Free PECB Certified Lead AI Risk Manager Practice Questions

Sample Practice Questions

Try these 10 sample questions from the PECB Certified Lead AI Risk Manager practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1A team has estimated the consequences of a harmful AI event. Which additional component is required to characterize its negative risk under the NIST AI RMF?

   1. A.The organization's readiness to accept the risk
   2. B.The probability of the harmful event occurringCorrect answer: B
   3. C.The remaining exposure after a proposed treatment
   4. D.The consequence magnitude before any treatment

   Explanation: NIST defines risk as a "composite measure of an event’s probability of occurring and the magnitude or degree of the consequences". The team has the consequence component and still needs probability. Readiness to accept is tolerance, remaining exposure follows treatment, and another consequence estimate does not supply likelihood.

   Reference: NIST AI Risk Management Framework (AI RMF 1.0) — section 1.1, printed page 4

2. 2A program manager proposes finishing GOVERN once, then excluding governance from later mapping, measurement and management work. Which change best aligns the program with the NIST AI RMF?

   1. A.Keep governance active across the other risk management functionsCorrect answer: A
   2. B.Replace governance with a single model-accuracy test
   3. C.Restrict governance to post-incident investigations
   4. D.Limit governance to the initial procurement approval

   Explanation: The RMF says GOVERN "is a cross-cutting function that is infused throughout AI risk management". It is a continuing organizational function, rather than a one-time procurement gate, accuracy test or incident-only activity.

   Reference: NIST AI Risk Management Framework (AI RMF 1.0) — section 5.1, printed page 22

3. 3A risk team cannot determine which AI systems the organization actually uses. Which record provides the most direct starting point for a systematic identification effort?

   1. A.A register limited to incidents already reported
   2. B.A repository limited to approved supplier contracts
   3. C.An inventory of the organization's AI systemsCorrect answer: C
   4. D.A register limited to completed benchmark tests

   Explanation: GOVERN 1.6 requires mechanisms "to inventory AI systems". Incidents, contracts and benchmark records each describe a narrower population and may omit systems that still need risk identification.

   Reference: NIST AI Risk Management Framework (AI RMF 1.0) — Table 1, GOVERN 1.6, printed page 23

4. 4An organization has more documented AI risks than it can treat immediately. Which basis for treatment priority is specified in MANAGE 1.2?

   1. A.Ownership, development phase and document-completion status
   2. B.Impact, likelihood and available resources or methodsCorrect answer: B
   3. C.Supplier assurance, contract duration and release frequency
   4. D.Model architecture, parameter count and training-corpus size

   Explanation: MANAGE 1.2 names "impact, likelihood, and available resources or methods". Administrative status, procurement attributes and model scale are different information sets and do not substitute for these stated prioritization factors.

   Reference: NIST AI Risk Management Framework (AI RMF 1.0) — Table 4, MANAGE 1.2, printed page 32

5. 5An organization is deciding what AI risk-management competence development its workforce needs. Which starting point follows the PECB Domain 5 competency?

   1. A.Select training from a course catalogue before identifying workforce gaps
   2. B.Base all course assignments on headcount rather than required skills
   3. C.Carry forward the previous syllabus without analyzing current workforce skills
   4. D.Analyze workforce skills and identify competence gapsCorrect answer: D

   Explanation: The stated starting point is "analyzing workforce skills and identifying gaps". Catalogue selection, headcount or a carried-forward syllabus does not establish the current competence-development need.

   Reference: PECB Lead AI Risk Manager Candidate Handbook — page 11 / Domain 5, competency 3

6. 6Two organizations deploy the same model, but different user practices and social settings produce different harms. Which NIST description most directly explains this difference?

   1. A.AI systems are inherently socio-technicalCorrect answer: A
   2. B.AI systems are defined solely by their training algorithms
   3. C.AI risks are fixed when model training is completed
   4. D.AI harms are determined solely by model accuracy

   Explanation: The RMF states that "AI systems are inherently socio-technical in nature". Technical behavior interacts with human behavior and social context. The other descriptions omit those influences or incorrectly freeze risk at training.

   Reference: NIST AI Risk Management Framework (AI RMF 1.0) — Executive Summary, printed page 1

7. 7A team asks NIST AI RMF to supply the exact amount of risk its organization must accept. Which response correctly assigns responsibility?

   1. A.Use the framework's universal numerical tolerance for all uses
   2. B.Let the model's accuracy metric determine legal acceptability
   3. C.Adopt the vendor's tolerance without considering local obligations
   4. D.Define organizational tolerance in context, consistent with applicable requirementsCorrect answer: D

   Explanation: The RMF "does not prescribe risk tolerance". Tolerance is contextual and influenced by legal requirements and organizational priorities. Neither a universal value, one performance metric nor a vendor preference replaces that decision.

   Reference: NIST AI Risk Management Framework (AI RMF 1.0) — section 1.2.2, printed page 7

8. 8A risk analyst has listed generic AI hazards but cannot explain where they arise in a particular system. Which next step best implements the PECB handbook's Domain 3 mapping competency?

   1. A.Map the risks to system components, lifecycle stages and operational contextsCorrect answer: A
   2. B.Group the risks solely by the date each was entered in the register
   3. C.Copy the supplier's overall risk rating to every component
   4. D.Retain one aggregate risk label for the complete application

   Explanation: The handbook requires mapping risks to "system components, life cycle stages, and operational contexts". This locates risk in the actual system. Entry dates, copied supplier ratings and one aggregate label do not establish those relationships.

   Reference: PECB Lead AI Risk Manager Candidate Handbook — page 9 / Domain 3, competency 3

9. 9A provider has applied controls to an AI system. What should it do with remaining negative risks under MANAGE 1.4?

   1. A.Close the risk entries when the selected controls have been implemented
   2. B.Record the control implementation costs as the remaining-risk description
   3. C.Carry forward the original untreated risk scores as the remaining-risk description
   4. D.Document residual risks affecting downstream acquirers and end usersCorrect answer: D

   Explanation: MANAGE 1.4 calls for documenting negative residual risks "to both downstream acquirers of AI systems and end users". Treatment does not justify deleting remaining risks, treating them as costs alone or substituting pretreatment descriptions.

   Reference: NIST AI Risk Management Framework (AI RMF 1.0) — Table 4, MANAGE 1.4, printed page 32

10. 10A manager wants evidence that an AI risk-management course achieved its purpose. Which evaluation most directly follows the PECB Domain 5 training-outcomes competency?

    1. A.Determine whether the required competencies were achieved and maintainedCorrect answer: A
    2. B.Count the proportion of invited staff who attended the sessions
    3. C.Total the instructional hours completed by each participant
    4. D.Summarize participants' satisfaction ratings for the course

    Explanation: The training-outcome objective is to confirm "that competencies are achieved and maintained". Attendance, hours and satisfaction are real learning-program measures, but none alone demonstrates achievement and maintenance of competence.

    Reference: PECB Lead AI Risk Manager Candidate Handbook — page 11 / Domain 5, competency 5