IAPP Artificial Intelligence Governance (AIGP) Practice Questions & Study Guide

Free IAPP Artificial Intelligence Governance (AIGP) Practice Questions Preview

• Question 1

  Random forest algorithms are in what type of machine learning model?

  • A. Symbolic.
  • B. Generative.
  • C. Discriminative.
  • D. Natural language processing.

  Correct Answer: C

  Explanation:

  I agree with the chosen answer C. Random forest is a supervised learning algorithm used for classification and regression that functions by modeling the conditional probability of a target variable given input features, which is the definition of a discriminative model.

  Reason

  Option C is correct because discriminative models focus on learning the boundary between classes (the 'decision boundary'). Random forest achieves this by aggregating multiple decision trees to determine the most likely class or value for a given set of inputs, rather than modeling the underlying distribution of the data itself.

  Why the other options are not as suitable

  • Option A is incorrect because symbolic AI refers to high-level 'human-readable' representations of problems, logic, and search, whereas random forest is a connectionist/statistical machine learning approach.
  • Option B is incorrect because generative models aim to learn the joint probability distribution and can create new data instances; random forest cannot generate new samples.
  • Option D is incorrect because Natural Language Processing (NLP) is a field of application, not a type of machine learning model; while random forests can be used in NLP tasks, they are not a model type themselves.

  Citations

  • https://www.iapp.org/resources/article/aigp-body-of-knowledge/
  • https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf

• Question 2

  CASE STUDY -
  Please use the following to answer the next question:
  A company is considering the procurement of an AI system designed to enhance the security of IT infrastructure. The AI system analyzes how users type on their laptops, including typing speed, rhythm and pressure, to create a unique user profile. This data is then used to authenticate users and ensure that only authorized personnel can access sensitive resources.
  When prioritizing the updates to its policies, rules and procedures to include the new AI system for user authentication, the organization should:

  • A. Update third-party data sharing policies.
  • B. Update security controls for sensitive data.
  • C. Ensure that any personal data used is only processed for a specific and lawful purpose.
  • D. Reduce the complexity of the policy to make it easier for non technical employees to understand.

  Correct Answer: C

  Explanation:

  I agree with the suggested answer C. The case study describes the collection of behavioral biometrics (typing rhythm, speed, and pressure), which constitutes personal data and, in many legal frameworks, sensitive data. Under the IAPP AIGP body of knowledge, aligning AI procurement with privacy principles—specifically purpose limitation and lawfulness—is a foundational requirement for policy updates.

  Reason

  Option C is correct because it addresses the fundamental data protection principle of purpose limitation. Since the system creates a unique user profile based on biometric patterns, the organization must ensure a lawful basis for processing exists and that the data is not repurposed for anything other than the stated authentication goal. This is a primary step in AI governance to mitigate legal and compliance risks.

  Why the other options are not as suitable

  • Option A is incorrect because while third-party sharing might occur, the primary concern is the internal collection and processing of biometric data itself.
  • Option B is a secondary step; while security controls are necessary, they are technical implementations that follow the establishment of a lawful processing framework.
  • Option D is incorrect because while transparency is important, reducing complexity does not supersede the legal requirement to ensure specific and lawful purpose for sensitive biometric processing.

  Citations

  • https://iapp.org/resources/article/artificial-intelligence-governance-professional-body-of-knowledge/
  • https://iapp.org/resources/article/iapp-aigp-exam-blueprint/

• Question 3

  What type of organizational risk is associated with AI’s resource-intensive computing demands?

  • A. People risk.
  • B. Security risk.
  • C. Third-party risk.
  • D. Environmental risk.

  Correct Answer: D

  Explanation:

  I agree with the chosen answer D. In the context of the IAPP AIGP body of knowledge, the massive energy consumption and water usage required for cooling data centers that run LLMs and other intensive AI models are specifically categorized under Environmental risk.

  Reason

  Option D is correct because Environmental risk (or sustainability risk) focuses on the ecological footprint of AI. Training and deploying large-scale models require significant electricity, leading to high carbon emissions, and substantial water resources for thermal management in data centers.

