Isaca AAISM Online Practice Questions and Exam Preparation

Isaca AAISM Online Questions & Answers

• Question 201:

  The PRIMARY purpose of adopting and implementing AI architecture within an organizational AI program is to:

  A. Deploy fast and cost-efficient AI systems
  B. Provide a basis for identifying threats and vulnerabilities
  C. Align AI system components with business goals
  D. Ensure powerful and scalable AI systems
  C. Align AI system components with business goals

  ---

  AAISM describes AI architecture as a strategic alignment framework, ensuring AI systems, data pipelines, governance processes, and capabilities match organizational business goals and regulatory requirements. While threat identification (B) and scalability (D) are advantages, the primary purpose is business alignment. Option A is not a core architectural objective.

  References: AAISM Study Guide - AI Architecture and Business Alignment.

• Question 202:

  Which of the following is the PRIMARY benefit of maintaining complete feature-level lineage in AI datasets?

  A. Reduced storage requirements
  B. Stronger adversarial robustness
  C. Improved auditability and accountability
  D. Faster model-training times
  C. Improved auditability and accountability

  ---

  AAISM stresses that data lineage--especially feature-level--supports transparent audits, regulatory compliance, and fault diagnosis. Robustness (B) benefits indirectly but is not primary. Storage (A) and training speed (D) are unaffected.

  References:

  AAISM Study Guide ?Data Governance; Lineage, Traceabilityand; Audit Evidence.

• Question 203:

  A preliminary risk assessment of a SaaS-based large language model (LLM) business support system has identified prompt injection, data poisoning, and model exfiltration as material threats. Which of the following is the BEST approach to ensure risks are treated consistently?

  A. Implementing an AI threat control matrix that maps threats to specific controls and assurance activities
  B. Applying control baselines from a recognized industry standard to AI components
  C. Relying on vendor independent audit reports and service level agreements (SLAs) as evidence of AI risk coverage
  D. Focusing resources on post-deployment red teaming and deferring control selection until post go-live feedback is received
  A. Implementing an AI threat control matrix that maps threats to specific controls and assurance activities

  ---

  AAISM prescribes building and maintaining an AI Threat-Control Matrix to ensure consistent, repeatable risk treatment. The matrix traces each material threat (e.g., prompt injection, poisoning, exfiltration) to named controls, test/evidence procedures, and assurance owners across the lifecycle. Baselines and vendor attestations can support assurance but are insufficient alone; deferring control selection until after deployment conflicts with AAISM's proactive treatment principle.

  References: AI Security Management (AAISM) Body of Knowledge - AI Risk Treatment Planning; Threat-Control Traceability; Assurance and Evidence Management for AI Systems.

• Question 204:

  Which of the following approaches BEST helps reduce model bias?

  A. Ensuring diversity in training data sources
  B. Utilizing a more complex architecture
  C. Decreasing frequency of model updates
  D. Increasing the number of labels per instance
  A. Ensuring diversity in training data sources

  ---

  AAISM states that the strongest control against bias is ensuring representative, diverse, and inclusive training data. This directly minimizes skew and systemic underrepresentation.

  Complex architectures (B) do not reduce bias and may exacerbate it. Reducing updates (C) increases drift. More labels (D) improves supervision quality but does not inherently solve bias if the data itself is skewed.

  References: AAISM Study Guide - Bias Mitigation and Data Quality Requirements.

• Question 205:

  A programmer suspects an AI system is inferring sensitive user information. What is the BEST action?

  A. Inform the governance panel
  B. Suggest fine-tuning
  C. Conduct a code review D. Alert the CIO
  A. Inform the governance panel

  ---

  AAISM directs that potential privacy, ethical, or compliance risks must be escalated to the AI Governance Panel, the body responsible for oversight, risk approval, and corrective action. Fine-tuning (B) is premature and may worsen risk. Code review (C) does not address model-level inference issues. Escalating directly to the CIO (D) bypasses the required governance process.

  References: AAISM Study Guide - AI Governance Committees; Escalation Procedures.

• Question 206:

  Which of the following employee awareness topics would MOST likely be revised to account for AI-enabled cyber risk?

