Isaca AAISM Online Practice Questions and Exam Preparation

Isaca AAISM Online Questions & Answers

• Question 251:

  An organization needs large data sets to perform application testing. Which of the following would BEST fulfill this need?

  A. Reviewing AI model cards
  B. Incorporating data from search content
  C. Using open-source data repositories
  D. Performing AI data augmentation
  C. Using open-source data repositories

  ---

  According to AAISM study guidance, the most direct and effective way to obtain large volumes of diverse data for application testing is through open-source data repositories. These repositories provide freely available, well-documented, and often standardized data that supports testing and benchmarking in a compliant manner. Model cards document AI behavior but do not provide data. Incorporating search content may introduce legal, privacy, and quality risks. Data augmentation is useful for expanding

  existing sets but does not provide the breadth or size required when starting with insufficient data. The recommended best practice for sourcing large testing datasets is therefore the use of open-source repositories.

  References:

  AAISM Study Guide - AI Technologies and Controls (Data Sources and Testing Practices)

  ISACA AI Security Management - Data Governance and Compliance in AI Testing

• Question 252:

  Which of the following approaches BEST enables the separation of sensitive and shareable data to prevent an AI chatbot from inadvertently disclosing confidential information?

  A. Zero Trust
  B. Sandboxing
  C. Siloing
  D. Containerization
  C. Siloing

  ---

  AAISM materials describe data segregation and segmented access as core technical controls to prevent unintended information disclosure by AI systems. Siloing refers to logically or physically separating data into distinct repositories or contexts, ensuring that sensitive datasets are not available to components or applications that only require non-sensitive information. This is directly aligned with preventing a chatbot from accessing or mixing confidential data with general conversational content. Zero Trust

  (A) is an overarching security architecture principle, focusing on identity and continuous verification; it does not by itself guarantee separation of data. Sandboxing (B) isolates processes but is less about fine-grained data separation. Containerization (D) packages applications and their dependencies, again not necessarily solving the specific problem of mixing sensitive and non-sensitive datasets. Siloing is explicitly highlighted as a way to prevent cross-context leakage in AI use cases.

  References: AI Security Management (AAISM) Study Guide - Technical Controls for AI Data Protection; Data Segregation and Access Boundaries.

• Question 253:

  An AI research team is developing a natural language processing model that relies on several open-source libraries. Which of the following is the team's BEST course of action to ensure the integrity of the software packages used?

  A. Maintain a list of frequently used libraries to ensure consistent application in projects
  B. Scan the packages and libraries for malware prior to installation
  C. Use the latest version of all libraries from public repositories
  D. Retrain the model regularly to handle package and library updates
  B. Scan the packages and libraries for malware prior to installation

  ---

  AAISM's technical control guidance emphasizes that when using open-source libraries, the best safeguard for integrity is to scan the packages for malware before installation. This ensures that compromised or malicious code does not enter the AI system environment. Maintaining lists aids consistency but not security. Always using the latest versions may introduce unverified vulnerabilities. Retraining models addresses functionality but not software integrity. Therefore, the strongest protective measure is

  pre-installation malware scanning of open-source packages.

  References:

  AAISM Exam Content Outline - AI Technologies and Controls (Software Supply Chain Security)

  AI Security Management Study Guide - Open-Source Package Risk Mitigation

• Question 254:

  An AI governance team is concerned that a newly deployed generative model may unintentionally reveal internal financial projections. Which control BEST minimizes this output-related risk?

  A. Encrypting all inference data
  B. Implementing strict data-sanitization before inference
  C. Enforcing output filtering and post-generation validation
  D. Deploying a private foundation model
  C. Enforcing output filtering and post-generation validation

  ---

  AAISM emphasizes output-level controls as the most effective safeguard for preventing generative models from exposing sensitive material. Output filtering, validation gates, and DLP-aligned policies ensure that inappropriate or confidential information is blocked before release. Encryption (A) protects data in transit/storage but not output. Sanitization (B) occurs before inference, not after. Private models (D) reduce exposure but do not guarantee output safety.

  References:

  AAISM Study Guide ?Generative AI Output Controls; Post-Generation Validationand; DLP Enforcement.

• Question 255:

  A financial organization is concerned about the risk of prompt injection attacks on its customer service chatbot. Which of the following controls BEST addresses this concern?

  A. Human-in-the-loop
  B. Input validation
  C. Increasing model parameters
  D. Continuous monitoring
  B. Input validation

  ---

  AAISM describes prompt injection as an attack where adversaries craft inputs that manipulate model behavior or override system instructions. The recommended control pattern is to implement robust input validation and constraint mechanisms that sanitize and structure user inputs before they are processed by the model. The guidance includes techniques such as template-based prompts, restricted instruction sets, and validation rules to filter malicious or out-of-scope content. Human-in-the-loop (A) provides oversight but may not scale and is not a primary technical protection. Increasing model parameters (C) relates to capacity and performance, not security. Continuous monitoring (D) is important for detection but does not prevent prompt injection at the point of entry. Therefore, input validation, combined with controlled prompt construction, is identified as the best direct control against prompt injection attacks in customer-facing chatbots.

  References: AI Security Management. (AAISM) Study Guide - AI Threats and Attack Vectors; Prompt Injection and Input Control Mechanisms.

