Isaca AAISM Online Practice Questions and Exam Preparation

Isaca AAISM Online Questions & Answers

• Question 191:

  Which of the following AI data management techniques involves creating validation and test data?

  A. Training
  B. Annotating
  C. Splitting
  D. Learning
  C. Splitting

  ---

  Data splitting partitions a labeled dataset into training, validation, and test subsets to enable unbiased model tuning and evaluation. Training (A) consumes the training split; annotating (B) adds labels; learning (D) is a general term for model optimization, not a data management step.

  References: AI Security Management (AAISM) Body of Knowledge - Data Lifecycle Controls; Dataset Partitioning for Validation and Testing. AAISM Study Guide - Train/Validation/Test Splits and Evaluation Integrity.

• Question 192:

  A viral video shows a blurry person making claims about a product safety issue. The video has random low-quality sections. This MOST likely represents what threat?

  A. Hallucinations
  B. Model drift
  C. Data poisoning
  D. Deepfake
  D. Deepfake

  ---

  AAISM defines deepfakes as manipulated media where individuals appear in synthetic or altered video/audio. Indicators include:

  blurred or inconsistent facial rendering

  mismatched frames

  low-quality or distorted transitions

  These characteristics match the scenario provided.

  Hallucinations (A) relate to model outputs, not video manipulation. Drift (B) affects model performance.

  Poisoning (C) affects training data, not video content.

  References: AAISM Study Guide - AI-Generated Media Threats; Deepfake Identification.

• Question 193:

  Which of the following should be the PRIMARY consideration for an organization concerned about liabilities associated with unforeseen behavior from agentic AI systems?

  A. Model dependencies
  B. Approved base models
  C. Accountability model
  D. Acceptable risk level
  C. Accountability model

  ---

  AAISM governance guidance stresses that when dealing with agentic AI systems capable of autonomous decision-making, the primary consideration is accountability. Without clear accountability structures, unforeseen or harmful outcomes may result in unmitigated liability for the organization. While dependencies, base models, and defined risk levels are important, they do not directly address who is responsible when systems act unpredictably. The key governance safeguard is the implementation of an

  accountability model that ensures liability and oversight are properly assigned.

  References:

  AAISM Exam Content Outline - AI Governance and Program Management (Accountability and Liability Management)

  AI Security Management Study Guide - Responsible Oversight of Agentic AI

• Question 194:

  Which of the following types of testing can MOST effectively mitigate prompt hacking?

  A. Load
  B. Input
  C. Regression
  D. Adversarial
  D. Adversarial

  ---

  Prompt hacking manipulates large language models by injecting adversarial instructions into inputs to bypass or override safeguards. The AAISM framework identifies adversarial testing as the most effective way to simulate such manipulative attempts, expose vulnerabilities, and improve the resilience of controls. Load testing evaluates performance, input testing checks format validation, and regression testing validates functionality after changes. None of these directly address the manipulation of natural

  language inputs. Adversarial testing is therefore the correct approach to mitigate prompt hacking risks.

  References:

  AAISM Exam Content Outline - AI Risk Management (Testing and Assurance Practices)

  AI Security Management Study Guide - Adversarial Testing Against Prompt Manipulation

• Question 195:

  When preparing for an AI incident, which of the following should be done FIRST?

  A. Implement a communication channel to report AI incidents
  B. Establish a cross-functional incident response team with AI knowledge
  C. Establish recovery processes for AI system models and data sets
  D. Create containment and eradication procedures for AI-related incidents
  B. Establish a cross-functional incident response team with AI knowledge

  ---

  AAISM incident response guidance states the first foundational step is forming a cross-functional AI-aware incident response team, including model developers, data stewards, security leads, and compliance officers. Without the team established, recovery (C), containment (D), or communication channels (A) cannot be effectively designed or executed.

  References: AAISM Study Guide - AI Incident Response; Establishing Cross-Functional Teams.