  Why the other options are not as suitable

  • Option A is incorrect as People risk typically refers to workforce displacement, bias, or safety hazards to individuals.
  • Option B is incorrect because Security risk relates to data breaches, adversarial attacks, or system vulnerabilities, not resource consumption.
  • Option C is incorrect because while many resource-intensive models are hosted by third parties, the nature of the risk described (resource demand) is inherently environmental rather than a concern about vendor management or supply chain integrity.

  Citations

  • https://iapp.org/resources/article/artificial-intelligence-governance-professional-body-of-knowledge/
  • https://iapp.org/news/a/the-environmental-impact-of-ai-a-governance-challenge/

• Question 4

  A hospital implements an AI system to assist doctors in diagnosing diseases based on historical patient data.
  Which one of the following model types best describes this system?

  • A. Inference.
  • B. Statistical.
  • C. Probabilistic.
  • D. Deterministic.

  Correct Answer: C

  Explanation:

  I agree with the suggested answer C (Probabilistic). In the context of the IAPP AIGP Body of Knowledge, AI diagnostic systems are fundamentally non-deterministic and rely on calculating the likelihood of an outcome based on historical patterns, making 'probabilistic' the most accurate description of the model's nature.

  Reason

  Probabilistic models are defined by their ability to handle uncertainty. In medical diagnosis, there is rarely a 1:1 mapping of symptoms to diseases; instead, the model outputs a probability distribution or a confidence score based on historical data. This aligns with how Machine Learning functions—mapping inputs to likely outputs rather than fixed rules.

  Why the other options are not as suitable

  Inference is a process (the phase where a trained model makes predictions on new data) rather than a 'model type' itself. Statistical is a broad field that informs AI, but in AI governance terminology, 'probabilistic' more precisely describes the output behavior compared to deterministic systems. Deterministic is the opposite of how these AI systems work; a deterministic system would produce the exact same output for an input every time based on rigid logic, which cannot account for the variability and noise found in historical medical data.

  Citations

  • https://iapp.org/certify/get-certified/aigp/
  • https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf

• Question 5

  Which of the following AI uses is best described as human-centric?

  • A. Pattern recognition algorithms are used to improve the accuracy of weather predictions, which benefits many industries and everyday life.
  • B. Autonomous robots are used to move products within a warehouse, allowing human workers to reduce physical strain and alleviate monotony.
  • C. Machine learning is used for demand forecasting and inventory management, ensuring that consumers can find products they want when they want them.
  • D. Virtual assistants are used to adapt educational content and teaching methods to individuals, offering personalized recommendations based on ability and needs.

  Correct Answer: D

  Explanation:

  I agree with the chosen answer D. In the context of the IAPP AIGP body of knowledge and the OECD AI Principles, human-centric AI refers to systems that prioritize human agency, well-being, and the protection of fundamental rights through personalized support and empowerment.

  Reason

  Option D is correct because it exemplifies human-centric design by focusing on the individual's unique needs, abilities, and development. By adapting educational content to a specific person, the AI serves as a tool for human empowerment and personal growth, which is a core pillar of trustworthy, human-centric AI frameworks.

  Why the other options are not as suitable

  • Option A describes a general-purpose utility; while beneficial to society, it lacks the individual-level agency and personalization typical of the human-centric definition.
  • Option B focuses on operational efficiency and workplace automation; while it reduces strain, the primary driver is task-oriented rather than human-centric development.
  • Option C is a commercial optimization use case aimed at supply chain efficiency and consumer satisfaction, which aligns more with market demand than the ethical 'human-centric' principle of individual wellbeing and rights.

  Citations

  • https://oecd.ai/en/dashboards/ai-principles/p1
  • https://framework.iapp.org/
  • https://digital-strategy.ec.europa.eu/en/library/ethics-guidelines-trustworthy-ai

• Question 6

  Which of the following is a foundational characteristic of effective AI governance?

  • A. Engagement of a cross-functional team.
  • B. Reliance on tested vendor management processes.
  • C. Thorough reviews of a company’s public filings with experts.
  • D. Uniform policies and procedures across developer, deployer and user roles.

