in AI governance programs?

A.​ Classify AI systems into prohibited, high-risk, or minimal-risk categories.

B.​ Score AI models for fairness using quantitative metrics only.
C.​ Define security controls at each infrastructure layer for cloud services.
D.​ Clarify accountability by assigning who is Responsible, Accountable, Consulted, and
Informed for key activities. ✓

Justifications:

A.​ Risk classification is a regulatory activity; RACI is about roles and responsibilities.
B.​ Fairness scoring is a measurement activity, not a responsibility assignment tool.
C.​ Control definition is a security architecture task, not the purpose of RACI.
D.​ RACI establishes clear role assignments and decision rights to prevent accountability gaps.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 31

Question M6-Q4

Which U.S. jurisdiction has Automated Decision-Making Technology (ADMT) rules attached to its privacy
law?

A.​ California, via CCPA ADMT regulations requiring notices, rights, and risk assessments.
✓
B.​ Texas, under a statewide AI licensing board that oversees all models.
C.​ Washington, with a blanket ban on automated decisions across industries.
D.​ New York, through a federal mandate that preempts state privacy statutes.

Justifications:

A.​ California’s CCPA ADMT rules add pre-use notices, consumer rights, and business requirements
for significant decisions.
B.​ No such statewide AI licensing board exists in Texas within this module’s scope.
C.​ Washington does not impose a blanket ban; requirements vary by context.
D.​ There is no federal preemption described that creates a New York-specific mandate here.

Question M6-Q5

Which trustworthiness characteristic is emphasized by the NIST AI RMF?

A.​ Lowest possible cost regardless of impact.

B.​ Unlimited model complexity to improve accuracy.
C.​ Valid and reliable performance under expected conditions. ✓
D.​ Fastest deployment speed without testing.

Justifications:

A.​ Cost is an operational consideration, not a trustworthiness characteristic in the AI RMF.

B.​ Complexity alone does not satisfy trustworthiness objectives and can harm explainability.
C.​ Trustworthiness includes validity, reliability, safety, security, resilience, accountability,
transparency, and fairness.
D.​ Speed without testing undermines safety and reliability requirements.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 32

Module 7: Introduction to AI Safety and Security
Question M7-Q1

What is the primary distinction between AI safety and AI security?

A.​ Safety focuses on cost reduction; security focuses on compliance only.

B.​ Safety prevents unintended harm; security protects against intentional attacks. ✓
C.​ Safety applies only to physical systems; security applies only to digital systems.
D.​ Safety is regulated in all cases; security is voluntary in most jurisdictions.

Justifications:

A.​ Cost and compliance are operational concerns, not the defining difference.
B.​ Safety focuses on avoiding unintended harm; security focuses on resisting deliberate attacks.
C.​ Both safety and security apply to physical and digital contexts; the distinction is not physical vs.
digital.
D.​ Regulatory status varies; the key distinction is harm type (unintentional vs. intentional).

Question M7-Q2

In the enterprise architecture framework, monitoring for hallucinations and documenting low-confidence
outputs primarily belongs to which layer?

A.​ Application/Model layer.

B.​ Governance layer.
C.​ Data and Information layer.
D.​ Operation layer. ✓

Justifications:

A.​ Application/Model covers robustness and error handling; this task is operational monitoring
across use.
B.​ Governance sets policy and oversight rather than real-time monitoring.
C.​ Data and Information concerns data management and integrity, not outputs monitoring per se.
D.​ Operation focuses on day-to-day monitoring and safe user interactions, including tracking model
outputs and confidence.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 33

Question M7-Q3

Which option best defines AI alignment?

A.​ Ensuring AI models remain within budget constraints.

B.​ Automating safety checks without human oversight.
C.​ Mapping AI outputs to enterprise architecture layers.
D.​ Keeping AI goals and behavior consistent with human values and intended outcomes. ✓

Justifications:

A.​ Budget control is not the definition of alignment.

B.​ Automation can help, but alignment requires oversight and value consistency.
C.​ Architecture mapping is unrelated to value alignment.
D.​ Alignment addresses value-consistency and avoidance of reward hacking and unintended side
effects.

Question M7-Q4

Which pillar of the Four Pillars of AI Security addresses data poisoning and privacy leakage risks?

A.​ Vulnerability Management.

B.​ Data Security & Privacy Protection. ✓
C.​ Model Security.
D.​ Governance & Compliance.

