Isaca AAISM Online Practice Questions and Exam Preparation

Isaca AAISM Online Questions & Answers

• Question 61:

  Which of the following is the BEST way to ensure role clarity and staff effectiveness when implementing AI-assisted security monitoring tools?

  A. Defer implementation until the security team can be expanded with data scientists.
  B. Update the security program to include cross-functional AI-specific responsibilities.
  C. Transition responsibilities for AI tools to external consultants for improved scalability.
  D. Increase training budgets for business staff to obtain vendor-neutral AI certifications.
  B. Update the security program to include cross-functional AI-specific responsibilities.

  ---

  AAISM directs that AI adoption in security operations be governed through explicit operating models and RACI-mapped responsibilities spanning security operations, data science/ML, platform engineering, privacy, and compliance. Role clarity comes from updating the security program to codify AI-specific responsibilities (model monitoring, incident handling for AI failures, data governance, change control for models, bias / fairness reviews, supplier assurance) rather than deferring implementation,

  outsourcing core accountability, or relying on generic certifications. This ensures measurable accountability, reduces hand-off risk, and aligns day-to-day SOC practices with AI control objectives.

  References:. AI Security Management (AAISM) Body of Knowledge: AI Governance Operating Model; Roles and Responsibilities; RACI for AI-enabled Security Operations. AAISM Study Guide: Program Governance, Control Objective Mapping to SOC Workflows; Cross-Functional Ownership for AI Controls

• Question 62:

  Which of the following controls would BEST help to prevent data poisoning in AI models?

  A. Increasing the size of the training data set
  B. Implementing a strict data validation mechanism
  C. Establishing continuous monitoring
  D. Regularly updating the foundational model
  B. Implementing a strict data validation mechanism

  ---

  The most direct preventative control against data poisoning is robust data validation/ingestion gating: provenance checks, schema and constraint validation, anomaly/outlier screening, label consistency tests, and whitelist/blacklist source controls before data reaches training pipelines. Larger datasets (A) don't inherently prevent poisoning; monitoring (C) is detective; updating a foundation model (D) does not address tainted inputs entering the pipeline.

  References: AI Security Management (AAISM) Body of Knowledge - Adversarial ML Threats and Training-Time Attacks; Secure Data Ingestion and Validation Controls. AAISM Study Guide - Poisoning Prevention: Provenance, Validation, and Sanitization Gates.

• Question 63:

  An organization wants to detect deepfake-enhanced phishing calls. Which control BEST addresses this threat?

  A. Natural language generation
  B. Voice biometrics with liveness detection
  C. Multi-factor authentication for email
  D. Data encryption for audio files
  B. Voice biometrics with liveness detection

  ---

  AAISM highlights biometric liveness detection as an effective control for audio-based deepfake attacks, ensuring voices are genuine and not synthesized. MFA (C) helps email security, not voice phishing. Encryption (D) protects stored audio, not real-time spoofing detection.

  References:

  AAISM Study Guide ?Deepfake Risk Controls; Biometric Liveness Verification.

• Question 64:

  Which of the following should be done FIRST when developing an acceptable use policy for generative AI?

  A. Determine the scope and intended use of AI B. Review AI regulatory requirements
  B. Consult with risk management and legal
  C. Review existing company policies
  A. Determine the scope and intended use of AI B. Review AI regulatory requirements

  ---

  According to the AAISM framework, the first step in drafting an acceptable use policy is defining the scope and intended use of the AI system. This ensures that governance, regulatory considerations, risk assessments, and alignment with organizational policies are all tailored to the specific applications and functions the AI will serve. Once scope and intended use are clearly defined, legal, regulatory, and risk considerations can be systematically applied. Without this step, policies risk being generic and

  misaligned with business objectives.

  References:

  AAISM Study Guide - AI Governance and Program Management (Policy Development Lifecycle)

  ISACA AI Governance Guidance - Defining Scope and Use Priorities

• Question 65:

  Which control MOST effectively prevents unauthorized third-party embedding of a company's proprietary AI model?

  A. API rate limiting
  B. Output watermarking
  C. License-based access enforcement
  D. Model compression
  C. License-based access enforcement

  ---

  AAISM highlights license-based access enforcement, contractual controls, and API key governance as key mechanisms to prevent unauthorized reuse or embedding of proprietary models. Rate limiting (A) controls volume, not legality. Watermarking (B) detects misuse but doesn't prevent it.

  References:

  AAISM Body of Knowledge ?Intellectual Propertyand; Model Access Governance.

• Question 66:

  An organization is planning to commission a third-party AI system to make decisions using sensitive data. Which of the following metrics is MOST important for the organization to consider?