  Correct Answer: A

  Explanation:

  I agree with the chosen answer (A). AI governance is inherently multi-disciplinary, requiring input from legal, technical, ethical, and business stakeholders to effectively manage the unique risks associated with machine learning systems.

  Reason

  A is correct because cross-functional engagement is a pillar of the IAPP AIGP Body of Knowledge. Effective AI governance cannot exist in a vacuum; it requires a 'team of teams' approach (including legal, IT, data science, and HR) to ensure that oversight covers technical performance, regulatory compliance, and ethical alignment.

  Why the other options are not as suitable

  B is incorrect because while vendor management is a component of AI procurement, it is a narrow subset of governance rather than a 'foundational characteristic' of the entire system. C is incorrect because public filings are a reporting requirement for specific entities, not a fundamental building block of an internal AI governance framework. D is incorrect because uniform policies are often inappropriate across different roles; developers, deployers, and users have distinct responsibilities and risk profiles that require tailored rather than uniform procedures.

  Citations

  • https://iapp.org/certify/get-certified/aigp/
  • https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf

• Question 7

  CASE STUDY -
  Please use the following to answer the next question:
  A company is considering the procurement of an AI system designed to enhance the security of IT infrastructure. The AI system analyzes how users type on their laptops, including typing speed, rhythm and pressure, to create a unique user profile. This data is then used to authenticate users and ensure that only authorized personnel can access sensitive resources.
  All of the following are obligations of the company as a data controller when implementing its AI system EXCEPT?

  • A. Ensuring that third-party processors are based in the same country as the company.
  • B. Allowing data subject access requests (DSARs).
  • C. Implementing technical and organizational measures.
  • D. Conducting a Data Protection Impact Assessment (DPIA) / Privacy Impact Assessment (PIA).

  Correct Answer: A

  Explanation:

  I agree with the chosen answer A. Under global data protection frameworks like the GDPR (which informs much of the AIGP body of knowledge), there is no absolute legal requirement for third-party processors to be located in the same country as the data controller, provided that valid cross-border transfer mechanisms are in place.

  Reason

  Option A is the correct 'EXCEPT' choice because data protection laws allow for international data transfers to processors in other countries as long as adequate protections (like Standard Contractual Clauses or Adequacy Decisions) are met. Location proximity is a business or risk preference, not a legal obligation of a data controller.

  Why the other options are not as suitable

  • Option B is a core obligation as Data Subject Access Requests (DSARs) are a fundamental right for individuals to understand how their biometric-style data is being used.
  • Option C is mandatory because controllers must implement technical and organizational measures to secure sensitive behavioral data.
  • Option D is required because the AI system uses behavioral biometrics for authentication, which constitutes high-risk processing, necessitating a Data Protection Impact Assessment (DPIA).

  Citations

  • https://iapp.org/resources/article/iapp-aigp-body-of-knowledge/
  • https://gdpr-info.eu/art-24-gdpr/
  • https://gdpr-info.eu/art-35-gdpr/

• Question 8

  CASE STUDY -
  Please use the following to answer the next question:
  A company is considering the procurement of an AI system designed to enhance the security of IT infrastructure. The AI system analyzes how users type on their laptops, including typing speed, rhythm and pressure, to create a unique user profile. This data is then used to authenticate users and ensure that only authorized personnel can access sensitive resources.
  The data processed by the AI system would be classified as:

  • A. Non-sensitive personal data, since it does not reveal information about health, gender or race.
  • B. Organizational data, since it is part of the authentication process.
  • C. Non-personal data, as long as it is not linked to a user ID.
  • D. Special category data, if it can be used to uniquely identify a person.

  Correct Answer: D

  Explanation:

  I agree with the suggested answer D. The data described—typing speed, rhythm, and pressure—constitutes behavioral biometrics. Under privacy frameworks like the GDPR (which informs much of the AIGP body of knowledge), biometric data is elevated to Special Category Data specifically when it is processed for the purpose of uniquely identifying a natural person, which is the exact use case for authentication described in the prompt.

