Free PECB ISO/IEC 42001 Foundation Practice Questions

Sample Practice Questions

Try these 10 sample questions from the PECB ISO/IEC 42001 Foundation practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1What does ISO/IEC 42001 specify requirements for managing?

   1. A.A framework for describing machine-learning system components
   2. B.An organization's AI management systemCorrect answer: B
   3. C.A prescribed technical protocol for training every AI model
   4. D.A certification body's qualification system for AIMS auditors

   Explanation: ISO states that the standard specifies requirements for "an Artificial Intelligence Management System (AIMS) within organizations." Its focus is the organization’s management system for AI.

   Reference: ISO/IEC 42001:2023 — AI management systems — What is ISO/IEC 42001?

2. 2Which governance documentation clarifies who is responsible for communicating AI risk findings?

   1. A.A list of AI models and their training datasets
   2. B.A record of roles, responsibilities and communication linesCorrect answer: B
   3. C.A schedule of model performance measurements
   4. D.A set of criteria for rating the severity of AI risks

   Explanation: NIST calls for "Roles and responsibilities and lines of communication" for AI risk activities to be documented and clear. This assigns the communication responsibility identified in the scenario.

   Reference: NIST AI Risk Management Framework (AI RMF 1.0) — Section 5.1, GOVERN 2.1

3. 3Which organization falls within the intended applicability of ISO/IEC 42001?

   1. A.Only large companies that develop their own AI models
   2. B.Only public agencies that procure AI-based services
   3. C.A nonprofit organization that uses an AI-based serviceCorrect answer: C
   4. D.A company only when it sells AI systems to customers

   Explanation: ISO describes the standard as relevant to "companies or non-profits" and to organizations developing, providing, or using AI-based services. A nonprofit user therefore fits the stated scope.

   Reference: ISO/IEC 42001:2023 — AI management systems — FAQ, Who is ISO/IEC 42001 for?

4. 4Under NIST's AI RMF, who takes responsibility for decisions about risks from AI system development and deployment?

   1. A.The system's data science lead
   2. B.The internal audit program manager
   3. C.The organization's executive leadershipCorrect answer: C
   4. D.The supplier's risk management lead

   Explanation: NIST states that "Executive leadership of the organization takes responsibility for decisions about risks" associated with AI development and deployment.

   Reference: NIST AI Risk Management Framework (AI RMF 1.0) — Section 5.1, GOVERN 2.3

5. 5How does ISO describe the relationship between innovation and governance in its AI management system standard?

   1. A.It replaces governance with an innovation program.
   2. B.It balances innovation with governance of AI risks and opportunities.Correct answer: B
   3. C.It confines governance to AI systems after they are retired.
   4. D.It eliminates the need to consider AI-related opportunities.

   Explanation: ISO describes "balancing innovation with governance" through a structured way to manage AI risks and opportunities. The standard addresses both aims together.

   Reference: ISO/IEC 42001:2023 — AI management systems — Why is ISO/IEC 42001 important?

6. 6What role does senior leadership have in an organization's AI risk culture according to NIST?

   1. A.Setting the tone for risk management and organizational cultureCorrect answer: A
   2. B.Limiting risk culture to the model testing stage
   3. C.Assigning risk culture solely to the system's users
   4. D.Defining risk culture solely through deployment-speed incentives

   Explanation: NIST states that "Senior leadership sets the tone for risk management within an organization" and its organizational culture.

   Reference: NIST AI Risk Management Framework (AI RMF 1.0) — Section 5.1, Govern

7. 7Which pair of continuing actions does ISO/IEC 42001 describe for an established AI management system?

   1. A.Maintaining the system while freezing its performance
   2. B.Replacing the system whenever an AI model is updated
   3. C.Maintaining and continually improving the systemCorrect answer: C
   4. D.Establishing and implementing the system before it exists

   Explanation: ISO describes requirements for "maintaining, and continually improving" the AIMS as well as establishing and implementing it. The system is not a one-time project.

   Reference: ISO/IEC 42001:2023 — AI management systems — What is ISO/IEC 42001?

8. 8An organization uses human reviewers with AI recommendations. What governance action does NIST identify for these arrangements?

   1. A.Define and differentiate human-AI roles and oversight responsibilities.Correct answer: A
   2. B.Assume the AI system has sole responsibility for every decision.
   3. C.Replace human oversight responsibilities with system availability targets.
   4. D.Assign all review duties to users without describing their authority.

   Explanation: NIST calls for policies and procedures "to define and differentiate roles and responsibilities for human-AI configurations and oversight of AI systems".

   Reference: NIST AI Risk Management Framework (AI RMF 1.0) — Section 5.1, GOVERN 3.2

9. 9How does ISO describe the level at which ISO/IEC 42001 manages AI-related risks and opportunities?

   1. A.Across an organization through a management systemCorrect answer: A
   2. B.Only within the source code of individual AI models
   3. C.Only within the external auditor's certification process
   4. D.Across an industry through a single shared AI model

   Explanation: ISO states that the standard provides "a practical way of managing AI-related risks and opportunities across an organization." It describes management-system governance rather than details of specific applications.

   Reference: ISO/IEC 42001:2023 — AI management systems — FAQ, What types of standards does ISO have for AI?

10. 10Why should personnel and partners receive AI risk management training, according to NIST?

    1. A.To designate every trained person as the risk owner
    2. B.To replace the need for any role assignments
    3. C.To treat training completion as risk acceptance
    4. D.To perform assigned duties consistently with policies and agreementsCorrect answer: D

    Explanation: NIST links training to personnel and partners being able "to perform their duties and responsibilities consistent with related policies, procedures, and agreements".

    Reference: NIST AI Risk Management Framework (AI RMF 1.0) — Section 5.1, GOVERN 2.2