  A. Model response time
  B. Service availability
  C. Accessibility rating
  D. Accuracy thresholds
  D. Accuracy thresholds

  ---

  When AI systems make consequential decisions over sensitive data, AAISM requires explicit performance thresholds tied to decision quality-i.e., accuracy (and related error/false-rate limits) aligned to business risk appetite and regulatory expectations. Availability and latency are important service metrics, but decision integrity and error bounds are primary risk drivers in sensitive contexts. Establishing, monitoring, and enforcing minimum accuracy thresholds (with subgroup performance checks) is essential to

  reduce harm, ensure fairness/compliance, and support auditability.

  References:. AI Security Management. (AAISM) Body of Knowledge: Risk-aligned performance metrics; decision quality thresholds; harm and error-rate governance in sensitive processing.. AI Security Management. Study Guide: Metric selection for high-risk AI; accuracy, false positive/negative limits, and acceptance criteria tied to business controls.

• Question 67:

  When integrating AI for innovation, which of the following can BEST help an organization manage security risk?

  A. Re-evaluating the risk appetite
  B. Seeking third-party advice
  C. Evaluating compliance requirements
  D. Adopting a phased approach
  D. Adopting a phased approach

  ---

  AAISM emphasizes that when introducing innovative AI systems, organizations reduce security and compliance risk by following a phased adoption approach. This allows incremental deployment, controlled testing, and gradual scaling while monitoring risks in real time. Re-evaluating risk appetite and evaluating compliance are important governance steps but do not directly mitigate risks during implementation. Seeking third-party advice can add expertise but does not provide the structured control that

  phased integration offers. The most effective risk management approach for AI innovation is to adopt a phased rollout strategy.

  References:

  AAISM Exam Content Outline - AI Risk Management (Innovation and Risk Control)

  AI Security Management Study Guide - Phased Implementation Strategies

• Question 68:

  A financial services firm received a regulatory fine after a vendor switched its chatbot's AI model without due diligence, resulting in unethical investment advice to the firm's clients. Which of the following controls should be implemented by the firm to BEST prevent recurrence of this scenario?

  A. Master services agreement
  B. Shared responsibility model
  C. Data minimization
  D. Change management
  D. Change management

  ---

  AAISM requires formal change management for AI systems, including vendor-initiated changes: pre-approval, documented impact assessment (ethics/compliance/performance), regression testing, sign-off by accountable owners, and traceable release records. While MSAs (A) and shared responsibility models (B) set contractual/role baselines, they do not enforce per-change approvals. Data minimization (C) reduces exposure but does not control model substitutions.

  References: AI Security Management. (AAISM) Body of Knowledge - AI Governance: Change Control and Release Management; Third-Party AI Assurance and Approval Workflows; Accountability and Sign-off for Model Changes.

• Question 69:

  When evaluating a third-party AI service provider, which master services agreement (MSA) provision is MOST critical for managing security risk?

  A. Guaranteeing unlimited model retraining requests
  B. Sharing real-time log information
  C. Prohibiting the use of customer data for model training
  D. Restricting query volume thresholds
  C. Prohibiting the use of customer data for model training

  ---

  AAISM emphasizes strong contractual restrictions on how vendors use customer data, especially prohibiting vendors from using customer inputs to train or fine-tune shared models.

  This protects against:

  data leakage

  intellectual property exposure

  regulatory violations

  shadow training of external models

  Log sharing (B) and query limits (D) are operational controls but do not directly prevent data misuse.

  Unlimited retraining (A) has no relevance to security.

  References: AAISM Study Guide - Vendor Risk Management; Data Usage Restrictions in Contracts.

• Question 70:

  In a new supply chain management system, AI models used by participating parties are interactively connected to generate advice in support of management decision making. Which of the following is the GREATEST challenge related to this architecture?

  A. Establishing clear lines of responsibility for AI model outputs
  B. Identifying hallucinations returned by AI models
  C. Determining the aggregate risk of the system
  D. Explaining the overall benefit of the system to stakeholders
  A. Establishing clear lines of responsibility for AI model outputs

  ---

  The AAISM governance framework notes that in multi-party AI ecosystems, the greatest challenge is ensuring clear accountability for AI outputs. When models from different parties interact, responsibility for errors, bias, or harmful recommendations can be unclear, leading to disputes and compliance gaps. While aggregate risk assessment and error identification are significant, they are secondary to the fundamental governance requirement of establishing transparent lines of responsibility. Without defined

  accountability, no stakeholder can reliably manage or mitigate risks. Therefore, the greatest challenge in such a distributed architecture is responsibility for AI outputs.

  References:

  AAISM Study Guide - AI Governance and Program Management (Accountability in Multi-Party Systems)

  ISACA AI Governance Guidance - Roles and Responsibilities in AI Collaboration