Justifications:

A.​ Vulnerability Management focuses on supply chain, infra vulns, and pipeline security.
B.​ The Data pillar covers training/inference data protection, minimizing leakage, and detecting
poisoning.
C.​ Model Security focuses on model theft, inversion, adversarial examples, and backdoors.
D.​ Governance & Compliance addresses roles, policies, and oversight rather than data-specific risks.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 34

Question M7-Q5

Which scenario best illustrates “AI for security” (as opposed to “security for AI”)?

A.​ Implementing Zero Trust access controls for model APIs.

B.​ Using AI to detect anomalies in network traffic logs across the enterprise. ✓
C.​ Running prompt injection detection on LLM inputs.
D.​ Encrypting data within AI training pipelines.

Justifications:

A.​ Zero Trust for model APIs is security for AI (protecting the AI system).
B.​ AI for security applies AI techniques to defend external systems and infrastructure.
C.​ Prompt injection detection is a control for securing AI models, not using AI to protect other
systems.
D.​ Data encryption in pipelines protects AI systems’ security for AI.

Module 8: Cloud and AI Security

Question M8-Q1

In the shared responsibility model, who is primarily responsible for securing data at rest in an IaaS
environment?

A.​ Customer only. ✓

B.​ Both provider and customer equally.
C.​ Third-party auditors.
D.​ Cloud service provider only.

Justifications:

A.​ In IaaS, customers are responsible for securing data at rest using encryption and access controls.
B.​ The division of responsibilities is not equal; the customer handles in-cloud data.
C.​ Auditors evaluate compliance but are not responsible for security implementation.
D.​ Providers secure the infrastructure, not customer data in IaaS.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 35

Question M8-Q2

Why is automatic key rotation in a Key Management Service (KMS) important for AI workloads?

A.​ It reduces model latency during inference.

B.​ It ensures encryption keys are regularly updated to limit exposure risk. ✓
C.​ It eliminates the need for access policies.
D.​ It simplifies API integration with AI pipelines.

Justifications:

A.​ Rotation affects security, not model performance.

B.​ Regularly rotating keys reduces long-term risk and limits exposure if keys are compromised.
C.​ Access policies remain essential even with KMS.
D.​ API integration is unrelated to key rotation.

Question M8-Q3

During an AI model breach, logs show repeated abnormal queries with slight input variations. Which type
of attack does this indicate?

A.​ Policy misconfiguration.

B.​ Hardware failure.
C.​ Evasion attack. ✓
D.​ Data poisoning.

Justifications:

A.​ Policy misconfiguration is not adversarial input.

B.​ Hardware failure is unrelated.
C.​ Evasion attacks use small input changes to bypass model detection.
D.​ Data poisoning occurs during training.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 36

Question M8-Q4

In a secure MLOps pipeline, what is the primary role of dependency pinning and lockfiles?

A.​ Accelerating GPU utilization.

B.​ Improving CI/CD performance metrics.
C.​ Reducing infrastructure costs.
D.​ Preventing unauthorized or unexpected third-party code updates. ✓

Justifications:

A.​ Not related to GPU utilization.

B.​ Not related to performance metrics.
C.​ Not for cost reduction.
D.​ Dependency pinning ensures consistent versions and reduces supply chain risks.

Question M8-Q5

You are designing access policies for an AI inference service. Which strategy BEST reflects Zero Trust
principles?

A.​ Apply dynamic, per-session access policies that evaluate identity, context, and risk
before granting access. ✓
B.​ Reduce monitoring to minimize overhead.
C.​ Provide static keys that never expire.
D.​ Grant persistent access.

Justifications:

A.​ Zero Trust enforces dynamic, risk-based access.

B.​ Monitoring is essential.
C.​ Static keys increase risk.
D.​ Persistent access violates Zero Trust.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 37

Module 9: Data Security & Privacy in AI Systems
Question M9-Q1

Which of the following best describes data lineage in AI systems?

A.​ Tracking the origin, transformations, and usage of data throughout its lifecycle. ✓
B.​ Creating synthetic datasets to mimic real data.
C.​ Restricting access to data through RBAC policies.
D.​ Encrypting sensitive data before storage.

Justifications:

A.​ Data lineage is the process of documenting the origin, transformation, and use of data
throughout its lifecycle.
B.​ Synthetic data reduces privacy risks but does not record data history.
C.​ RBAC manages permissions but is not equivalent to lineage tracking.
D.​ Encryption protects confidentiality but does not track data usage history.

Question M9-Q2

Why is anonymization critical in AI systems that handle healthcare data?

A.​ It guarantees data completeness.

B.​ It eliminates the need for encryption.
C.​ It improves model speed.
D.​ It protects individual identities and ensures compliance with laws like HIPAA. ✓

Justifications:

A.​ Completeness is a data quality issue, not privacy.

