Isaca AAISM Online Practice Questions and Exam Preparation

Isaca AAISM Online Questions & Answers

• Question 121:

  Which of the following would BEST help mitigate vulnerabilities associated with hidden triggers in generative AI models?

  A. Regularly retraining the model using a diverse data set
  B. Applying differential privacy and masking sensitive patterns in the training data
  C. Incorporating adversarial training to expose and neutralize potential triggers
  D. Monitoring model outputs and suspicious patterns to detect trigger activations
  C. Incorporating adversarial training to expose and neutralize potential triggers

  ---

  Hidden triggers are adversarial backdoors planted in AI models, activated only by specific inputs. The AAISM materials specify that the best mitigation is to use adversarial training, which deliberately exposes the model to potential trigger inputs during training so it can learn to neutralize or resist them. Retraining with diverse data reduces bias but does not address hidden triggers. Differential privacy is focused on privacy preservation, not adversarial resilience. Monitoring outputs can help with detection but is

  reactive rather than preventative. The proactive solution highlighted in the study guide is adversarial training.

  References:

  AAISM Exam Content Outline - AI Risk Management (Backdoors and Hidden Triggers)

  AI Security Management Study Guide - Adversarial Training as a Mitigation Control

• Question 122:

  Which of the following is the BEST mitigation control for membership inference attacks on AI systems?

  A. Model ensemble techniques
  B. AI threat modeling
  C. Differential privacy
  D. Cybersecurity-oriented red teaming
  C. Differential privacy

  ---

  Membership inference attacks attempt to determine whether a particular data point was part of a model's training set, which risks violating privacy. The AAISM study guide highlights differential privacy as the most effective mitigation because it introduces mathematical noise that obscures individual contributions without significantly degrading model performance. Ensemble methods improve robustness but do not specifically protect privacy. Threat modeling and red teaming help identify risks but are not direct

  controls. The explicit mitigation control aligned with privacy preservation for membership inference is differential privacy.

  References:

  AAISM Study Guide - AI Technologies and Controls (Privacy-Preserving Techniques) ISACA AI Security Management - Membership Inference Mitigations

• Question 123:

  Which of the following is the BEST control for preventing deepfakes?

  A. Output provenance verification
  B. Regular AI risk assessment
  C. AI governance policies
  D. System input validation
  A. Output provenance verification

  ---

  Output provenance verification (e.g., robust watermarking, cryptographic signing, content credentials, and chain-of-custody attestations) is the primary preventive and detective control to combat deepfakes at scale. It enables receivers and downstream systems to verify that media originates from trusted sources and has not been tampered with. While risk assessments (Option B) and governance policies (Option C) set expectations, they do not technically prevent forged media. Input validation (Option D)

  does not address media authenticity once generated or received.

  References:

  AAISM Body of Knowledge: Content Authenticity, Watermarking, and Provenance; Trustworthy AI Outputs and Media Integrity Controls.

  AAISM Study Guide: Mitigations for Synthetic Media Risks; Watermark/Signature Verification Pipelines; Content Credentials in Enterprise Controls.

• Question 124:

  Which of the following BEST mitigates the risk of membership inference attacks in deployed AI models?

  A. Limiting the model's output confidence scores
  B. Increasing the transparency of model architecture
  C. Providing more detailed explanations to users
  D. Replacing supervised learning with unsupervised learning
  A. Limiting the model's output confidence scores

  ---

  AAISM highlights that membership inference exploits confidence discrepancies between training and non-training samples. Restricting confidence scores reduces signal exposure, weakening the attack surface. Transparency (B) may worsen risk. Explanations (C) increase leakage potential. Changing learning paradigms (D) does not mitigate inference attacks.

  References:

  AAISM Study Guide ?Privacy Attacks; Membership Inference Mitigations.

• Question 125:

  Which of the following reviews MUST be conducted as part of an AI impact assessment?

  A. Testing, evaluation, validation, and verification Evaluation of model
  B. reproducibility
  C. Security control self-assessment (CSA)
  D. Identification of environmental and societal consequences
  D. Identification of environmental and societal consequences

  ---

  The AAISM material frames an AI impact assessment as broader than a technical model review. It emphasizes that governance of AI includes assessing societal, environmental, and human-rights impacts in addition to organizational risk. The official guidance notes that high-level impact assessments must explicitly consider "potential consequences for individuals, communities, and the environment" as part of responsible AI governance. Activities such as testing/validation (A) and reproducibility (B) are critical in the development lifecycle but are not, by themselves, sufficient to constitute an impact assessment. A CSA (C) is focused on security controls, which is narrower than overall impact. The mandatory element that differentiates an AI impact assessment is the assessment of environmental and societal consequences, making option D the correct answer in alignment with governance expectations.

  References: AI Security Management (AAISM) Study Guide - AI Governance and Impact Assessments; Responsible and Trustworthy AI Section.

• Question 126:

  When using AI as part of incident response, which of the following BEST ensures the automation aligns with regulatory and governance obligations?

