Isaca AAISM Online Practice Questions and Exam Preparation

Isaca AAISM Online Questions & Answers

• Question 141:

  An organization decides to contract a vendor to implement a new set of AI libraries. Which of the following is MOST important to address in the master service agreement to protect data used during the AI training process?

  A. Data pseudonymization
  B. Continuous data monitoring
  C. Independent certification
  D. Right to audit
  D. Right to audit

  ---

  AAISM emphasizes that the right to audit is the most critical contractual safeguard when outsourcing AI services. This allows the contracting organization to independently verify that the vendor is applying appropriate protections to training data, meeting compliance obligations, and upholding privacy requirements. Pseudonymization is a technical method, monitoring is operational, and certifications provide external assurance, but none give the direct, enforceable oversight that audit rights provide. In vendor

  contracts, the right to audit is the primary safeguard for data protection and governance.

  References:

  AAISM Study Guide - AI Governance and Program Management (Third-Party Contracts and Audit Rights)

  ISACA AI Security Management - Vendor Governance Controls

• Question 142:

  Secure aggregation enhances federated learning security by:

  A. Encrypting individual model updates so only the server can access them
  B. Applying differential privacy to training data
  C. Ensuring client contributions remain confidential even if the server is compromised
  D. Processing client updates in isolation
  C. Ensuring client contributions remain confidential even if the server is compromised

  ---

  AAISM explains that secure aggregation ensures the server only sees aggregated model updates-not individual client contributions-so privacy is preserved even if the server is breached. Encryption (A) is semi-correct but still allows the server to decrypt. Differential privacy (B) is separate. Isolation (D) does not guarantee confidentiality.

  References: AAISM Study Guide - Federated Learning Security; Secure Aggregation.

• Question 143:

  A vendor switched its chatbot's AI model without due diligence, causing unethical investment advice. What control BEST prevents this scenario?

  A. Master services agreement
  B. Change management
  C. Shared responsibility model
  D. Data minimization
  B. Change management

  ---

  AAISM stresses AI-specific change management as essential for vendor-driven or system-driven updates. Proper change control includes: . impact assessments . ethical review . risk evaluation . approval checkpoints . rollback plans An MSA (A) supports contracts but does not manage operational change. Shared responsibility (C) describes roles, not change control. Data minimization (D) reduces exposure but doesn't control model updates.

  References: AAISM Study Guide - AI Change Management; Vendor Model Update Controls.

• Question 144:

  Which of the following is the MOST effective defense against cyberattacks that alter input data to avoid detection by the model?

  A. Conducting periodic monitoring activities on the model's decisions
  B. Enhancing model robustness through adversarial training
  C. Implementing restricted access to the model's internal parameters
  D. Applying differential privacy controls on training datasets
  B. Enhancing model robustness through adversarial training

  ---

  Evasion attacks manipulate inputs to induce misclassification while leaving the model unchanged. AAISM prescribes adversarial robustness controls, with adversarial training as a primary measure: incorporate adversarially perturbed examples into training/validation to harden decision boundaries and improve resilience across threat models (e.g., Lp-bounded perturbations). Monitoring (A) is detective, not preventive. Restricting parameter access (C) protects confidentiality but does not mitigate input-space

  attacks. Differential privacy (D) addresses training data leakage, not robustness to adversarial inputs.

  References:AI Security Management. (AAISM) Body of Knowledge: Adversarial ML-Evasion vs. Poisoning; Robustness and Resilience Controls; Adversarial Training.AAISM Study Guide: Model Hardening Techniques; Evaluation of Robust Accuracy; Security Testing with Adversarial Examples.

• Question 145:

  What is the GREATEST concern when a vendor enables generative AI features for an organization's critical system?

  A. Security monitoring and alerting
  B. Bias and ethical practices
  C. Proposed regulatory enhancements
  D. Access to the model
  D. Access to the model

  ---

  AAISM highlights that uncontrolled access to generative AI in critical systems introduces the highest level of risk, as such models can: expose sensitive data execute unintended actions be manipulated through injected prompts cause operational instability Monitoring (A) is important but not the core risk. Bias (B) is significant but secondary in critical systems. Regulatory enhancements (C) are indirect.

  References: AAISM Study Guide - Generative AI Operational Risk; Access Control Priority.

• Question 146:

  An organization using an AI model for financial forecasting identifies inaccuracies caused by missing data. Which of the following is the MOST effective data cleaning technique to improve model performance?

