Isaca AAISM Online Practice Questions and Exam Preparation

Isaca AAISM Online Questions & Answers

• Question 221:

  Which of the following is MOST important to ensure security throughout the AI data life cycle?

  A. Leveraging selected open-source models
  B. Conducting periodic data reviews
  C. Restricting use of data in third-party models
  D. Maintaining a complete inventory with data lineage records
  D. Maintaining a complete inventory with data lineage records

  ---

  AAISM emphasizes data lineage, provenance tracking, and inventory completeness as essential controls to ensure data security and accountability across all AI data life-cycle phases. This enables detection of unauthorized modifications, improper use, and compliance violations.

  Periodic reviews (B) are necessary but insufficient without lineage. Restricting third-party use (C) is one control but not comprehensive. Open-source model choice (A) does not secure data.

  References: AAISM Study Guide - AI Data Governance; Lineage and Traceability.

• Question 222:

  Which strategy is MOST effective for penetration testers assessing an AI model against membership inference attacks?

  A. Generating synthetic training data
  B. Analyzing AI model confidence scores
  C. Disabling model logging
  D. Measuring accuracy on the test set
  B. Analyzing AI model confidence scores

  ---

  AAISM specifies that membership inference attacks often exploit unusually high confidence scores when the model encounters data points used during training. Penetration testers identify vulnerability by analyzing model confidence behavior across known and unknown samples. Synthetic data (A) does not test inference leakage. Disabling logs (C) removes evidence and reduces visibility. Test-set accuracy (D) is unrelated.

  References: AAISM Study Guide - AI Privacy Attacks; Membership Inference Testing Techniques.

• Question 223:

  Which of the following is the MOST serious consequence of an AI system correctly guessing the personal information of individuals and drawing conclusions based on that information?

  A. The exposure of personal information may result in litigation
  B. The publicly available output of the model may include false or defamatory statements about individuals
  C. The output may reveal information about individuals or groups without their knowledge
  D. The exposure of personal information may lead to a decline in public trust
  C. The output may reveal information about individuals or groups without their knowledge

  ---

  The AAISM curriculum states that the most serious privacy concern occurs when AI systems infer and disclose sensitive personal or group information without the knowledge or consent of the individuals. This constitutes a direct breach of privacy rights and data protection principles, including those enshrined in GDPR and other global regulations. While litigation, reputational damage, or loss of trust are significant consequences, the unauthorized revelation of personal information through inference is classified as the most severe, because it directly undermines individual autonomy and confidentiality.

  References: AAISM Exam Content Outline - AI Risk Management AI Security Management Study Guide - Privacy and Confidentiality Risks

• Question 224:

  What is the PRIMARY purpose of a dedicated AI management system policy?

  A. Minimizing environmental impact
  B. Optimizing AI model accuracy
  C. Complying with external regulations
  D. Providing a framework to set AI objectives
  D. Providing a framework to set AI objectives

  ---

  AAISM states that an AI management system policy provides organizational structure by: defining AI objectives aligning governance . outlining accountability defining roles, responsibilities, and guiding principles Regulatory compliance (C) is a part of governance but not the overall purpose. Accuracy (B) and environmental impact (A) are narrower focus areas.

  References: AAISM Study Guide - AI Management System Policies; Governance Framework Requirements.

• Question 225:

  Which of the following factors is MOST important for preserving user confidence and trust in generative AI systems?

  A. Bias minimization
  B. Access controls and secure storage solutions
  C. Transparent disclosure and informed consent
  D. Data anonymization
  C. Transparent disclosure and informed consent

  ---

  AAISM risk guidance underscores that transparent disclosure and informed consent are the most important factors in maintaining user trust in generative AI. Users must clearly understand how outputs are created, what data sources are used, and how risks such as bias or misinformation are managed. While bias minimization, access controls, and anonymization contribute to technical or ethical robustness, they are not sufficient to preserve user trust. Trust requires openness and consent, which align with

  governance expectations for transparency and accountability.

  References:

  AAISM Exam Content Outline - AI Risk Management (Transparency and Trust)

  AI Security Management Study Guide - User Confidence in Generative AI

• Question 226:

  When deriving statistical information generated by AI systems, which of the following types of risk is MOST important to address?

  A. Systemic bias in data
  B. Incomplete outputs
  C. Lack of data normalization
  D. Presence of hallucinations
  A. Systemic bias in data

  ---

  The most critical risk when deriving statistical insights from AI-generated data is systemic bias in data. According to the AI Security Management. (AAISM) framework, systemic bias directly undermines the fairness, reliability, and validity of analytical results derived from AI systems. If the input data or learned model patterns are biased-reflecting skewed representation, sampling imbalance, or embedded prejudice-the statistical outputs will propagate and amplify these biases, leading to misinformed decisions

  and compliance violations.

  Why Option A is Correct:

  Systemic bias affects the integrity and trustworthiness of AI-generated statistical information.

  It can introduce discriminatory outcomes, ethical breaches, and regulatory non-compliance-key

  concerns in AAISM's AI Risk Management and Governance principles.

