612-51 Exam Guide & Practice Questions

A regional utility is replacing a keyword-based help page with an AI assistant that answers questions about service outages and billing. It already has a hosted foundation model API, a searchable collection of approved public guidance, and private customer account records. The assistant must not use customer records for training, and users must not retrieve information about another account. The team needs natural-language answers without expanding the permitted data use.

Which design best meets the utility's technical and ethical requirements?

• AFine-tune the model on past customer conversations after removing names and account numbers.
• BRun an open-weight model locally and place all support records in a shared retrieval index without access controls.
• CUse a hosted foundation model with retrieval from approved, access-controlled documents, and configure the service so prompts are not used for model training.
• DReplace the model with a fixed rules engine that returns only prewritten responses.

A recruitment firm plans to train a model to rank applicants for technical roles. Its dataset contains five years of application records and the final hiring decisions, but most people hired during that period came from a narrow set of schools. The team can remove names and other direct identifiers, yet the hiring records also include applicants who were rejected. Managers want to begin training next month and suggest treating every past decision as a correct label.

What should the team do before using the historical records to train its applicant-screening model?

• ARemove names and protected attributes, then use all historical outcomes as training labels.
• BValidate whether the historical outcomes are appropriate labels and examine whether the examples represent affected applicant groups.
• CIncrease the number of records for underrepresented groups until group counts are equal, without changing the historical labels.
• DUse only recent hires because their outcomes are more current than those of earlier applicants.

A public library wants to forecast busy hours so it can schedule staff and keep enough study spaces available. Its facilities team has proposed an AI system using entrance cameras, but the forecast requires only hourly visitor totals, not visitor identities or movement histories. The library has a limited storage budget, and its privacy notice does not currently describe identifying visitors for analytics. Staff need a method that provides useful counts without collecting more personal data than the task requires.

Which approach is most appropriate for the library's stated forecasting task?

• AUse facial recognition to identify repeat visitors and infer attendance patterns.
• BProcess camera video, blur faces after analysis, and retain the raw footage for future model retraining.
• CUse non-identifying doorway counters or aggregate sensor counts, retain totals, and assess the accuracy limits of those counts.
• DInfer attendance from hashed Wi-Fi device identifiers and retain the identifiers to track repeat visits.

A multinational insurer receives AI proposals from claims, customer service, and underwriting. Each unit has separate budget decisions, and no executive is accountable for the organization-wide AI portfolio. The board wants proposals compared against corporate priorities, while existing privacy and legal teams must retain their established responsibilities. Which governance arrangement best addresses this need?

Which governance arrangement best addresses the insurer’s need for an aligned AI strategy and clear organizational accountability?

• AGive the technology department sole authority to select AI projects and set their business priorities.
• BCreate an executive AI governance committee with business and relevant control-function representation, a defined charter, and authority to set priorities and assign accountable sponsors.
• CAllow each business unit to establish its own AI strategy and policies, with no organization-wide coordination.
• DTransfer AI strategy decisions to an external consultancy and ask it to approve proposed projects.

A call center plans to introduce an AI assistant to reduce the time agents spend searching internal guidance. Executives have set a target for shorter calls, but customer satisfaction must not decline. Many agents are concerned that the system will make their work harder, and the current reporting dashboard measures call duration but not staff adoption or service outcomes. Which performance approach best supports the strategy?

Which performance approach best supports the call center’s AI strategy?

• AMeasure the project only by average call-handling time and increase deployment if that figure falls.
• BSet success measures for handling time, customer-service outcomes, and staff adoption, establish baselines, and schedule leadership reviews against the stated objectives.
• CMeasure the number of AI features released and treat each release as evidence of business value.
• DLet the vendor define success measures after deployment so that targets reflect the tool’s capabilities.

A software company plans to sell an AI system that ranks job applicants to employers in the European Union, the United Kingdom, and Canada. The product team expects the same intended use in each market, but local sales teams have raised questions about different legal requirements. The company has not yet assigned an owner for determining its obligations as the system provider. What should it do first to establish a sound governance approach for this expansion?

What should the company do first to establish a sound governance approach for this expansion?

• AApply the same compliance checklist in every market because the company’s intended use is unchanged.
• BProhibit all AI-assisted recruitment in every jurisdiction until regulators issue identical rules.
• CHave legal and compliance owners map applicable requirements by jurisdiction, intended purpose, and the company’s role, then use that assessment to set market-entry conditions.
• DAsk each local sales team to decide whether the system is permitted, since those teams understand their customers.

An insurer uses a retrieval-augmented model to summarize claim documents. Access controls restrict each adjuster to assigned claims, but a security test shows that crafted text in an invoice can make the model include details from another claim in its response. The risk register does not cover adversarial document content, and the team has not tested this path in its assessment.

Which action should the risk team take first?

• ADisable retrieval for every claims workflow, then treat the issue as resolved.
• BDocument the attack path and assess its likelihood and impact using the current controls.
• CAdd more invoice examples to the model’s training data before recording the finding.
• DAsk the vendor to add a service-level commitment without changing the risk assessment.

A regional insurer is considering a vendor’s claims-triage model that will influence which files receive urgent review. The vendor hosts the model and updates it regularly, but its due-diligence response does not identify training-data sources, model versions, or subcontractors. The insurer’s procurement team needs evidence that would let it trace changes and reassess risk before accepting the service.

