Skip to main content

AAISM Real Exam Questions

ISACA Advanced in AI Security Management (AAISM)

275 questions available · Page 1 of 28

Updated Exam DumpsVerified AnswersPass Guarantee

Get Complete Exam Dumps
Question 1 Single choice

A vendor switched its chatbot's AI model without due diligence, causing unethical investment advice.

What control BEST prevents this scenario?

  1. A

    Master services agreement

  2. B

    Change management

  3. C

    Shared responsibility model

  4. D

    Data minimization

Show answer and explanation

Correct answer: B

Explanation

AAISM stresses AI-specific change management as essential for vendor-driven or system-driven updates.
Proper change control includes:
.
impact assessments
.
ethical review
.

risk evaluation
.
approval checkpoints
.
rollback plans
An MSA (A) supports contracts but does not manage operational change. Shared responsibility (C) describes roles, not change control. Data minimization (D) reduces exposure but doesn't control model updates.
References:
AAISM Study Guide - AI Change Management
Vendor Model Update Controls.

Question 2 Single choice

Which of the following is BEST for analyzing true positives, true negatives, false positives, and false negatives produced by an AI model?

  1. A

    Hyperparameter tuning

  2. B

    Precision

  3. C

    Confusion matrix

  4. D

    Recall

Show answer and explanation

Correct answer: C

Explanation

A confusion matrix is explicitly defined in AAISM as the framework used to interpret classification performance by listing: true positives true negatives false positives false negatives

Precision (B) and recall (D) are derived metrics that use parts of the matrix but do not show the full picture.
Hyperparameter tuning (A) is unrelated.

References:
AAISM Study Guide - AI Model Evaluation Metrics
Confusion Matrix.

Question 3 Single choice

During the creation of a new large language model (LLM), an organization procured training data from multiple sources.

Which of the following is MOST likely to address the CISO's security and privacy concerns?

  1. A

    Data augmentation

  2. B

    Data minimization

  3. C

    Data classification

  4. D

    Data discovery

Show answer and explanation

Correct answer: B

Explanation

AAISM guidance highlights data minimization as a critical practice for addressing both security and privacy concerns. By ensuring that only the minimum necessary data is collected and retained, the organization reduces the risk of sensitive information being exposed or misused during training. Data augmentation expands data but does not mitigate privacy risk. Classification organizes data but does not limit exposure.
Data discovery helps locate sources but does not directly reduce risks. The control that directly aligns with privacy-by-design principles is data minimization.

References:
AAISM Exam Content Outline - AI Risk Management (Data Privacy and Minimization) AI Security Management Study Guide - Privacy Safeguards in AI Training

Question 4 Single choice

AI developers often find deep learning systems difficult to explain PRIMARILY because:

  1. A

    Knowledge dynamically changes without logs

  2. B

    Neural network architectures include statistical methods not fully understood

  3. C

    Algorithms rely on probability theories

  4. D

    Training data is spread across public domains

Show answer and explanation

Correct answer: B

Explanation

AAISM notes that deep learning systems lack transparency due to complex neural architectures, where internal representations are statistical, nonlinear, and not directly interpretable.
While probability (C) and data sourcing (D) contribute to opacity, the root cause is the intrinsic complexity and opacity of deep neural networks.

References:
AAISM Study Guide - Explainability Challenges in Deep Learning.

Question 5 Single choice

An organization plans to use AI to analyze the shopping patterns of its customers to predict interests and send targeted, customized marketing emails.

Which of the following should be done FIRST?

  1. A

    Obtain customer consent

  2. B

    Train the marketing department

  3. C

    Update the terms of service

  4. D

    Verify customer email addresses

Show answer and explanation

Correct answer: A

Explanation

The first action, before any processing of personal data for AI-driven profiling and targeted communications, is to establish a lawful basis for processing. Under AAISM-aligned privacy governance, explicit and informed consent is prioritized for new or sensitive uses such as interest profiling and targeted marketing. Consent ensures purpose limitation, transparency, and user control prior to model ingestion and campaign activation. Training teams, updating terms of service, or verifying contact details are important, but they do not provide legal authority to process data; therefore, they follow after consent is
obtained.

References:
AI Security Management (AAISM) Body of Knowledge - Privacy Governance and Lawful
Basis
Purpose Limitation and Transparency
Consent Management in AI-enabled Marketing. AAISM
Study Guide - Data Protection Controls for AI Profiling
Consent Capture and Record-Keeping.

Question 6 Single choice

An organization is adopting an agentic AI solution from an external vendor to support its internal IT operations.
To evaluate the security posture of this system, which of the following provides the MOST reliable and independently verifiable evidence of implemented security controls?

