Isaca AAISM Online Practice Questions and Exam Preparation

Isaca AAISM Online Questions & Answers

• Question 31:

  Within an incident handling process, which of the following would BEST help restore end user trust with an AI system?

  A. The AI model prioritizes incidents based on business impact
  B. AI is being used to monitor incident detection and alerts
  C. The AI model's outputs are validated by team members
  D. Remediation of the AI system based on lessons learned
  C. The AI model's outputs are validated by team members

  ---

  Restoring end user trust during incident handling requires visible, immediate assurance that system outcomes are safe and appropriate. AAISM prescribes human oversight and approval gates for high-risk AI decisions, with human validation of outputs before use as a primary control to maintain trust while technical remediation is underway. Prioritization (A) and monitoring (B) aid operations but do not directly rebuild user confidence in outcomes. Post-incident improvements (D) are essential for long-term assurance but do not provide the immediate trust restoration that supervised, human-validated outputs deliver.

  References: AI Security Management. (AAISM) Body of Knowledge - Incident Handling and Communications; Human Oversight and Approval Gates; Trust Restoration During AI Incidents.

• Question 32:

  An organization concerned about the ethical and responsible use of a newly developed AI product should consider implementing:

  A. Model cards
  B. Vendor monitoring
  C. An accountability model
  D. Security by design
  C. An accountability model

  ---

  The AAISM framework highlights that organizations adopting AI must ensure accountability structures are in place to govern ethical and responsible use. An accountability model assigns clear responsibility for decisions, outputs, and risks related to AI systems. While model cards provide transparency about a model's design and performance, they are primarily documentation tools. Vendor monitoring focuses on third-party oversight, not internal accountability. Security by design improves resilience but does not by itself address ethical use. The governance approach that most directly supports responsible and ethical AI deployment is an accountability model.

  References: AAISM Study Guide - AI Governance and Program Management (Ethical AI and Accountability) ISACA AI Security Management - Responsible AI Practices

• Question 33:

  Which of the following is the BEST way to ensure role clarity and staff effectiveness when implementing AI-assisted security monitoring tools?

  A. Delay implementation until more data scientists are hired
  B. Increase budgets for AI certifications
  C. Update the security program to include cross-functional AI-specific responsibilities
  D. Transition responsibilities to external consultants
  C. Update the security program to include cross-functional AI-specific responsibilities

  ---

  AAISM stresses that AI-enabled security programs require updated governance structures, including defined cross-functional roles across security, data, development, and operations teams. Role clarity emerges from updated policies, responsibilities, and oversight-not from delaying adoption (A), outsourcing (D), or simply training (B).

  References: AAISM Study Guide - AI Governance Structure; Role Definition and Accountability.

• Question 34:

  A large financial services organization is integrating a third-party AI solution into its critical fraud detection system. Which of the following is the BEST way for the organization to reduce risk associated with AI vendor and supply chain dependencies?

  A. Conducting annual vulnerability assessments of the fraud detection system after integration
  B. Focusing on performance testing to ensure the solution meets operational requirements
  C. Establishing contractual agreements requiring vendors to provide evidence of secure development practices
  D. Implementing isolated virtual environments to validate the integration of the fraud detection system with the solution
  C. Establishing contractual agreements requiring vendors to provide evidence of secure development practices

  ---

  AAISM emphasizes supplier assurance through contractual obligations as the foundational control for AI supply chain risk. Contracts should require verifiable evidence of secure development practices (e.g., secure SDLC, model and data provenance documentation, SBOM/MBOM where applicable, vulnerability disclosure, patch SLAs, audit rights, incident notification, and regulatory compliance assertions). This creates enforceable, continuous assurance beyond point-in-time tests.

  A is necessary but reactive and limited to your environment.

  B addresses performance, not supply chain security.

  D is a good isolation/validation practice but does not create vendor accountability across the lifecycle.

  References:

  AI Security Management (AAISM) Body of Knowledge: Third-Party and Supply Chain Governance-Contractual security requirements, evidence-based assurance, right-to-audit.

  AI Security Management Study Guide: Vendor due diligence artifacts, secure development evidence, lifecycle obligations for AI providers.

• Question 35:

  As organizations increasingly rely on vendors to develop AI systems, which of the following is the MOST effective way to monitor vendors and ensure compliance with ethical and security standards?

  A. Conducting regular audits of vendor processes and adherence to AI development guidelines
  B. Requiring vendors to monitor their adherence to ethics and security standards
  C. Mandating that vendors share source code and AI documentation with the contracting party
  D. Allowing vendors to self-attest ethical AI compliance and implement benchmark monitoring
  A. Conducting regular audits of vendor processes and adherence to AI development guidelines

  ---

  AAISM vendor governance guidance identifies regular audits of vendor processes as the most effective method of ensuring compliance with ethical and security standards. Independent audits provide verifiable assurance that vendors are meeting agreed-upon requirements. Self-attestation, internal monitoring, or documentation sharing provide some transparency but do not guarantee compliance. The best practice, particularly for high-risk AI deployments, is independent and recurring audits of vendor

  processes.

