ECCouncil 612-51 : Certified Responsible AI Governance & Ethics (CRAGE)

A national cultural and education authority conducts an ethics review of its AI-supported public learning analytics platform. The review identifies major omissions: no assessment addressed cultural inclusion, environmental sustainability, community participation, gender equality, or societal impact. Stakeholder groups-teachers, parents, and cultural representatives-were not engaged during the design or validation phases. Auditors say these shortcomings conflict with an internationally adopted framework that stresses human rights, societal well-being, inclusive participation, and safeguarding cultural and social ecosystems.
As the Chief AI Governance Officer, which international AI ethics framework most closely aligns with the principles identified by the auditors?

• A. OECD
• B. DoD AI Ethical Principles
• C. IEEE
• D. UNESCO

SilverLine Insurance is classifying its AI vendors under the "Vendor Risk Tiers" model. The Chief Information Security Officer (CISO) identifies a vendor that supports the core claims-processing engine, for which failure would cause major legal exposure and significant harm.
Which vendor risk tier is most appropriate for this vendor based on its criticality and potential impact?

• A. Tier 4: Low-Criticality Vendors
• B. Tier 1: Mission-Critical Vendors
• C. Tier 3: Medium-Criticality Vendors
• D. Tier 2 High-Criticality Business Systems

An organization is deploying a large-scale AI solution that uses natural language processing (NLP) to handle customer-service interactions. It is concerned with protecting AI models from adversarial attacks and with ensuring the system is fair, transparent, and legally compliant. The organization is comparing two AI security frameworks: the Artificial Intelligence Controls Matrix (AICM) and the OWASP AI Security Top Ten.
Which statement best distinguishes these two frameworks with respect to securing AI systems and ensuring compliance?

• A. AICM is primarily concerned with ensuring secure APIs and system operations, while OWASP AI Security Top Ten focuses on providing a risk-based approach to security vulnerabilities, including data poisoning and model theft.
• B. Both frameworks provide identical guidance on securing AI models but differ in their approach to compliance and ethical considerations.
• C. AICM provides detailed security and governance controls across the AI lifecycle, with a focus on ethical considerations, bias mitigation, and compliance. In contrast, OWASP AI Security Top Ten focuses more on identifying and mitigating specific security vulnerabilities in AI models, particularly LLMs.
• D. OWASP AI Security Top Ten offers a comprehensive framework for compliance with legal standards, whereas AICM focuses solely on ethical guidelines and lacks any focus on security risks.

As the Chief Information Security Officer (CISO), you are presenting the AI security strategy to the Board of Directors. A board member challenges the need for AI-specific security controls, asserting that existing perimeter defenses and network segmentation ought to be enough.
In response, you explain an approach that applies security controls across multiple independent layers- including data, models, applications, and infrastructure-so compromising one layer does not expose the whole system.
Which security architecture approach are you describing?

• A. Zero Trust
• B. Security controls for Continuous monitoring
• C. Defense in Depth
• D. Security by design

A digital banking platform rolls out an AI-powered virtual assistant to help customers with account questions and financial guidance. Laura Bennett, the organization's Head of AI Governance, reviews incident reports showing that, although the assistant generally performs well, it sometimes responds to ambiguous user prompts by drifting beyond its approved scope, such as by providing speculative financial advice. While no policy violations have occurred so far, leadership identifies an increasing risk that unclear prompts could produce outputs misaligned with regulatory and organizational boundaries. Laura must ensure that the AI system consistently confines its responses to approved domains and stays aligned with user intent, even when prompts are vague or open-ended.
Which type of AI guardrail should Laura implement to address this issue?

• A. Safety Guardrails
• B. Contextual Guardrails
• C. Policy-Based Guardrails
• D. Ethical Guardrails