Free Access to IAPP.AIGP.v2026-02-07.q85 with Valid Practice Test (Page 2)

Question 1

CASE STUDY
Please use the following answer the next question:
Good Values Corporation (GVC) is a U.S. educational services provider that employs teachers to create and deliver enrichment courses for high school students. GVC has learned that many of its teacher employees are using generative Al to create the enrichment courses, and that many of the students are using generative Al to complete their assignments.
In particular, GVC has learned that the teachers they employ used open source large language models ("LLM") to develop an online tool that customizes study questions for individual students. GVC has also discovered that an art teacher has expressly incorporated the use of generative Al into the curriculum to enable students to use prompts to create digital art.
GVC has started to investigate these practices and develop a process to monitor any use of generative Al, including by teachers and students, going forward.
All of the following may be copyright risks from teachers using generative Al to create course content EXCEPT?

A.Content created by an LLM may be protectable under U.S. intellectual property law.
B.Generative Al is generally trained using intellectual property owned by third parties.
C.Students must expressly consent to this use of generative Al.
D.Generative Al often creates content without attribution.

Question 2

A deployer discovers that a high-risk AI recruiting system has been making widespread errors, resulting in harms to the rights of a considerable number of EU residents who are denied consideration for jobs for improper reasons such as ethnicity, gender and age.
According to the EU AI Act, what should the company do first?

A.Notify the provider, the distributor, and finally the relevant market authority of the serious incident.
B.Identify any decisions that may have been improperly made and re-open them for human review.
C.Submit an incomplete report to the relevant market authority immediately and follow up with a complete report as soon as possible.
D.Conduct a thorough investigation of the serious incident within the 15 day timeline and present the completed report to the relevant market authority.

Question 3

Business A sells software that provides users with writing and grammar assistance. Business B is a cloud services provider that trains its own AI models.
* Business A has decided to add generative AI features to their software.
* Rather than create their own generative AI model, Business A has chosen to license a model from Business B:
* Business A will then integrate the model into their writing assistance software to provide generative AI capabilities.
* Business A is most concerned that its writing assistance software could recommend toxic or obscene text to its users.
Which of the following governance processes should Business A take to best protect its users against potentially inappropriate text?

A.Business A should fine-tune the AI model on user-generated text that has been verified to be appropriate.
B.Business A should test that the AI model performs as expected and meets their minimum requirements for filtering toxic or obscene text.
C.Business A should establish a user reporting feature that allows users to flag toxic or obscene text, and report any incidents to Business B.
D.Business A should ask Business B for detailed documentation on the generative AI model's training data and whether it contained toxic or obscene sources.

Correct Answer: B

Business A is integrating a generative AI model licensed from a third party (Business B) and is primarily concerned with the risk of toxic or obscene outputs being delivered to users. In this scenario,testing and validationof the AI model for such content risks is the most direct and effective governance strategy.
According to theAI Governance in Practice Report 2024, organizations thatdeployAI must engage in performance monitoring protocolsand ensure systems perform adequately for theirintended purposes, including filtering harmful content:
"Operational governance... development of: #Performance monitoring protocols to ensure systems perform adequately for their intended purposes." (p. 12)
"Product governance... includes: #System impact assessments to identify and address risk prior to product development or deployment." (p. 11) Furthermore, under theEU AI Act, which sets the global standard many organizations aim to align with, there is a clear obligation to test and monitor systems for potential harmful behavior:
"The act imposes regulatory obligations... such as establishing appropriate accountability structures,assessing system impact, providing technical documentation,establishing risk management protocols and monitoring performance..." (p. 7) Option B directly reflects this best practice ofpre-deployment testing and validationto ensure that the model aligns with Business A's minimum content safety requirements.
Let's now evaluate the incorrect options:
* A. Fine-tuning on verified user-generated textmay improve model alignment but does not guarantee that the model will generalize correctly, especially if Business A lacks access to model internals (common in third-party licensing scenarios). Fine-tuning also introduces its own risks and may be contractually restricted.
* C. A user reporting featureisreactive, not preventive. While helpful for long-term monitoring and mitigation, it does not prevent the initial harm of toxic outputs, which isBusiness A's primary concern.
* D. Requesting documentation from Business Bis useful for transparency and risk management, but it does not replaceindependent verificationthat the model meets Business A's content safety standards.
Thus,testing the model's behavior for unacceptable outputs before deploymentis the most aligned approach with AI governance best practices and obligations.

Question 4

Scenario:
A European AI technology company was found to be non-compliant with certain provisions of the EU AI Act.
The regulator is considering penalties under the enforcement provisions of the regulation.
According to the EU AI Act, which of the following non-compliance examples could lead to fines of up to €
15 million or 3% of annual worldwide turnover (whichever is higher)?

A.In case of AI Act prohibitions
B.In case of breach of a provider's obligations for high-risk AI systems
C.In case of the supply of misleading information to notified bodies in reply to a request
D.In case of a breach of AI Act prohibition by the Union institutions, bodies, offices and agencies

Question 5

The best practice to manage third-party risk associated with AI systems is to create and implement policies that?

A.Focus on the financial stability of third-party vendors as the primary criterion for risk assessment.
B.Provide for an appropriate level of due diligence and ongoing monitoring based on the defined risk.
C.Require third-party AI systems to undergo a comprehensive audit by an external cybersecurity firm every six months.
D.Focus on the technical aspects of AI systems, such as data security, while ethical risks are addressed through suitable contracts.

Question 1

Question 2

Question 3

Question 4

Question 5

Download PDF File