  A. Increasing the frequency of model retraining with the existing data set
  B. Applying statistical methods to address missing data and reduce bias
  C. Deleting outlier data points to prevent unusual values impacting the model
  D. Tuning model hyperparameters to increase performance and accuracy
  B. Applying statistical methods to address missing data and reduce bias

  ---

  The AAISM study content emphasizes that data quality management is a central pillar of AI risk reduction. Missing data introduces bias and undermines predictive accuracy if not addressed systematically. The most effective remediation is to apply statistical imputation and related methods to fill in or adjust for missing values in a way that minimizes bias and preserves data integrity. Retraining on flawed data does not solve the underlying issue. Deleting outliers may harm model robustness, and

  hyperparameter tuning optimizes model mechanics but cannot resolve missing information. Therefore, the proper corrective technique for missing data is the application of statistical methods to reduce bias.

  References:

  AAISM Study Guide - AI Risk Management (Data Integrity and Quality Controls)

  ISACA AI Governance Guidance - Data Preparation and Bias Mitigation

• Question 147:

  Which of the following will BEST reduce data bias in machine learning (ML) algorithms?

  A. Adopting a more simplified model
  B. Utilizing unstructured data sets
  C. Diversifying the model training data
  D. Securing the model training data
  C. Diversifying the model training data

  ---

  AAISM guidance clearly states that the most effective way to mitigate data bias is through diverse training data that fairly represents all relevant populations, scenarios, and contexts. Simplified models may reduce complexity but do not remove bias. Unstructured data sets may introduce new errors without addressing fairness. Securing training data protects confidentiality and integrity but does not resolve representational imbalance. Therefore, the best practice for reducing bias in ML is diversification of training datasets.

  References: AAISM Study Guide - AI Risk Management (Bias and Fairness in AI) ISACA AI Security Management - Data Diversity and Representation Controls

• Question 148:

  A post-incident investigation finds that an AI-powered anti-money laundering system inadvertently allowed suspicious transactions because certain risk signals were disabled to reduce false positives. Which of the following governance failures does this BEST demonstrate?

  A. Lack of sufficient computing resources for the AI system
  B. Excessive reliance on external consultants for model design
  C. Absence of metrics and dashboards for analysts Insufficient
  D. model validation and change control processes
  D. model validation and change control processes

  ---

  AAISM states that AI risk signals, thresholds, and model logic must be governed through strict validation and change control processes. Disabling key risk indicators without formal review or testing directly reflects a failure in: AI model validation Change management Governance oversight

  This aligns precisely with option D.

  Lack of dashboards (C) affects monitoring but does not explain disabled risk signals. Computing resources (A) would not cause intentional disabling. Reliance on consultants (B) is not connected to improper internal model changes.

  References: AAISM Study Guide - AI Governance; Model Validation and Change Control Failures.

• Question 149:

  Which of the following would BEST help an organization align its AI initiatives with business objectives?

  A. Complying with applicable AI-related regulations
  B. Ensuring ethical use of AI technologies in projects
  C. Establishing an AI governance committee Protecting
  D. enterprise information used by AI projects
  C. Establishing an AI governance committee Protecting

  ---

  An AI governance committee provides cross-functional oversight to align AI strategy, investment, and risk appetite with business goals. It sets policies, prioritizes portfolios, ensures accountability, and integrates compliance, ethics, and security into decision-making. While compliance, ethics, and information protection are essential, governance is the primary mechanism that systematically connects AI initiatives to enterprise objectives.

  References: AI Security Management (AAISM) Body of Knowledge: AI Governance Operating Model- Structures, Roles, and Decision Rights; AAISM Study Guide: Strategic Alignment, Portfolio Oversight, and Accountability Mechanisms.

• Question 150:

  Which of the following is the MAIN objective of the operational phase of AI life cycle management?

  A. Optimize the model's algorithms
  B. Align the model to business needs
  C. Monitor model performance
  D. Obtain end-user feedback
  C. Monitor model performance

  ---

  AAISM identifies the operational phase as the stage where the AI system is actively deployed and requires continuous monitoring of performance, drift, security, and reliability. Business alignment (B) belongs to planning and design. Optimization (A) and user feedback (D) are part of development or improvement cycles, not primary operational objectives.

  References: AAISM Study Guide - AI Life Cycle Management; Operational Monitoring Requirements.