ISO/IEC 42001 Foundation

Ten sample exam questions

One per competency domain, exactly as they appear in the simulator.

1. Domain 1: Fundamental principles and concepts of an AIMS

   ISO/IEC 42001 is published under a designation that names two organizations. What does the prefix ISO/IEC tell the reader?

   1. That it was first issued by IEC, and later adopted by ISO through a vote of its national members.
   2. That it ranks above a standard issued by ISO alone, and therefore takes precedence in case of conflict.
   3. That it was developed jointly by ISO and IEC, in a field of interest to both organizations.
   4. That it is limited to electrotechnical equipment, and that IEC certifies the organizations applying it.

2. Domain 2: Artificial intelligence management system

   ISO/IEC 42001 uses the same clause 4 to clause 10 arrangement as ISO/IEC 27001 and ISO 9001. What explains this shared arrangement?

   1. A harmonized structure agreed for management system standards fixes the clause titles, the clause sequence and much of the common text.
   2. A conformity assessment scheme run by the accreditation bodies fixes the clause titles, the audit duration and the wording of certificates.
   3. A drafting rule issued by each technical committee fixes the clause titles, the number of requirements and the vocabulary of its sector.
   4. A licensing condition imposed on the national member bodies fixes the clause titles, the translation policy and the price of each standard.

3. Domain 1: Fundamental principles and concepts of an AIMS

   ISO is an independent, non-governmental organization made up of national standards bodies. How is its work mainly financed?

   1. Through subscriptions paid by its member bodies, plus the revenue obtained from selling standards and publications.
   2. Through an annual levy on manufacturers, plus fees charged to the organizations that hold certificates and licences.
   3. Through direct grants from the United Nations, plus contributions made by national governments and their ministries.
   4. Through a share of the customs duties collected on traded goods, plus penalties imposed on importers and distributors.

4. Domain 2: Artificial intelligence management system

   An organization certified to ISO/IEC 27001 decides to implement ISO/IEC 42001. What practical advantage does the harmonized structure give it?

   1. Its risk criteria, its statutory obligations and its certification scope transfer automatically from the existing certificate to the new one.
   2. Its AI objectives, its security objectives and its quality objectives merge into one objective that satisfies each set of requirements.
   3. Its management review, its internal audit process and its documented information can be combined into one integrated set of arrangements.
   4. Its existing controls, its existing policies and its existing procedures count as sufficient evidence of conformity with the new standard.

5. Domain 1: Fundamental principles and concepts of an AIMS

   An organization implementing an AIMS wants an agreed vocabulary, so that terms such as AI system, training data and inference are used consistently. Which standard serves that purpose?

   1. ISO/IEC 38507, which addresses the governance implications of the use and the oversight of artificial intelligence in an organization.
   2. ISO/IEC 22989, which establishes the terminology and the concepts used across the artificial intelligence standards.
   3. ISO/IEC 23894, which gives guidance on managing the risk of developing and operating artificial intelligence.
   4. ISO/IEC 42006, which sets requirements for the bodies auditing and certifying an AI management system.

6. Domain 2: Artificial intelligence management system

   How does ISO/IEC 42001 describe an artificial intelligence management system?

   1. A software platform of an organization used to monitor model accuracy, training data quality and the drift of models in production.
   2. A set of interrelated elements of an organization used to establish AI policies, AI objectives and the processes to achieve those objectives.
   3. A register of an organization used to record the AI use cases, the AI suppliers and the residual risks accepted by top management.
   4. A standing committee of an organization used to approve the AI projects, the AI budgets and the release of models into the production environment.

7. Domain 1: Fundamental principles and concepts of an AIMS

   A client asks whether its organization can obtain a certificate against ISO/IEC 23894 or ISO/IEC 38507. What is the correct answer?

   1. Both may be certified, since any published International Standard can serve as certification criteria.
   2. ISO/IEC 23894 alone may be certified, since a risk management standard states auditable requirements.
   3. Governance duties are certifiable, so a certificate against ISO/IEC 38507 can indeed be issued.
   4. Neither of them is certifiable, since both are guidance documents rather than requirement standards.

8. Domain 2: Artificial intelligence management system

   An organization certified to ISO/IEC 27001 asks what an AI management system adds to what it already runs. What is the most accurate answer?

   1. It replaces information security governance with model governance, algorithm testing and the certification of data scientists and of data engineers.
   2. It narrows the existing scope to the systems that use machine learning, deep learning and the neural networks trained on personal data and on public data.
   3. It transfers accountability for AI outcomes to the supplier, the integrator and the cloud provider that hosts the models and the training data.
   4. It extends risk thinking beyond information security to fairness, transparency and the impact that AI systems have on individuals and on society.

9. Domain 1: Fundamental principles and concepts of an AIMS

   The board of a bank wants to understand what adopting artificial intelligence means for its own accountability, before any management system is built. Which standard is addressed to that audience?

   1. ISO/IEC 38507, which sets out the governance implications of the use of artificial intelligence.
   2. ISO/IEC 22989, which fixes the terminology of artificial intelligence for the whole family of standards.
   3. ISO/IEC 23894, which gives guidance on the management of risk related to artificial intelligence.
   4. ISO/IEC 42001, which states the requirements for an artificial intelligence management system.

10. Domain 2: Artificial intelligence management system

    According to clause 4.1 of ISO/IEC 42001, what must the organization determine?

    1. The external and internal issues that are relevant to its purpose and that affect its ability to achieve the intended results of its AI management system.
    2. The inventory of AI systems and AI components that are in operation and that are planned for release in the next financial year.
    3. The legal and contractual obligations that apply to its AI systems and that are accepted by its top management in a signed statement.
    4. The technical and financial resources that are already available for the AI projects and that are approved by the budget holder for the coming financial period.

Answer these same ten questions in the simulator and see the explanation of every option, including the wrong ones. It opens with no sign-up →

About the official exam: its format, duration and number of questions are set by the certification body and may change, so confirm them in its documentation before you sit it. This material trains the standard, not one body's exam, so it is just as useful if you certify elsewhere.