  References:

  AAISM Exam Content Outline - AI Risk Management (Vendor Oversight)

  AI Security Management Study Guide - Vendor Audit and Compliance Assurance

• Question 36:

  A large language model (LLM) has been manipulated to provide advice that serves an attacker's objectives. Which of the following attack types does this situation represent?

  A. Privilege escalation
  B. Data poisoning
  C. Model inversion
  D. Evasion attack
  D. Evasion attack

  ---

  AAISM categorizes the manipulation of an LLM at inference time, where crafted inputs cause outputs to serve attacker objectives, as an evasion attack. Evasion attacks exploit weaknesses in the model's decision-making boundaries by altering queries to produce compromised or misleading outputs. Privilege escalation refers to unauthorized access rights, data poisoning targets the training phase, and model inversion reconstructs training data. In this case, manipulation of outputs to align with an attacker's

  goals reflects an evasion attack.

  References:

  AAISM Exam Content Outline - AI Risk Management (Adversarial Attack Types)

  AI Security Management Study Guide - Evasion and Manipulation Risks

• Question 37:

  From a risk perspective, which of the following is the MOST important step when implementing an adoption strategy for AI systems?

  A. Benchmarking against peer organizations' AI risk strategies
  B. Implementing a robust risk analysis methodology tailored to AI-specific tasks
  C. Conducting an AI risk assessment and updating the enterprise risk register
  D. Establishing a comprehensive AI risk assessment framework
  C. Conducting an AI risk assessment and updating the enterprise risk register

  ---

  AAISM guidance states that when adopting AI, the most important step is to conduct a risk assessment and update the enterprise risk register. This ensures AI-specific risks are identified, documented, and integrated into the organization's existing governance structures. Benchmarking peers provides context but does not address internal risk. Implementing methodologies and frameworks are important, but they precede or follow the assessment process. The decisive step that connects adoption to

  enterprise risk governance is updating the

  risk register with AI-specific risks.

  References:

  AAISM Study Guide - AI Risk Management (Integration with Enterprise Risk Management)

  ISACA AI Security Management - Risk Assessment and Register Updates

• Question 38:

  A regulator warns of increased risk of AI re-identification attacks on anonymized datasets. What should the information security manager do FIRST?

  A. Assume anonymization is permanent and continue operations
  B. Immediately delete anonymized datasets and suspend AI services
  C. Implement a monitoring program including privacy audits and adversarial testing
  D. Establish strong access controls for services using anonymized data
  C. Implement a monitoring program including privacy audits and adversarial testing

  ---

  AAISM states that anonymization is not permanent and may be reversible through re-identification attacks. The first action should be to evaluate and measure the actual privacy risk through:

  adversarial re-identification testing

  privacy audits

  monitoring for misuse

  This provides the factual basis needed before making destructive or operational decisions.

  Access control (D) is important but not the FIRST step. Deleting datasets (B) is premature. Assuming anonymization is permanent (A) violates AI privacy principles.

  References: AAISM Study Guide - Privacy Risk, Re-Identification Threats, Adversarial Testing.

• Question 39:

  An AI application development team has been given access to user information and now must format it to be readable by the AI model. During which phase of the data life cycle would this MOST likely occur?

  A. Data minimization
  B. Data preparation
  C. Data collection
  D. Data normalization
  B. Data preparation

  ---

  According to AAISM's data life-cycle model, data preparation is the phase where raw data is transformed into a model-ready format. The materials describe this phase as including "cleaning, encoding, formatting, feature engineering, and other transformations required for model consumption." This directly matches the scenario where a team formats user information to be readable by an AI model. Data minimization (A) is about reducing data to the minimum necessary for the stated purpose. Data collection

  (C) focuses on acquiring data from different sources. Data normalization (D) is a specific technique (often a sub-activity within preparation) that adjusts numeric values to a common scale; it is narrower than the broader concept of preparation. Therefore, the activity described is correctly associated with data preparation, which the AAISM framework clearly positions before training and evaluation.

  References: AI Security Management (AAISM) Study Guide - AI Data Life Cycle; Data Preparation and Pre-processing.

• Question 40:

  Which of the following BEST describes the role of risk documentation in an AI governance program?

  A. Providing a record of past AI-related incidents for audits
  B. Outlining the acceptable levels of risk for AI-related initiatives
  C. Offering detailed analyses of technical risk and vulnerabilities
  D. Demonstrating governance, risk, and compliance (GRC) for external stakeholders
  B. Outlining the acceptable levels of risk for AI-related initiatives

  ---

  In AAISM governance guidance, risk documentation is described as the structured record that defines the organization's risk appetite and tolerance levels for AI initiatives. By outlining acceptable levels of risk, documentation ensures decision-makers can approve, monitor, and adjust AI projects within defined boundaries. While it may also serve audit functions, technical analysis, or communication to stakeholders, its primary role is to formalize risk acceptance thresholds and integrate them into governance

  and decision-making. This aligns directly with the governance requirement to align AI adoption with organizational risk appetite.

  References:

  AAISM Study Guide - AI Governance and Program Management (Risk Documentation and Appetite)

  ISACA AI Security Management - Governance, Risk and Compliance Integration