  1. A

    Internal red team testing reports

  2. B

    Industry benchmarking peer review

  3. C

    General AI security whitepapers

  4. D

    Third-party audit reports

Show answer and explanation

Correct answer: D

Explanation

Third-party audit reports provide independent assurance that the vendor's stated controls are designed and operating effectively against recognized criteria. Such attestations (e.g., audit/assurance frameworks) are traceable, repeatable, and verifiable, and they support supply-chain risk reviews and contractual assurance. Internal red-team reports are not independent, industry "peer reviews" are not control attestations, and whitepapers are marketing/educational materials without evidence of control operation.

References:
AI Security Management. (AAISM) Body of Knowledge: Third-Party & Supply-Chain
Assurance
Independent Assessment and Audit Evidence
Vendor Risk Management. AAISM Study
Guide: Assurance Artifacts for AI Services
Evaluating External AI Providers.

Question 7 Single choice

To ensure ethical and responsible AI use, which AI usage policy metric is MOST important to monitor?

  1. A

    Number of policy violations

  2. B

    Number of AI projects reviewed for compliance

  3. C

    Frequency of policy consultations by employees

  4. D

    Frequency of policy reviews and updates

Show answer and explanation

Correct answer: C

Explanation

AAISM states the most meaningful policy performance metric is how often employees consult AI policies, which reflects:
.
awareness
.
practical adoption
.
reliance on policy guidance
.
safe decision-making behavior
Violations (A) are lagging indicators. Compliance reviews (B) measure oversight, not behavior. Policy review frequency (D) tracks governance updates, not usage.

References:
AAISM Study Guide - AI Policy Effectiveness Metrics.

Question 8 Single choice

Which of the following is the MOST effective way to mitigate the risk of deepfake attacks?

  1. A

    Relying on human judgment for oversight

  2. B

    Limiting employee access to AI tools

  3. C

    Validating the provenance of the data source

  4. D

    Using a general-purpose large language model (LLM) to detect fraud

Show answer and explanation

Correct answer: C

Explanation

AAISM study content identifies validating the provenance of data sources as the most effective way to counter deepfake risks. Provenance validation ensures that content is authentic, verifiable, and traceable, preventing malicious synthetic media from being trusted as legitimate. Human oversight helps but cannot reliably detect sophisticated fakes. Limiting tool access reduces exposure but does not prevent external attacks. General-purpose LLMs are not optimized for fraud detection. The strongest control is verifying the origin and authenticity of data before acceptance.

References:
AAISM Study Guide - AI Risk Management (Deepfake and Content Integrity Risks) ISACA AI Security Management - Provenance Validation as a Defense

Question 9 Single choice

A post-incident investigation finds that an AI-powered anti-money laundering system inadvertently allowed suspicious transactions because certain risk signals were disabled to reduce false positives.

Which of the following governance failures does this BEST demonstrate?

  1. A

    Lack of sufficient computing resources for the AI system

  2. B

    Insufficient model validation and change control processes

  3. C

    Excessive reliance on external consultants for model design

  4. D

    Absence of metrics and dashboard for analysts

Show answer and explanation

Correct answer: B

Explanation

AAISM requires formal model change governance: documented justification, risk assessment, validation / verification (V&V), approvals, and post-deployment monitoring when altering features, thresholds, or

signals. Disabling risk indicators to reduce false positives without rigorous validation and controlled rollout reflects a failure in model validation and change control, which AAISM treats as a core safeguard against unintended harms and regulatory breaches.

References:
AI Security Management. (AAISM) Body of Knowledge - Model Risk Governance
Change
Management & Approvals
Validation/Verification Requirements. AAISM Study Guide - Control Gates for
Feature/Threshold Changes
Post-Change Monitoring and Backout Criteria.

Question 10 Single choice

An AI application development team has been given access to user information and now must format it to be readable by the AI model.
During which phase of the data life cycle would this MOST likely occur?

  1. A

    Data minimization

  2. B

    Data preparation

  3. C

    Data collection

  4. D

    Data normalization

Show answer and explanation

Correct answer: B

Explanation

According to AAISM's data life-cycle model, data preparation is the phase where raw data is transformed into a model-ready format. The materials describe this phase as including "cleaning, encoding, formatting, feature engineering, and other transformations required for model consumption." This directly matches the scenario where a team formats user information to be readable by an AI model. Data minimization (A) is about reducing data to the minimum necessary for the stated purpose. Data collection (C) focuses on acquiring data from different sources. Data normalization (D) is a specific technique (often a sub-activity within preparation) that adjusts numeric values to a common scale; it is narrower than the broader concept
of preparation. Therefore, the activity described is correctly associated with data preparation, which the AAISM framework clearly positions before training and evaluation.

References:
AI Security Management (AAISM) Study Guide - AI Data Life Cycle
Data Preparation and
Pre-processing.