Isaca AAISM Online Practice Questions and Exam Preparation

Isaca AAISM Online Questions & Answers

• Question 151:

  An organization is commissioning a third-party AI system using sensitive data. Which metric is MOST important to consider?

  A. Accessibility rating
  B. Model response time
  C. Accuracy thresholds
  D. Service availability
  C. Accuracy thresholds

  ---

  AAISM specifies that when AI systems process sensitive or high-impact data (e.g., financial, identity, health), accuracy thresholds become critical risk indicators. Inaccurate predictions can cause harm, regulatory noncompliance, discrimination, or financial loss. Availability (D) is important but secondary to correctness in sensitive decision scenarios. Response time (B) and accessibility ratings (A) do not outweigh the need for accurate, reliable predictions.

  References: AAISM Study Guide - AI Model Risk Metrics; Accuracy Requirements for High-Impact Systems.

• Question 152:

  An AI fraud-detection model frequently flags legitimate transactions. Which activity BEST improves its precision?

  A. Increasing adversarial training
  B. Conducting feature-importance analysis
  C. Reducing the entropy in tokenization
  D. Shortening the training window
  B. Conducting feature-importance analysis

  ---

  AAISM notes that feature-importance analysis helps identify misleading or noise-heavy features contributing to false positives. Adversarial training (A) improves robustness, not precision. Token entropy (C) is irrelevant. Short training windows (D) may worsen accuracy.

  References:

  AAISM Study Guide ?Feature Governanceand; Model Explainability.

• Question 153:

  A financial institution plans to deploy an AI system to provide credit risk assessments for loan applications. Which of the following should be given the HIGHEST priority in the system's design to ensure ethical decision-making and prevent bias?

  A. Regularly update the model with new customer data to improve prediction accuracy.
  B. Integrate a mechanism for customers to appeal decisions directly within the system.
  C. Train the system to provide advisory outputs with final decisions made by human experts.
  D. Restrict the model's decision-making criteria to objective financial metrics only.
  C. Train the system to provide advisory outputs with final decisions made by human experts.

  ---

  In AI governance frameworks, credit scoring is treated as a high-risk application. For such systems, the highest-priority safeguard is human oversight to ensure fairness, accountability, and prevention of bias in automated decisions.

  The AI Security Management (AAISM) domain of AI Governance and Program Management emphasizes that high-impact AI systems require explicit governance structures and human accountability. Human-in-the-loop design ensures that final decisions remain the responsibility of human experts rather than being fully automated. This is particularly critical in financial contexts, where biased outputs can affect individuals' access to credit and create compliance risks.

  Official ISACA AI governance guidance specifies:

  High-risk AI systems must comply with strict requirements, including human oversight, transparency, and fairness.

  The purpose of human oversight is to reduce risks to fundamental rights by ensuring humans can intervene or override an automated decision.

  Bias controls are strengthened by requiring human review processes that can analyze outputs and prevent unfair discrimination.

  Why other options are not the highest priority:

  A. Regular updates improve accuracy but do not guarantee fairness or ethical decision-making. Model drift can introduce new bias if not governed properly.

  B. Appeals mechanisms are important for accountability, but they operate after harm has occurred. Governance frameworks emphasize prevention through human oversight in the decision loop.

  D. Restricting criteria to "objective metrics" is insufficient, as even objective data can contain hidden proxies for protected attributes. Bias mitigation requires monitoring, testing, and human oversight, not only feature restriction.

  An AI governance committee provides cross-functional oversight to align AI strategy, investment, and risk appetite with business goals. It sets policies, prioritizes portfolios, ensures accountability, and integrates compliance, ethics, and security into decision-making. While compliance, ethics, and information protection are essential, governance is the primary mechanism that systematically connects AI initiatives to enterprise objectives.

  References: AI Security Management (AAISM) Body of Knowledge: AI Governance Operating Model-Structures, Roles, and Decision Rights; AAISM Study Guide: Strategic Alignment, Portfolio Oversight, and Accountability Mechanisms.

• Question 154:

  Which of the following is the BEST approach for minimizing risk when integrating acceptable use policies for AI foundation models into business operations?

  A. Limit model usage to predefined scenarios specified by the developer
  B. Rely on the developer's enforcement mechanisms
  C. Establish AI model life cycle policy and procedures
  D. Implement responsible development training and awareness
  C. Establish AI model life cycle policy and procedures

  ---

  The AAISM guidance defines risk minimization for AI deployment as requiring a formalized AI model life cycle policy and associated procedures. This ensures oversight from design to deployment, covering data handling, bias testing, monitoring, retraining, decommissioning, and acceptable use. Limiting usage to developer-defined scenarios or relying on vendor mechanisms transfers responsibility away from the organization and fails to meet governance expectations. Training and awareness support cultural

  alignment but cannot substitute for structured lifecycle controls. Therefore, the establishment of a documented lifecycle policy and procedures is the most comprehensive way to minimize operational, compliance, and ethical risks in integrating foundation models.

  References:

  AAISM Study Guide - AI Governance and Program Management (Model Lifecycle Governance)

  ISACA AI Security Guidance - Policies and Lifecycle Management

• Question 155:

  Which of the following BEST addresses risk associated with hallucinations in AI systems?