  A. Use deep learning models to autonomously classify all incidents
  B. Train the AI incident response platform to mirror legacy response workflows and log containment
  C. Apply anomaly detection models to filter incoming threats and automate containment
  D. Implement a tiered automation strategy where severity ratings inform the need for human oversight
  D. Implement a tiered automation strategy where severity ratings inform the need for human oversight

  ---

  AAISM prescribes risk-based, human-in-the-loop orchestration for safety-critical or regulated actions. A tiered automation strategy that gates autonomy by incident severity, data sensitivity, and regulatory requirements ensures accountability, auditability, and proportionality, satisfying governance obligations. Full autonomy (A) risks non-compliance; simply mirroring legacy workflows (B) may not meet current obligations; broad auto-containment (C) lacks necessary oversight controls.

  References: AI Security Management (AAISM) Body of Knowledge - Governance of AI-Driven Security Automation; Human Oversight and Escalation; Risk-Based Orchestration. AAISM Study Guide - Incident Response with AI: Controls, Approvals, and Auditability.

• Question 127:

  A marketing recommendation AI begins producing culturally insensitive suggestions. What is the FIRST corrective action?

  A. Conduct a data-source representativeness review
  B. Retrain the model with synthetic data
  C. Add content-filtering rules
  D. Increase inference-time sampling diversity
  A. Conduct a data-source representativeness review

  ---

  AAISM emphasizes that bias issues first require understanding whether training data lacks diversity for cultural contexts. Retraining (B) comes after root cause analysis. Filtering (C) is a compensating control. Sampling (D) does not address bias.

  References:

  AAISM Study Guide ?Bias Identification; Data Representativeness Checks.

• Question 128:

  Which of the following controls BEST mitigates the inherent limitations of generative AI models?

  A. Ensuring human oversight
  B. Adopting AI-specific regulations
  C. Classifying and labeling AI systems
  D. Reverse engineering the models
  A. Ensuring human oversight

  ---

  The AAISM governance framework emphasizes that the inherent limitations of generative AI-including hallucinations, bias, and unpredictability-are best mitigated by human oversight. Human-in-the-loop review ensures that outputs are validated before being used in sensitive or high-risk contexts. Regulatory adoption, system classification, and reverse engineering all play supporting roles but do not directly safeguard against the model's inherent unpredictability. Governance best practices highlight human

  oversight as the critical safeguard.

  References:

  AAISM Exam Content Outline - AI Governance and Program Management (Human Oversight and Accountability)

  AI Security Management Study Guide - Mitigating Generative AI Limitations

• Question 129:

  Which of the following would BEST protect trade secrets related to AI technologies during their life cycle?

  A. Patenting AI algorithms along with data sets
  B. Enforcing trademark rights in AI systems
  C. Introducing watermarks when generating AI output
  D. Restricting access to sensitive data
  D. Restricting access to sensitive data

  ---

  Restricting access to sensitive data and artifacts (e.g., training data, feature stores, model weights, prompts, system designs) using least-privilege, segregation, encryption, and monitoring is the most effective way to protect trade secrets throughout the AI lifecycle. Patents require public disclosure, trademarks protect branding (not secrets), and output watermarks help provenance/abuse deterrence but do not secure underlying proprietary know-how.

  References: AI Security Management (AAISM) Body of Knowledge: Information Protection for AI-Access Control, Segmentation, and Secrets Management; AAISM Study Guide: Lifecycle Security of AI Artifacts and Trade-Secret Safeguards.

• Question 130:

  A retail organization implements an AI-driven recommendation system that utilizes customer purchase history. Which of the following is the BEST way for the organization to ensure privacy and comply with regulatory standards?

  A. Conducting quarterly retraining of the AI model to maintain the accuracy of recommendations
  B. Maintaining a register of legal and regulatory requirements for privacy
  C. Establishing a governance committee to oversee AI privacy practices
  D. Storing customer data indefinitely to ensure the AI model has a complete history
  B. Maintaining a register of legal and regulatory requirements for privacy

  ---

  According to the AI Security Management. (AAISM) study framework, compliance with privacy and regulatory standards must begin with a formalized process of identifying, documenting, and maintaining applicable obligations. The guidance explicitly notes that organizations should maintain a comprehensive register of legal and regulatory requirements to ensure accountability and alignment with privacy laws. This register serves as the foundation for all governance, risk, and control practices surrounding AI

  systems that handle personal data.

  Maintaining such a register ensures that the recommendation system operates under the principles of privacy by design and privacy by default. It allows decision-makers and auditors to trace every AI data processing activity back to relevant compliance obligations, thereby demonstrating adherence to laws such as GDPR, CCPA, or other jurisdictional mandates. Other measures listed in the options contribute to good practice but do not achieve the same direct compliance outcome. Retraining models

  improves technical accuracy but does not address legal obligations. Oversight committees are valuable but require the documented register as a baseline to oversee effectively. Indefinite storage of customer data contradicts regulatory requirements, particularly the principle of data minimization and storage limitation.

  AAISM Domain Alignment:

  This requirement falls under Domain 1 - AI Governance and Program Management, which emphasizes organizational accountability, policy creation, and maintaining compliance documentation as part of a structured governance program.

  References from AAISM and ISACA materials: AAISM Exam Content Outline - Domain 1: AI Governance and Program Management AI Security Management Study Guide - Privacy and Regulatory Compliance Controls ISACA AI Governance Guidance - Maintaining Registers of Applicable Legal Requirements