Which procurement condition would best address the supply-chain risk before approval?

• ARequire the vendor to provide traceable dataset and model-version lineage, and to notify the insurer of material changes.
• BAccept the vendor’s general security certification as proof that its training data are suitable.
• CRequire the vendor to indemnify the insurer for all claims, without requesting information about model inputs or updates.
• DApprove the service if the vendor confirms that it uses data from multiple sources.

A health insurer uses a vendor-hosted model to prioritize incoming claims. Final decisions take several months, while the vendor can change the model during the year. The risk team needs an early warning process, but current reports show only monthly processing volume and average response time. The insurer can request additional reports and has authority to pause use if a defined risk limit is exceeded.

Which monitoring approach is most appropriate for detecting a change in the model’s risk profile?

• AReview annual accuracy results after enough final claim decisions have accumulated.
• BTrack agreed input and output indicators against thresholds, and trigger risk reassessment when a threshold is crossed.
• CUse the vendor’s monthly update schedule as the only signal that risk has changed.
• DCheck whether the model’s average processing time remains within its service target.

A financial services team deploys a classification model monthly. After a recent update, reviewers cannot determine which training data snapshot and source code produced decisions from the previous release. The team must preserve evidence for each release without preventing scheduled updates. Engineers also need to recreate an earlier release during an investigation. What should the team implement?

Which implementation best supports traceability and reproducibility for each deployed model release?

• AStore only the latest production model and overwrite earlier artifacts after each rollout.
• BKeep a release record linking the model artifact hash, source commit, data snapshot identifier, configuration, and approval, and retain it with each deployed version.
• CMaintain a wiki page with a narrative training summary and update it whenever engineers recall a change.
• DRecord serving latency and output scores, but omit build identifiers to reduce storage.

A manufacturer runs an internal document-classification model through a REST inference service used by two approved business applications. The service processes confidential reports, and traffic currently crosses a shared corporate network. The team must prevent unapproved workloads from invoking the model and protect requests and responses in transit, while retaining automated deployment and service-to-service calls. Which implementation best meets these requirements?

Which implementation best meets the access-control and communications requirements?

• AExpose the inference endpoint publicly, use an API key embedded in each application, and encrypt only stored data.
• BUse a private endpoint with TLS, authenticate each application through a workload identity, and authorize only the required model operations.
• CRequire all callers to share one administrator credential and permit each application to invoke every available model.
• DPlace the endpoint behind a corporate firewall and allow unauthenticated calls from any workload on the internal network.

A customer-support organization operates a generative assistant that logs complete prompts and responses for troubleshooting. Analysts need to diagnose recurring formatting failures, and logs are retained for 30 days. The privacy team has prohibited routine storage of customer message content and direct identifiers, but engineering must still correlate errors to affected sessions. Which change best meets these requirements?

Which change best protects customer information while preserving useful diagnostic telemetry?

• AStop collecting all application telemetry, including error codes and session references.
• BRedact message content and direct identifiers before persistent logging, while retaining error codes and pseudonymous session references with restricted access.
• CContinue storing complete prompts and responses, but encrypt the log storage and allow the engineering team to access it.
• DReplace each complete prompt with a hash and discard the remaining event details.

A public benefits office uses an AI system to prioritize applications for staff review. After an upstream data provider changes a field format, the system produces unusually high priority scores for many applications. The service is still running, but staff can use an approved manual queue for several hours. Processing logs are subject to routine deletion overnight, and the incident plan names an incident lead and communication contacts.

Which action should the incident lead take first?

• ASuspend automated decisions, move to the approved manual workflow, preserve relevant records, and follow the incident communication plan.
• BReplace the production model with the previous version and resume automated decisions before investigating the input change.
• CKeep automated decisions running and increase monitoring until the data provider confirms the cause.
• DDelete malformed input records and restart the service to prevent further processing errors.

An internal audit is reviewing an AI tool that assigns customer service cases to specialist teams. The operations group says it completed user acceptance and model validation before release, but the audit file contains only a presentation stating that testing passed. The system has since received a minor update, and the audit must establish whether the original release decision was supported by reviewable evidence and whether test exceptions were handled.

What should the audit team request before it closes this finding?

• AA reproducible evidence package containing the test scope, acceptance criteria, sampled cases, results, exceptions, and documented remediation decisions.
• BA signed statement from the system owner confirming that the tests were completed and that no material issues remain.
• CA new run of the tests using the current system, with only the final pass or fail result retained.
• DA summary of user satisfaction scores collected after deployment, because operational use is stronger evidence than test records.

A call center relies on an AI system to classify urgent service requests. Its continuity plan sets a two-hour recovery time objective and a 15-minute recovery point objective. During a regional outage exercise, the standby service becomes available after 90 minutes, but its latest restored data is nine hours old. Staff can use a documented manual process for up to six hours, and the exercise team must decide how to proceed and record the result.

Which response best follows the continuity plan and supports an effective recovery review?

• AUse the approved manual process, record that the recovery point objective was missed, and address the backup and recovery gaps before authorizing the standby service.
• BRoute all live traffic to the standby service because it is responding, then assess the data age after service resumes.
• CWait for the primary region to return without using the manual process, since a standby with stale data could create inconsistent results.
• DRestore the standby snapshot and treat the recovery time objective as met because the service becomes available within two hours.