  A. Recursive chunking
  B. Automated output validation
  C. Content enrichment
  D. Human oversight
  D. Human oversight

  ---

  AAISM prescribes human-in-the-loop (HITL) controls as the primary safeguard for high-impact generative AI use cases to mitigate hallucination risk. Human oversight ensures critical outputs are reviewed, corrected, and approved before use, with accountability, escalation, and documented decision trails. Automated validators and enrichment help reduce errors but are secondary; recursive chunking is a prompting tactic, not a governance control.

  References: AI Security Management (AAISM) Body of Knowledge: Responsible AI and Human Oversight; Generative AI Risk Controls-Approval Workflows and Human Review; AAISM Study Guide: Hallucination Risk Treatment with HITL and Approval Gates.

• Question 156:

  Which of the following approaches BEST helps to reduce model bias?

  A. Increasing the number of labels per instance
  B. Decreasing the frequency of model updates
  C. Utilizing a more complex model architecture
  D. Ensuring diversity in training data sources
  D. Ensuring diversity in training data sources

  ---

  AAISM frames bias risk primarily as a data problem. The most impactful mitigation is to ensure diversity and representativeness of training data sources, thereby reducing sampling bias and improving fairness across subpopulations. More labels per instance (A) does not correct coverage gaps; reducing update cadence (B) can entrench existing bias; and higher model complexity (C) may overfit or obscure bias without addressing root causes. Diverse, representative datasets-paired with fairness testing-are the recommended first-line control.

  References: AI Security Management (AAISM) Body of Knowledge - Bias Identification and Mitigation; Data Quality and Representativeness. AAISM Study Guide - Fairness Risk Controls; Dataset Curation and Coverage Analysis.

• Question 157:

  A newly deployed AI cybersecurity tool is generating too many false positives. Which metric is MOST relevant to assess whether its tuning should be modified?

  A. Recall
  B. Learning rate
  C. Token embedding variance
  D. Hyperparameter count
  A. Recall

  ---

  False positives relate to recall/precision balance. AAISM emphasizes tuning models by analyzing recall vs. precision trade-offs, adjusting thresholds to reduce false alerts. Learning rate (B) and embedding variance (C) are not primary metrics.

  References:

  AAISM Study Guide ?Performance Metrics for Security ML Models.

• Question 158:

  Which of the following BEST represents a combination of quantitative and qualitative metrics that can be used to comprehensively evaluate AI transparency?

  A. AI system availability and downtime metrics
  B. AI model complexity and accuracy metrics
  C. AI explainability reports and bias metrics
  D. AI ethical impact and user feedback metrics
  D. AI ethical impact and user feedback metrics

  ---

  The AAISM governance framework emphasizes that AI transparency cannot be evaluated using only technical statistics; it requires a combination of quantitative and qualitative metrics. The best pairing is ethical impact assessments (qualitative) with user feedback metrics (quantitative and perception-based). Availability and accuracy metrics measure performance, not transparency. Explainability reports and bias metrics are useful but still technical and limited. Comprehensive evaluation of transparency

  requires consideration of ethical dimensions and stakeholder perspectives, which is achieved through ethical impact analysis and user feedback.

  References:

  AAISM Study Guide - AI Governance and Program Management (Transparency and Accountability)

  ISACA AI Security Management - Measuring Ethical AI Practices

• Question 159:

  An organization is implementing AI agent development across engineering teams. What should AI-specific training focus on?

  A. Prompt injection, agent memory control, insecure tool execution
  B. Dataset bias, explainability, fairness
  C. Output moderation, hallucination handling, policy alignment
  D. API abuse, data leakage, third-party plug-in risk
  A. Prompt injection, agent memory control, insecure tool execution

  ---

  AAISM states that AI agent security training should focus on the unique risks of agentic systems, which include: . prompt injection . memory control and context hijacking . unsafe tool execution (agents triggering unauthorized actions) These risks are specific to autonomous or semi-autonomous AI agents. Bias, fairness (B) and output moderation (C) are important but not the most critical for agent security. API

  abuse and plug-in risk (D) matter but are secondary.

  References: AAISM Study Guide - Agentic AI Security; Prompt Injection and Tool Execution Risks.

• Question 160:

  After implementing a third-party generative AI tool, an organization learns about new regulations related to how organizations use AI. Which of the following would be the BEST justification for the organization to decide not to comply?

  A. The AI tool is widely used within the industry
  B. The AI tool is regularly audited
  C. The risk is within the organization's risk appetite
  D. The cost of noncompliance was not determined
  C. The risk is within the organization's risk appetite

  ---

  The AAISM framework clarifies that compliance decisions must always be tied to an organization's risk appetite and tolerance. When new regulations emerge, management may choose not to comply if the associated risk remains within the documented and approved risk appetite, provided that accountability is established and governance structures support this decision. Other options such as widespread industry use, third-party audits, or lack of cost assessment do not justify noncompliance under the governance principles. The risk appetite framework is the only recognized justification under AI governance principles.

  References: AAISM Study Guide - AI Governance and Program Management ISACA AI Risk Guidance - Risk Appetite and Compliance Decisions