Isaca AAISM Online Practice Questions and Exam Preparation

Isaca AAISM Online Questions & Answers

• Question 21:

  Which area of intellectual property law presents the GREATEST challenge in determining copyright protection for AI-generated content?

  A. Enforcing trademark rights associated with AI systems
  B. Determining the rightful ownership of AI-generated creations
  C. Protecting trade secrets in AI technologies
  D. Establishing licensing frameworks for AI-generated works
  B. Determining the rightful ownership of AI-generated creations

  ---

  AAISM governance content highlights that the greatest intellectual property challenge in the context of AI-generated works is determining rightful ownership. Traditional copyright law requires human authorship, but AI-generated creations blur authorship and ownership boundaries, raising legal uncertainty about who can claim rights. Trademark enforcement, trade secret protection, and licensing frameworks are established areas of IP law but do not present the same fundamental challenge as ownership

  attribution. For AI-generated content, the central legal dilemma is ownership of the creation.

  References:

  AAISM Study Guide - AI Governance and Program Management (Intellectual Property and AI)

  ISACA AI Security Management - Copyright and Ownership Challenges

• Question 22:

  Which of the following is the MOST effective action an organization can take to address data security risk when using generative AI features in an application?

  A. Establish IP ownership guidelines with third parties
  B. Require opt-out provisions for data usage
  C. Establish policies and awareness training for acceptable AI use
  D. Rely on the AI provider's independent audit reports
  C. Establish policies and awareness training for acceptable AI use

  ---

  AAISM stresses that the largest and most immediate risk for generative AI is unintentional data leakage by employees, making acceptable-use policies and staff training the most effective short-term risk mitigation. Users must be instructed not to input sensitive data, understand usage restrictions, and follow governance requirements. Relying solely on third-party audits (D) is insufficient. IP agreements (A) and opt-out clauses (B) are contractual protections, not operational safeguards.

  References: AAISM Study Guide - Generative AI Security Risks; Policy and Awareness as Primary Controls.

• Question 23:

  Embedding unique identifiers into AI models would BEST help with:

  A. Preventing unauthorized access
  B. Tracking ownership C. Eliminating AI system biases
  C. Detecting adversarial attacks
  B. Tracking ownership C. Eliminating AI system biases

  ---

  The AAISM framework explains that embedding unique identifiers-such as digital watermarks or model fingerprints-enables organizations to trace and verify model provenance. This technique is used for tracking ownership and intellectual property rights over models, particularly when sharing, licensing, or distributing AI systems. While identifiers may support certain security functions, their primary control objective is ownership verification, not preventing access, bias removal, or adversarial detection. The

  correct alignment with AAISM controls is tracking ownership.

  References:

  AAISM Exam Content Outline - AI Technologies and Controls (Model Provenance and Watermarking)

  AI Security Management Study Guide - Ownership and Accountability of Models

• Question 24:

  Which phase of the AI data life cycle presents the GREATEST inherent risk?

  A. Monitoring
  B. Maintenance
  C. Preparation
  D. Training
  D. Training

  ---

  AAISM identifies training as the phase with the highest inherent risk because this is where: data poisoning can occur sensitive data may be exposed bias can be introduced model inversion risks originate security and privacy vulnerabilities are embedded Preparation (C) carries risk but is less critical. Maintenance (B) and monitoring (A) involve operational safeguards, not foundational risk creation.

  References: AAISM Study Guide - AI Data Life Cycle Risks; High-Risk Model Training Phase.

• Question 25:

  An organization's CIO provided the AI steering committee with a list of AI technologies in use and tasked them with categorizing the technologies by risk. Which of the following should the committee do FIRST?

  A. Begin grouping similar AI products and solutions together
  B. Identify vulnerabilities related to the technologies in use
  C. Ensure the AI technologies are included in the asset inventory
  D. Assess risk levels based on risk appetite and regulatory requirements
  C. Ensure the AI technologies are included in the asset inventory

  ---

  AAISM governance practices state that before categorizing technologies by risk, the first step is to ensure that all AI systems are documented in the organizational asset inventory. A complete inventory provides the foundation for subsequent risk analysis, accountability, and governance. Grouping solutions, identifying vulnerabilities, and assessing risk levels come afterward, once inventory accuracy is established. Without confirming that the technologies are recorded in the inventory, risk categorization may

  miss critical assets.

  References:

  AAISM Study Guide - AI Governance and Program Management (AI Inventories as a Prerequisite to Risk Analysis)

  ISACA AI Security Management - Asset Visibility and Risk Categorization

• Question 26:

  Which of the following should be a PRIMARY consideration when defining recovery point objectives (RPOs) and recovery time objectives (RTOs) for generative AI solutions?

