Free Certified Ethical Emerging Technologist Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Certified Ethical Emerging Technologist practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1In the NIST AI RMF, which description best captures an AI system?

   1. A. A machine-based system generating predictions, recommendations, or decisions for objectives
   2. B. A data repository retaining records without generating outputs for objectives
   3. C. A communications channel transporting inputs without processing them for objectives
   4. D. A monitoring dashboard displaying stored values without generating outputs for objectives

   Answer: A

   Explanation: The AI RMF describes a system that can "generate outputs such as predictions, recommendations, or decisions influencing real or virtual environments." Generating these outputs for objectives distinguishes this definition from storage, transport, or display alone.

   Reference: Artificial Intelligence Risk Management Framework (AI RMF 1.0) — Executive Summary, p. 1

2. 2Which ethical principle is most directly concerned with freedom from intrusion and a person's control over disclosure of their identity?

   1. A. Reliability
   2. B. Privacy
   3. C. Robustness
   4. D. Explainability

   Answer: B

   Explanation: NIST describes privacy norms as addressing "freedom from intrusion, limiting observation, or individuals’ agency to consent to disclosure or control of facets of their identities". Reliability and robustness concern performance; explainability concerns mechanisms.

   Reference: Artificial Intelligence Risk Management Framework (AI RMF 1.0) — Section 3.6, p. 17

3. 3A connected device operates as designed and protects data from unauthorized access, but its detailed usage records expose intimate household routines. What should the privacy assessment conclude?

   1. A. Privacy risk is absent because the system has not suffered a security incident
   2. B. Privacy risk exists only if the device's stored records are inaccurate
   3. C. Privacy risk can arise from intended data processing despite effective cybersecurity
   4. D. Privacy risk is eliminated when the operator is authorized to access the records

   Answer: C

   Explanation: NIST explains that cybersecurity management "is not sufficient, as privacy risks can also arise by means unrelated to cybersecurity incidents". Intended processing may cause surveillance-related harms even when access controls work.

   Reference: NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management, Version 1.0 — Section 1.2.1, pp. 3–4

4. 4Operations staff discover gaps in an AI service's privacy controls. Which internal report best supports management decisions under the NIST Privacy Framework?

   1. A. Report control successes and delay reporting deficiencies until they are corrected
   2. B. Report observed incidents but omit changing risks until they cause actual harm
   3. C. Report progress, deficiencies, incidents, and changing privacy risks
   4. D. Send incident totals without describing control gaps or implementation progress

   Answer: C

   Explanation: NIST says operations personnel "report on progress, gaps and deficiencies, incident management, and changing privacy risks" so managers and senior executives can respond. Delaying gaps, omitting emerging risks, or supplying totals without gaps and progress leaves material management information out.

   Reference: NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management, Version 1.0 — Strengthening Accountability, pp. 10–11

5. 5An organization assigns AI risk duties to staff and partners but provides no preparation for those duties. Which culture-building measure directly supports GOVERN 2.2?

   1. A. Provide general ethics orientation without assigned-duty practice
   2. B. Train personnel and partners for their assigned AI risk duties
   3. C. Prepare internal developers while excluding assigned partners
   4. D. Teach implementation without organizational risk-policy content

   Answer: B

   Explanation: GOVERN 2.2 specifies personnel and partners receive "AI risk management training to enable them to perform their duties and responsibilities consistent with related policies, procedures, and agreements." Generic awareness, developer-only coverage, or technical instruction without risk-policy preparation fails to prepare the relevant people for their assigned duties.

   Reference: Artificial Intelligence Risk Management Framework (AI RMF 1.0) — Table 1, GOVERN 2.2, p. 23

6. 6What does it mean to describe an AI system as socio-technical?

   1. A. Its risks are determined by the computational model independently of its deployment
   2. B. Its behavior depends on technical features interacting with people and social context
   3. C. Its social effects can be evaluated independently of its technical implementation
   4. D. Its outputs remain equivalent across organizations whenever its code is unchanged

   Answer: B

   Explanation: NIST states that AI systems are "influenced by societal dynamics and human behavior." Their risks arise through interactions between technical aspects, use, operators, and deployment context; unchanged code does not remove these influences.

   Reference: Artificial Intelligence Risk Management Framework (AI RMF 1.0) — Executive Summary, p. 1

7. 7According to the NIST AI RMF, which characteristic is a prerequisite for accountability?

   1. A. Full autonomy
   2. B. Maximum accuracy
   3. C. Transparency
   4. D. Model complexity

   Answer: C

   Explanation: NIST states, "Accountability presupposes transparency." Information about the system and its decisions supports accountability; autonomy, accuracy, and complexity do not by themselves supply that prerequisite.

   Reference: Artificial Intelligence Risk Management Framework (AI RMF 1.0) — Section 3.4, p. 15

8. 8An AI service infers previously private facts about identifiable people from otherwise available inputs. Which risk should be assessed?

   1. A. Privacy risk from inference
   2. B. Availability risk from downtime
   3. C. Integrity risk from corrupted storage
   4. D. Reliability risk from random outages

   Answer: A

   Explanation: NIST states, "AI systems can also present new risks to privacy by allowing inference to identify individuals or previously private information about individuals." The fact that inputs are available does not remove the risk created by the inferred private facts.

   Reference: Artificial Intelligence Risk Management Framework (AI RMF 1.0) — Section 3.6, p. 17

9. 9Business managers need direction from senior executives before implementing privacy policies. Which information should senior executives communicate in the NIST Privacy Framework's collaboration model?

   1. A. Organizational privacy values and risk tolerance
   2. B. Financial return targets as the entire basis for privacy decisions
   3. C. Technical control choices in place of organizational privacy priorities
   4. D. Supplier privacy preferences in place of the organization's risk direction

   Answer: A

   Explanation: NIST describes senior executives as those who "communicate an organization’s privacy values and risk tolerance". Financial objectives or technical choices alone do not express that privacy direction, and supplier preferences do not replace the organization's own values and tolerance.

   Reference: NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management, Version 1.0 — Strengthening Accountability, p. 10

10. 10Who does the NIST AI RMF identify as setting the tone for an organization's risk management culture?

    1. A. Individual users of AI predictions
    2. B. External AI component suppliers
    3. C. Independent AI system assessors
    4. D. The organization's senior leaders

    Answer: D

    Explanation: NIST states, "Senior leadership sets the tone for risk management within an organization, and with it, organizational culture." Other actors contribute information or expertise but do not replace leadership's culture-setting role.

    Reference: Artificial Intelligence Risk Management Framework (AI RMF 1.0) — Section 5.1, p. 22