• Question 256:

  Which of the following would BEST help to prevent the compromise of a facial recognition AI system through the use of alterations in facial appearance?

  A. Enhancing training data to increase variance
  B. Monitoring the system for misuse cases
  C. Fine-tuning the AI model to decrease hallucinations
  D. Implementing a secondary AI system to confirm images
  A. Enhancing training data to increase variance

  ---

  AAISM materials note that adversaries may attempt to bypass facial recognition by disguising or altering appearance. The most effective mitigation is to enhance training data with a wide range of variances in facial features, lighting, and disguises so the system can robustly detect authentic users despite adversarial attempts. Monitoring and secondary confirmation are supportive controls but are reactive. Fine-tuning to reduce hallucinations is irrelevant in this context, as hallucinations apply more to

  generative AI. The best preventive measure is strengthening the model with diverse, variance-rich training data.

  References:

  AAISM Study Guide - AI Technologies and Controls (Robust Training Data Strategies)

  ISACA AI Security Management - Biometric AI Security Risks

• Question 257:

  During red-team testing of an AI system used to make lending decisions, which of the following techniques BEST simulates a data poisoning attack?

  A. Inputting encrypted data into the model
  B. Adding noise to output predictions
  C. Stealing model weights from a deployed API
  D. Corrupting training data sets to manipulate outcomes
  D. Corrupting training data sets to manipulate outcomes

  ---

  AAISM defines data poisoning as the intentional manipulation of training data so that the learned model behaves incorrectly (e.g., skewed lending approvals/denials) while appearing valid. The correct simulation in red-team exercises is to corrupt or seed the training set with adversarial examples or mislabeled records to induce biased or erroneous decision boundaries. Encrypting inputs (A) is unrelated; output noise (B) describes perturbation of predictions, not training; model weight theft (C) is model extraction, not poisoning.

  References: AI Security Management (AAISM) Body of Knowledge -Adversarial ML Threats; Data Poisoning and Training-Time Attacks. AAISM Study Guide -Red-Team Methods for AI; Poisoning vs. Evasion vs. Model Extraction; Controls and Testing for Safety-Critical Decisions.

• Question 258:

  An organization decides to use an anomaly-based intrusion detection system (IDS) integrated with a generative adversarial network (GAN)-enabled AI tool. The integrated tool would MOST effectively detect intrusions by leveraging:

  A. Validation data sets to enable highly realistic AI decisions
  B. Classified real intrusion data based on labeled data
  C. Automated rule creation to increase model performance
  D. Synthetic intrusion data to train the tool's components
  D. Synthetic intrusion data to train the tool's components

  ---

  AAISM materials describe that GAN-based systems excel at generating synthetic data-including simulated attack traffic-which can significantly enhance anomaly-based intrusion detection capabilities. The guidance emphasizes that synthetic attack samples help strengthen the model's ability to detect rare or emerging intrusion types. This aligns with the principle that AI security controls should leverage adversarially generated data during training to improve resilience. Options A and C describe generic ML enhancements, but not GAN-specific advantages. Option B is useful but insufficient for anomaly detection, which relies heavily on recognizing atypical, previously unseen patterns.

  References: AAISM Study Guide - AI Security Controls; Adversarial Simulation and Synthetic Data Generation.

• Question 259:

  A large financial institution is integrating a third-party AI solution into its fraud detection system. Which is the BEST way to reduce AI vendor/supply chain risk?

  A. Conduct annual vulnerability assessments after integration
  B. Establish contractual agreements requiring evidence of secure development practices
  C. Use isolated virtual environments to validate integration
  D. Focus on performance testing
  B. Establish contractual agreements requiring evidence of secure development practices

  ---

  AAISM emphasizes contractual governance controls as the strongest mechanism for managing AI vendor and supply chain dependencies. Contracts must require: . secure development lifecycle practices . documentation of controls . security testing . supply chain transparency Isolated environments (C) help, but they do not ensure upstream integrity. Performance testing (D) is unrelated to security. Annual assessments (A) occur too late to mitigate onboarding risks.

  References: AAISM Study Guide - AI Vendor Governance; Contractual Risk Controls.

• Question 260:

  When robust input controls are not practical on a large language model (LLM) to prevent prompt injection attacks from external threats, which of the following would be the BEST compensating control to address the risk?

  A. Review and annotate the AI system's outputs
  B. Implement identity and access management (IAM)
  C. Conduct human reviews of the AI system's inputs
  D. Fine-tune the system to validate the AI system's inputs
  A. Review and annotate the AI system's outputs

  ---

  When preventive input hardening isn't feasible for LLMs, AAISM prescribes compensating detective and corrective controls-notably human review and annotation of outputs prior to downstream action-to reduce harm from prompt injection. Output-side review gates prevent untrusted instructions from propagating, enable rapid suppression/feedback loops, and provide labeled examples for subsequent model hardening. IAM (B) is necessary but does not mitigate injection in content; reviewing inputs (C) is less effective than auditing what the model is about to act on; fine-tuning for validation (D) is helpful long-term but is not an immediate compensating control when robust input validation is impractical.

  References: AI Security Management (AAISM) Body of Knowledge - LLM Threats and Compensating Controls; Human Oversight and Output Review Gates; Post-incident Feedback and Labeling for Model Hardening.