• Question 196:

  AI developers often find it difficult to explain the processes inside deep learning systems PRIMARILY because:

  A. Training data input for learning is spread throughout the public domain and continues to change
  B. Generated knowledge dynamically changes in memory without being tracked by change history logs
  C. Applied algorithms are based on probability theories to improve system performance
  D. Neural network architectures can include statistical methods that are not fully understood
  D. Neural network architectures can include statistical methods that are not fully understood

  ---

  Deep learning models learn high-dimensional, non-linear representations through layered parameterization that resists simple causal narratives. The internal mechanisms (e.g., distributed feature representations and complex statistical transformations) are difficult to map to human-interpretable rules, making explanation challenging. This is the primary reason for explainability difficulty in deep learning. Option A addresses data origin/volatility, not explainability. Option B mischaracterizes model behavior as mutable "knowledge" without logs. Option C notes probabilistic foundations but that alone does not make systems inexplicable.

  References: AI Security Management (AAISM) Body of Knowledge: "Explainability and Interpretability-Complexity in Deep Learning," "Model Behavior, Surrogates, and Post-hoc Explanations"; AAISM Study Guide: "Interpreting High-Dimensional Representations," "Limits of Transparency in Neural Architectures."

• Question 197:

  When deriving statistical information from AI systems, which source of risk is MOST important to address?

  A. Presence of hallucinations
  B. Incomplete outputs
  C. Lack of data normalization
  D. Systemic bias in data sets
  D. Systemic bias in data sets

  ---

  AAISM emphasizes systemic or structural bias as a high-impact risk because biased data leads directly to discriminatory insights or decisions when used for analytics or reporting. This risk affects fairness, compliance, and organizational reputation. Hallucinations (A) relate more to generative AI. Incomplete outputs (B) affect accuracy but not structural fairness. Lack of normalization (C) affects performance but is not the dominant risk.

  References: AAISM Study Guide - AI Bias, Fairness, and Ethical Risk.

• Question 198:

  An automotive manufacturer uses AI-enabled sensors on machinery to monitor variables such as vibration, temperature, and pressure. Which of the following BEST demonstrates how this approach contributes to operational resilience?

  A. Scheduling repairs for critical equipment based on real-time condition monitoring
  B. Performing regular maintenance based on manufacturer recommendations
  C. Conducting monthly manual reviews of maintenance schedules
  D. Automating equipment repairs without any human intervention
  A. Scheduling repairs for critical equipment based on real-time condition monitoring

  ---

  AAISM highlights that AI-enabled predictive maintenance improves operational resilience by using real-time sensor monitoring to schedule repairs based on actual conditions rather than fixed schedules. This prevents unexpected breakdowns, reduces downtime, and ensures continuity of operations. Regular maintenance based on recommendations is static and may not reflect real conditions. Manual reviews are slow and inefficient. Full automation of repairs without human oversight is not realistic or safe in

  critical manufacturing. The approach that best demonstrates resilience is real-time condition-based repair scheduling.

  References:

  AAISM Study Guide - AI Risk Management (Operational Resilience and Predictive Maintenance)

  ISACA AI Security Management - AI for Critical Infrastructure Reliability

• Question 199:

  A company deploys a generative AI chatbot to assist customers. Which metric is MOST important to measure output integrity?

  A. Token-generation speed
  B. Percentage of hallucination-free responses
  C. Training epoch count
  D. Average embedding dimensionality
  B. Percentage of hallucination-free responses

  ---

  Output integrity in AAISM frameworks is measured by tracking hallucination rates, policy violations, factual errors, and unsafe responses. Speed (A), training epochs (C), and embedding size (D) do not measure integrity.

  References:

  AAISM Study Guide ?Output Integrityand; Hallucination Metrics.

• Question 200:

  Which of the following BEST describes the role of model cards in AI solutions?

  A. They are primarily used to visualize the performance of AI models
  B. They are used to automatically fine-tune AI models by adjusting hyperparameters based on user feedback
  C. They provide a standardized way to document the training data and AI model use cases
  D. They help developers create synthetic data and train AI models
  C. They provide a standardized way to document the training data and AI model use cases

  ---

  AAISM positions model cards as standardized documentation artifacts that record intended use and out-of-scope use, training/evaluation data characteristics, performance metrics across groups, limitations/risks, and governance controls/owners. Their purpose is transparency and assurance, not automated tuning or synthetic data generation. Visualization (A) may appear within a card, but the core role is structured documentation for governance, risk, and compliance.

  References: AI Security Management. (AAISM) Body of Knowledge - Documentation and Transparency Artifacts; Model Cards for Governance, Risk, and Assurance; Intended Use, Limitations, and Performance Disclosure.