When deploying LLMs in production, what is a common strategy for parameter-efficient fine-tuning?
Correct Answer: B
Parameter-efficient fine-tuning (PEFT) strategies, like LoRA or adapters, freeze most pretrained parameters and train only lightweight modules, reducing computational costs while adapting to new tasks. This preserves general knowledge, prevents catastrophic forgetting, and enables quick deployments in resource-constrained settings. For LLMs, it's crucial for efficiency in production, allowing specialization without retraining billions of parameters. Security-wise, it minimizes exposure to new data risks. Exact extract: "A common strategy is freezing the majority of model parameters and updating only a small task-relevant subset, ensuring efficiency in fine-tuning for production deployment." (Reference: Cyber Security for AI by SISA Study Guide, Section on Efficient Fine-Tuning in SDLC, Page 90-92).
Question 2
When integrating LLMs using a Prompting Technique, what is a significant challenge in achieving consistent performance across diverse applications?
Correct Answer: C
Prompting techniques in LLM integration, such as zero-shot or few-shot prompting, face challenges in consistency due to the need for meticulously optimized templates that generalize across tasks. Variations in prompt phrasing can lead to unpredictable outputs, requiring iterative engineering to balance specificity and flexibility, especially in diverse domains like legal or medical apps. This optimization involves A/B testing, semantic alignment, and incorporating chain-of-thought to enhance reasoning, but it demands expertise and time in SDLC phases. Unlike latency issues, which are hardware-related, prompt optimization directly affects performance reliability. Security overlaps, as poor prompts might expose vulnerabilities, but the core challenge is generalization. Efficient SDLC uses automated prompt tuning tools to streamline this, reducing development overhead while maintaining efficacy. Exact extract: "A significant challenge is optimizing prompt templates to ensure generalization across different contexts, crucial for consistent LLM performance in varied applications." (Reference: Cyber Security for AI by SISA Study Guide, Section on Prompting in SDLC, Page 100-103).
Question 3
In ISO 42001, what is required for AI risk treatment?
Correct Answer: A
ISO 42001 mandates a systematic risk treatment process, involving identification of AI risks (e.g., bias, security), analysis of impacts, evaluation against criteria, and development of treatment plans like mitigation or acceptance. This ensures proactive management throughout the AI lifecycle. Exact extract: "ISO 42001 requires identifying, analyzing, and evaluating AI risks with appropriate treatment plans." (Reference: Cyber Security for AI by SISA Study Guide, Section on Risk Treatment in ISO 42001, Page 270-273).
Question 4
What role does GenAI play in automating vulnerability scanning and remediation processes?
Correct Answer: B
GenAI automates vulnerability management by analyzing scan results and generating tailored code patches or remediation strategies, accelerating the fix process and reducing human error. Using natural language processing, it interprets vulnerability reports, cross-references with known exploits, and proposes secure code alternatives, integrating seamlessly into DevSecOps pipelines. This proactive approach minimizes exposure windows and enhances system resilience against exploits. For instance, in cloud environments, GenAI can simulate patch impacts before application. This contributes to a stronger security posture by enabling rapid, accurate responses to threats. Exact extract: "GenAI automates vulnerability scanning and remediation by generating code patches and fixes, improving efficiency and security posture." (Reference: Cyber Security for AI by SISA Study Guide, Section on Automation in Vulnerability Management, Page 205-208).
Question 5
A company developing AI-driven medical diagnostic tools is expanding into the European market. To ensure compliance with local regulations, what should be the company's primary focus in adhering to the EU AI Act?
Correct Answer: A
The EU AI Act classifies AI systems by risk, with medical diagnostics as high-risk, requiring stringent safety measures to prevent harm, such as misdiagnoses. Compliance prioritizes robust testing, validation, and monitoring to ensure safe outcomes, aligning with ISO 42001's risk management framework. While ethics and privacy are critical, safety is the primary focus to meet regulatory thresholds and protect users. Exact extract: "The EU AI Act emphasizes implementing measures to prevent harmful outcomes and ensure AI system safety, particularly for high-risk applications like medical diagnostics." (Reference: Cyber Security for AI by SISA Study Guide, Section on EU AI Act Compliance, Page 175-178).