  Mitigating systemic bias requires data quality assessments, fairness audits, bias detection tools, and

  model interpretability measures to ensure the derived insights are accurate and ethically sound.

  Why Other Options Are Incorrect:

  Option B: Incomplete outputs can affect accuracy but are typically handled through process monitoring or retraining, not as a primary risk factor in statistical validity.

  Option C: Lack of data normalization is a technical preprocessing issue, not a governance-level risk impacting statistical trustworthiness.

  Option D: Hallucinations occur mainly in generative models (e.g., LLMs) and affect content generation,

  not statistical computation pipelines.

  Exact Extract from Official AAISM Study Guide:

  "Systemic bias in AI training and inference data represents the most material statistical risk. Bias propagates through derived metrics, predictive models, and decision outputs, compromising fairness, accuracy, and compliance. AI Security Management requires implementing bias detection, fairness testing, and governance mechanisms to identify and mitigate such systemic bias before using AI-generated analytics for organizational or regulatory reporting."

  References:

  AI Security Management. (AAISM) Body of Knowledge: AI Risk Identification and Evaluation, Bias and Fairness Management in AI Systems.

  AI Security Management. Study Guide: Systemic Bias Mitigation Techniques, Fairness Assurance in AI Analytics.

  ISO/IEC 23894:2023 - Clause 7.2: Bias identification and treatment within AI risk frameworks.

• Question 227:

  Which of the following is the GREATEST benefit of implementing an AI tool to safeguard sensitive data and prevent unauthorized access?

  A. Timely analysis of endpoint activities
  B. Timely initiation of incident response
  C. Reduced number of false positives
  D. Reduced need for data classification
  C. Reduced number of false positives

  ---

  The AAISM study materials highlight that AI-powered security tools provide the greatest benefit by reducing false positives in monitoring and access control systems. This improves efficiency, prevents alert fatigue, and enables security teams to focus on true threats. While timely analysis and incident response are benefits, they are not unique to AI-based tools and can be achieved with traditional methods. AI also does not remove the need for data classification, as classification underpins governance and

  compliance. The standout advantage is the improved accuracy and reduced false positives provided by AI.

  References:

  AAISM Study Guide - AI Technologies and Controls (Security Tools and Access Management)

  ISACA AI Security Management - Benefits of AI-Enabled Security

• Question 228:

  To ensure ethical and responsible AI use, which AI usage policy metric is MOST important to monitor?

  A. Number of policy violations
  B. Number of AI projects reviewed for compliance
  C. Frequency of policy consultations by employees
  D. Frequency of policy reviews and updates
  C. Frequency of policy consultations by employees

  ---

  AAISM states the most meaningful policy performance metric is how often employees consult AI policies, which reflects: . awareness . practical adoption . reliance on policy guidance . safe decision-making behavior Violations (A) are lagging indicators. Compliance reviews (B) measure oversight, not behavior. Policy review frequency (D) tracks governance updates, not usage.

  References: AAISM Study Guide - AI Policy Effectiveness Metrics.

• Question 229:

  Which of the following is the MOST important consideration when deciding how to compose an AI red team?

  A. Resource availability
  B. AI use cases
  C. Time-to-market constraints
  D. Compliance requirements
  B. AI use cases

  ---

  AAISM materials specify that the composition of an AI red team must be tailored to the organization's AI use cases. The purpose of red-teaming is to simulate realistic adversarial conditions aligned with the actual applications of AI. For example, testing a generative model requires different expertise than testing a fraud detection system. While resource availability, compliance requirements, and time-to-market pressures are practical considerations, they are secondary to aligning team expertise with use case

  scenarios. The most important factor is therefore the AI use cases themselves.

  References:

  AAISM Exam Content Outline - AI Risk Management (Red Teaming Considerations)

  AI Security Management Study Guide - Tailoring Adversarial Testing to Use Cases

• Question 230:

  An organization has discovered that employees have started regularly utilizing open-source generative AI without formal guidance. Which of the following should be the CISO's GREATEST concern?

  A. Lack of monitoring
  B. Policy violations
  C. Data leakage
  D. Model hallucinations
  C. Data leakage

  ---

  The greatest immediate risk from unsanctioned use of public or open-source generative AI tools is data leakage-employees may paste confidential or regulated information into third-party systems, resulting in loss of confidentiality, regulatory exposure, and loss of intellectual property. AAISM emphasizes that when AI use occurs outside approved channels, the top control priority is preventing exfiltration of sensitive data via prompts, attachments, and context sharing. Monitoring and policy are necessary

  enablers, but leakage is the highest-impact failure mode in the short term; hallucinations primarily affect accuracy, not confidentiality.

  References:. AI Security Management. (AAISM) Body of Knowledge: Generative AI governance; human-in-the-loop risks; data loss and exfiltration vectors in prompts; sanctioned vs. unsanctioned AI usage.. AI Security Management. Study Guide: Immediate risk triage for shadow AI; DLP and input-control safeguards; confidentiality-first posture for generative AI adoption.