  A. Clean desk policy
  B. Social engineering
  C. Malicious insider threats
  D. Authentication controls
  B. Social engineering

  ---

  AAISM training guidance specifies that social engineering is the awareness topic most impacted by AI-enabled risks. With generative AI and deepfake technologies, attackers can create highly convincing phishing messages, synthetic voices, or fake executive requests, increasing the sophistication of social engineering attacks. Clean desk policies, insider threat awareness, and authentication procedures remain relevant but are not directly altered by AI advancements. The most likely revision to employee

  awareness programs in the AI era is therefore enhanced social engineering awareness.

  References:

  AAISM Exam Content Outline - AI Risk Management (Human Factors and Awareness)

  AI Security Management Study Guide - Social Engineering Risks with AI

• Question 207:

  An organization is evaluating a SaaS-based HR system that uses AI for resume vetting. Which control is MOST important?

  A. Inclusion of diverse and representative training data
  B. Availability of backups
  C. Vendor conformity assessments
  D. Encryption and isolation of customer data
  A. Inclusion of diverse and representative training data

  ---

  AAISM states that HR systems performing candidate evaluation must prioritize training data fairness, representativeness, and bias mitigation because biased HR decisions carry regulatory, ethical, and litigation risks. Backups (B) and encryption (D) relate to availability and confidentiality, not fairness. Conformity assessments (C) are helpful but secondary.

  References: AAISM Study Guide - AI Bias and Fairness; High-Risk HR Use Cases.

• Question 208:

  Which of the following MOST effectively addresses bias in generative AI models?

  A. Data minimization
  B. Data augmentation
  C. Adversarial training
  D. Fairness constraints
  D. Fairness constraints

  ---

  AAISM identifies fairness constraints as a direct mechanism to mitigate and control model bias by embedding fairness requirements into optimization objectives during training.

  Data augmentation (B) helps but is not a primary anti-bias control. Adversarial training (C) focuses on robustness, not fairness. Minimization (A) reduces data, often making bias worse.

  References: AAISM Study Guide - Fairness, Bias Mitigation Techniques, Ethical AI Controls.

• Question 209:

  An organization is deploying an automated AI cybersecurity system. Which of the following would be the MOST effective strategy to minimize human error and improve overall security?

  A. Conducting periodic penetration testing
  B. Using historical data to train AI detection software
  C. Utilizing machine learning (ML) algorithms to ensure responsible use
  D. Implementing manual monitoring of potential alerts
  B. Using historical data to train AI detection software

  ---

  Training detection models on relevant, representative historical data improves signal quality, reduces false positives, and automates triage-directly lowering human workload and error rates (e.g., alert fatigue, missed correlations). Penetration testing is valuable but episodic and does not systematically reduce day-to-day operator error. "Ensure responsible use" is a governance aim, not a concrete method to cut human error in detection. Manual monitoring increases reliance on human judgment and is prone to inconsistency.

  References: AI Security Management (AAISM) Body of Knowledge: Model Development and Evaluation Controls; Data Selection and Representativeness; Operationalization to Reduce Human Error. AAISM Study Guide: Tuning Detection Systems with Historical Corpora; Alert Quality, Precision/Recall, and SOC Workflow Integration.

• Question 210:

  Which of the following AI data life cycle phases presents the GREATEST inherent risk?

  A. Training
  B. Maintenance
  C. Monitoring
  D. Preparation
  D. Preparation

  ---

  The data Preparation phase-covering sourcing, collection, labeling, cleansing, and provenance-presents the greatest inherent risk because it is where privacy, consent, representativeness, bias, quality, lineage, and legality must be established. Decisions and defects here propagate into training and downstream use, amplifying ethical, regulatory, and accuracy risks. While Training can introduce additional risks (e.g., poisoning, leakage), these are frequently mitigated by controls that depend on having trustworthy prepared data. Monitoring and Maintenance are later-life-cycle phases oriented toward detection and correction; they are critical but inherently rely on the foundation set during Preparation.

  References: AI Security Management (AAISM) Body of Knowledge: "AI Data Lifecycle Risks-Sourcing, Consent, Provenance, and Bias," "Risk Treatment Priorities Across the Lifecycle"; AAISM Study Guide: "Data Preparation Controls and Quality Gates," "Bias and Privacy Risk Controls at Ingestion."