B.​ Encryption remains necessary even with anonymization.
C.​ Anonymization is for privacy, not model performance.
D.​ Anonymization prevents identification of individuals, ensuring compliance with privacy laws like
HIPAA.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 38

Question M9-Q3

What distinguishes a backdoor attack from other poisoning attacks?

A.​ It embeds a hidden trigger that causes targeted misclassification. ✓

B.​ It only occurs in image datasets.
C.​ It always requires access to metadata.
D.​ It increases training speed.

Justifications:

A.​ Backdoor attacks plant hidden triggers that cause specific outputs when activated.
B.​ Backdoor attacks can occur across modalities, not only in images.
C.​ They manipulate training data, not metadata.
D.​ They degrade security, not training performance speed.

Question M9-Q4

What is one advantage of using synthetic data in training AI systems?

A.​ It guarantees zero bias in the dataset.

B.​ It reduces privacy risks by avoiding direct use of sensitive records. ✓
C.​ It improves query response speed.
D.​ It eliminates the need for governance policies.

Justifications:

A.​ Synthetic data does not guarantee zero bias—it may perpetuate biases from source data or fail to
capture rare or complex patterns.
B.​ Synthetic data reduces direct exposure of sensitive records, lowering re-identification risk while
preserving data utility.
C.​ Faster query response is unrelated to the privacy or bias implications of synthetic data.
D.​ Governance policies are still required; synthetic data is not a substitute for oversight.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 39

Question M9-Q5

During an audit, a regulator requests proof that sensitive features were flagged and removed before
model training. Which governance control provides this evidence?

A.​ Secure API logging. ✓

B.​ Imputation of missing values.
C.​ PCA dimensionality reduction.
D.​ Metadata management with sensitive field tagging.

Justifications:

A.​ Secure API logging (immutable logs) provides reliable auditing and compliance verification for
regulators.
B.​ Imputation addresses missing values but does not provide compliance verification.
C.​ PCA reduces dimensions for modeling, not for regulatory audit purposes.
D.​ Metadata tagging is important for governance, but regulators require tamper-proof audit logs,
not just metadata.

Module 10: Continuous Learning and Adaptation

Question M10-Q1

What is the main purpose of continuous learning in AI systems?

A.​ To ensure models adapt to new data while retaining prior knowledge. ✓
B.​ To maximize training speed regardless of accuracy.
C.​ To reduce model size for faster inference.
D.​ To eliminate the need for monitoring or updates.

Justifications:

A.​ Continuous learning enables adaptation to new data.

B.​ Speed is not the priority.
C.​ Not purpose.
D.​ Monitoring is needed.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 40

Question M10-Q2

Which scenario best illustrates prediction drift?

A.​ The training dataset becomes corrupted.

B.​ The outputs of a model shift significantly compared to historical predictions. ✓
C.​ Input features of a fraud detection system change over time.
D.​ New features are added to a dataset mid-deployment.

Justifications:

A.​ Not prediction drift.

B.​ Prediction drift occurs when model outputs differ over time.
C.​ That's data drift.
D.​ Not drift.

Question M10-Q3

What is catastrophic forgetting in continuous learning?

A.​ When a model loses prior knowledge after retraining on new data. ✓
B.​ When a system’s database becomes corrupted.
C.​ When bias testing is skipped during validation.
D.​ When model weights cannot be updated due to hardware limits.

Justifications:

A.​ Catastrophic forgetting = loss of old knowledge after retraining.

B.​ Database corruption unrelated.
C.​ Not bias testing.
D.​ Not hardware.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 41

Question M10-Q4

Why would a healthcare consortium adopt federated learning instead of centralizing data?

A.​ To eliminate the need for monitoring.

B.​ To increase training speed by pooling data centrally.
C.​ To reduce compute costs.
D.​ To protect patient privacy while still enabling collective model training. ✓

Justifications:

A.​ Monitoring is still needed.

B.​ Pooling reduces privacy.
C.​ Cost is not the main driver.
D.​ Federated learning enables training without data sharing.

Question M10-Q5

Which feedback mechanism ensures expert input is weighted more heavily than casual user input?

A.​ Contextual feedback analysis. ✓

B.​ Random sampling of feedback.
C.​ Batch updates every quarter.
D.​ Consensus by majority voting.

Justifications:

A.​ Contextual analysis prioritizes expert input.

B.​ Random ignores expertise.
C.​ Batching doesn't weight experts.
D.​ Majority treats all equal.

© Copyright 2025, Cloud Security Alliance. All rights reserved.​ ​ ​ 42