  Reason

  Option D is correct because biometric data (including behavioral characteristics like keystroke dynamics) is considered Special Category Data or Sensitive Personal Information when used for identification or authentication. The prompt explicitly states the AI creates a unique user profile to authenticate users, meeting the legal threshold for this classification.

  Why the other options are not as suitable

  • Option A is incorrect because while the data may not reveal health or race directly, its use for unique identification automatically triggers its status as sensitive/special category biometric data.
  • Option B is incorrect because the origin or purpose of the data (organizational authentication) does not change its legal nature as personal biometric data.
  • Option C is incorrect because the data is inherently identifiable; even if not linked to a name, the 'unique user profile' acts as a pseudonymous identifier, and the goal is to link the behavior to a specific authorized person, making it personal data.

  Citations

  • https://iapp.org/resources/article/iapp-aigp-body-of-knowledge/
  • https://gdpr-info.eu/art-9-gdpr/

• Question 9

  Which of the following typical approaches is a large organization least likely to use to responsibly train stakeholders on AI terminology, strategy and governance?

  • A. Providing all technical employees education on AI development so they can retool and participate in the development of AI systems.
  • B. Providing training on AI ethics, based on the extent to which the organization seeks to promote a responsible AI culture.
  • C. Providing role-specific training, based on whether the organization uses a centralized, federated or decentralized governance mode.
  • D. Providing information and education to customers and users to understand the capabilities and limitations of the AI tools with which they interact.

  Correct Answer: A

  Explanation:

  I disagree with the community vote (C) and agree with the Suggested Answer (A). While organizations provide general AI literacy, it is least likely and practically unfeasible for a large organization to provide 'all' technical employees with the deep retooling required for AI development as a standard governance or training approach.

  Reason

  Option A is the correct choice because the question asks for the least likely approach. Large organizations focus on AI literacy and role-based training rather than universal technical retooling. It is inefficient and often unnecessary to train every technical staff member (e.g., database admins, front-end devs, hardware techs) in the intricacies of AI development when many will only be users or maintainers of existing systems.

  Why the other options are not as suitable

  • Option B is incorrect because training on AI ethics is a fundamental pillar of Responsible AI (RAI) frameworks and a highly likely activity.
  • Option C is incorrect because role-specific training tailored to the governance model (centralized vs. decentralized) is a best practice recommended by the IAPP AIGP Body of Knowledge to ensure accountability.
  • Option D is incorrect because transparency via customer and user education regarding AI limitations is a core requirement of many AI regulations (like the EU AI Act) and safety standards.

  Citations

  • https://iapp.org/certify/get-certified/aigp/
  • https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf

• Question 10

  All of the following are elements of establishing a global AI governance infrastructure EXCEPT:

  • A. Providing training to foster a culture that promotes ethical behavior.
  • B. Creating policies and procedures to manage third-party risk.
  • C. Understanding differences in norms across countries.
  • D. Publicly disclosing ethical principles.

  Correct Answer: D

  Explanation:

  I disagree with the Suggested Answer (D) and the community's conflicting votes for A and B. According to the IAPP AIGP Body of Knowledge, the correct answer is B. While managing third-party risk is a standard component of localized or enterprise-level AI governance, the specific elements of a global governance infrastructure focus on cultural alignment, transparency, and internal ethical culture rather than the technicalities of vendor management.

  Reason

  Option B is the correct 'EXCEPT' choice because Creating policies and procedures to manage third-party risk is typically classified under the AI Lifecycle or Operational Governance phase rather than the Global Infrastructure phase. Global infrastructure refers to the high-level framework that enables an organization to operate across borders, such as establishing core values and understanding international legal/normative variances.

  Why the other options are not as suitable

  • Option A is an element of global infrastructure because fostering an ethical culture via training ensures that the governance framework is respected by employees worldwide.
  • Option C is a primary element because Understanding differences in norms is the literal definition of globalizing a governance approach to ensure international compliance and interoperability.
  • Option D is an element because Publicly disclosing ethical principles is a foundational step in establishing global transparency and accountability to external stakeholders and regulators.

  Citations

  • https://iapp.org/certify/get-certified/aigp/
  • https://iapp.org/resources/article/ai-governance-professional-body-of-knowledge/