  A. Preserving the most recent versions of data models to avoid inaccuracies in functionality
  B. Prioritizing computational efficiency over data integrity to minimize downtime
  C. Ensuring the backup system can restore training data sets within the defined RTO window
  D. Maintaining consistent hardware configurations to prevent discrepancies during model restoration
  C. Ensuring the backup system can restore training data sets within the defined RTO window

  ---

  When setting RPOs and RTOs for AI systems, especially generative AI, the critical factor is the restoration of training data and model artifacts within the recovery window. Without this, restored systems may function inaccurately or incompletely, undermining business continuity.

  AAISM risk management principles emphasize:

  Recovery objectives must align with data protection requirements for both training and inference data.

  The ability to restore large-scale training datasets is primary, since downtime without them leads to operational and compliance risks.

  Computational efficiency and hardware consistency are secondary considerations, but not the primary drivers of RPO/RTO definitions.

  Thus, ensuring backup and restore capabilities of training datasets directly within RTO is the primary requirement.

• Question 27:

  During the creation of a new large language model (LLM), an organization procured training data from multiple sources. Which of the following is MOST likely to address the CISO's security and privacy concerns?

  A. Data augmentation
  B. Data minimization
  C. Data classification
  D. Data discovery
  B. Data minimization

  ---

  AAISM guidance highlights data minimization as a critical practice for addressing both security and privacy concerns. By ensuring that only the minimum necessary data is collected and retained, the organization reduces the risk of sensitive information being exposed or misused during training. Data augmentation expands data but does not mitigate privacy risk. Classification organizes data but does not limit exposure. Data discovery helps locate sources but does not directly reduce risks. The control that

  directly aligns with privacy-by-design principles is data minimization.

  References:

  AAISM Exam Content Outline - AI Risk Management (Data Privacy and Minimization)

  AI Security Management Study Guide - Privacy Safeguards in AI Training

• Question 28:

  An organization plans to apply an AI system to its business, but developers find it difficult to predict system results due to lack of visibility to the inner workings of the AI model. Which of the following is the GREATEST challenge associated with this situation?

  A. Gaining the trust of end users through explainability and transparency
  B. Assigning a risk owner who is responsible for system uptime and performance
  C. Determining average turnaround time for AI transaction completion
  D. Continuing operations to meet expected AI security requirements
  A. Gaining the trust of end users through explainability and transparency

  ---

  AAISM materials identify explainability and transparency as the greatest challenge when models operate as "black boxes" where inner logic is opaque. Inability to interpret how results are produced undermines the trust of business users, customers, regulators, and auditors. Explainability is emphasized as a critical governance requirement, because without it, ethical validation, accountability, and regulatory compliance are at risk. Assigning risk owners or measuring transaction times are operational

  concerns, but they do not address the core trust deficit caused by lack of visibility. The greatest challenge in this situation is therefore the loss of end-user trust due to insufficient explainability.

  References:

  AAISM Study Guide - AI Governance and Program Management (Transparency and Explainability)

  ISACA AI Security Management - Ethical and Trust Considerations

• Question 29:

  An organization plans to use an open-source foundational AI model. Which of the following is MOST important for the AI governance committee to consider when approving its use?

  A. Confidential data leakage
  B. AI model accuracy
  C. AI model support
  D. Employee privacy rights
  A. Confidential data leakage

  ---

  AAISM emphasizes that open-source AI models present elevated data leakage risks because internal data may flow into external, uncontrolled repositories or be used for further training. Governance bodies must prioritize the risk of data exposure, model reuse, data retention uncertainty, and uncontrolled model behavior. While accuracy (B) and support (C) are important operational considerations, they are not the primary governance risk. Employee privacy rights (D) matter but are encompassed within the broader risk of data leakage.

  References: AAISM Study Guide - Open-Source AI Governance; Data Leakage and Uncontrolled Model Behavior.

• Question 30:

  Which of the following would MOST effectively obtain ongoing support from stakeholders to align AI initiatives with business objectives?

  A. Conducting periodic organization-wide AI staff training
  B. Addressing and optimizing AI-related risk
  C. Developing and monitoring the AI strategic roadmap
  D. Quantifying and communicating the value of AI solutions
  D. Quantifying and communicating the value of AI solutions

  ---

  Sustained stakeholder sponsorship hinges on demonstrated, quantified business value communicated in terms they own (KPIs, ROI, cost-to-serve, risk-adjusted outcomes). AAISM frames stakeholder alignment as a value-assurance loop: define value hypotheses, measure realized value, and continuously communicate results to sponsors. While an AI roadmap (C), risk optimization (B), and training (A) are important, they support rather than drive ongoing executive buy-in. Quantified value narratives secure

  resources and reinforce alignment to strategic goals.

  References:

  AI Security Management (AAISM) Body of Knowledge: Strategy and Value Realization-value metrics, benefits tracking, stakeholder reporting.

  AAISM Study Guide: Business alignment for AI-OKRs/KPIs, ROI cases, benefits realization management