Isaca AAISM Online Practice Questions and Exam Preparation

Isaca AAISM Online Questions & Answers

• Question 81:

  Which of the following BEST ensures AI components are validated during disaster recovery testing?

  A. Running simulated data-loss scenarios by deleting test feature-store records
  B. Disconnecting model training clusters to test retraining workflows
  C. Simulating DoS attacks on AI APIs
  D. Monitoring model performance during failover and recovery
  D. Monitoring model performance during failover and recovery

  ---

  AAISM states that AI disaster recovery testing must validate that models behave correctly during failover.

  The only option that tests actual operational continuity of AI components is:

  # monitoring model performance during failover

  This validates stability, functionality, and resilience under disaster conditions.

  Options A, B, and C test isolated scenarios but do not validate end-to-end AI operational continuity.

  References: AAISM Study Guide - AI Resilience and Disaster Recovery Testing.

• Question 82:

  A global organization has experienced multiple incidents of staff copying confidential data into public chatbots and acting on the model outputs. Which of the following is MOST important to reduce short-term risk when launching an AI security awareness initiative?

  A. Blocking access to public large language models (LLMs) at the network perimeter
  B. Requiring employees to complete an annual generic phishing and deepfake awareness module
  C. Delivering role-based and scenario-driven AI security training mapped to policy and job functions
  D. Publishing an AI acceptable use policy and collecting e-signatures of employees
  C. Delivering role-based and scenario-driven AI security training mapped to policy and job functions

  ---

  AAISM prescribes targeted, role-based, scenario-driven training aligned to policy and job tasks as the highest-impact near-term intervention for human-factor AI risks. By mapping concrete "do/don't" behaviors (e.g., what data may/may not be pasted into public chatbots, required redaction steps, approved tools, verification of outputs) to specific roles, organizations rapidly reduce incident likelihood and harmful actions.

  A (blocking) is a technical containment option but is not an awareness-initiative control and may cause workarounds; AAISM treats it as complementary, not a substitute for behavior change.

  B generic modules fail to address the specific misuse pattern.

  D signatures provide attestations without ensuring comprehension or changed behavior.

  References:. AI Security Management. (AAISM) Body of Knowledge: Human-centric Controls-Role-based training, policy-to-practice mapping, and scenario exercises for rapid risk reduction.. AI Security Management. Study Guide: Awareness program design for generative AI misuse; behavior-anchored training outcomes.

• Question 83:

  Which of the following is the MOST important consideration for an organization that has decided to adopt AI to leverage its competitive advantage?

  A. Develop a comprehensive strategic roadmap for AI integration
  B. Develop a comprehensive risk management process to address AI-related issues
  C. Develop internal training programs on AI governance, risk, and compliance (GRC)
  D. Develop a business case for the procurement of AI monitoring tools
  A. Develop a comprehensive strategic roadmap for AI integration

  ---

  AAISM's governance guidance emphasizes that adopting AI for competitive advantage must begin with a

  comprehensive strategic roadmap for integration. This roadmap aligns AI adoption with business objectives,

  sets priorities, defines milestones, and ensures coordination across functions. Risk management, training, and

  tool procurement are essential, but they are tactical steps that follow once the strategic direction is defined.

  Without a roadmap, adoption becomes fragmented and risks misalignment with business strategy. The most

  important consideration at the adoption stage is therefore creating a strategic integration roadmap.

  References:

  AAISM Exam Content Outline - AI Governance and Program Management (Strategy and Roadmapping)

  AI Security Management Study Guide - Business Alignment of AI Initiatives

• Question 84:

  Which of the following is the MOST important factor to consider when selecting industry frameworks to align organizational AI governance with business objectives?

  A. Risk tolerance
  B. Risk threshold
  C. Risk register
  D. Risk appetite
  D. Risk appetite

  ---

  According to AAISM governance principles, the risk appetite of the organization is the most important factor in selecting appropriate frameworks for AI governance. Risk appetite defines the level of risk an organization is willing to accept in pursuit of its objectives, ensuring frameworks are aligned with strategic goals. Risk tolerance and thresholds are operational measures derived from appetite, and the risk register is a documentation tool. The foundational consideration for framework alignment is the

  organization's risk appetite.

  References:

  AAISM Exam Content Outline - AI Governance and Program Management (Risk Appetite in Governance Alignment)

  AI Security Management Study Guide - Framework Selection and Business Strategy

• Question 85:

  An aerospace manufacturer prioritizing accuracy and security wants to use generative AI. Which LLM adoption plan BEST aligns with its risk appetite?

  A. Developing a private LLM to automate non-critical functions
  B. Contracting LLM access from a reputable third-party provider
  C. Developing a public LLM to automate critical functions
  D. Purchasing an LLM dataset on the open market
  A. Developing a private LLM to automate non-critical functions

  ---

  AAISM notes that high-security industries (e.g., aerospace) should prefer private, controlled environments with restricted data exposure. Developing a private LLM for non-critical workloads minimizes operational and security risk while enabling innovation. Public LLMs for critical functions (C) violate safety expectations. Purchased datasets (D) introduce unknown provenance. Outsourcing (B) increases third-party risk.

  References: AAISM Study Guide - AI Governance; Safe LLM Adoption Strategies.

• Question 86:

  An organization is deploying a large language model (LLM) and is concerned that input manipulations may compromise its integrity. Which of the following is the MOST effective way to determine an acceptable risk threshold?

  A. Restrict all user inputs containing special characters
  B. Deploy a real-time logging and monitoring system
  C. Implement a static risk threshold by limiting LLM outputs
  D. Assess the business impact of known threats
  D. Assess the business impact of known threats

  ---

  AAISM requires that risk thresholds/tolerances be set by aligning threat likelihood and impact with the organization's business context and risk appetite. Determining "acceptable" risk starts with assessing business impact of credible threats (e.g., prompt injection leading to data exfiltration, policy evasion, or harmful actions), then translating this into control intensity and thresholds. Hard input restrictions (A) and static output caps (C) are blunt measures that may degrade utility without ensuring alignment to risk appetite. Monitoring (B) is essential for detection, but it does not, by itself, define what level of risk is acceptable.

  References: AI Security Management. (AAISM) Body of Knowledge - Risk Appetite and Tolerance for AI; Threat Modeling for LLMs; Business Impact Analysis and Risk Acceptance Criteria.

• Question 87:

  Which of the following is the MOST important course of action prior to placing an in-house developed AI solution into production?

  A. Perform a privacy, security, and compliance gap analysis
  B. Deploy a prototype of the solution
  C. Obtain senior management sign-off
  D. Perform testing, evaluation, validation, and verification
  D. Perform testing, evaluation, validation, and verification

  ---

  AAISM lifecycle governance guidance specifies that before any AI solution is moved into production, it must undergo testing, evaluation, validation, and verification to ensure accuracy, resilience, security, and compliance with standards. These steps confirm that the solution performs as expected under varied conditions. Conducting gap analysis is part of compliance checks but comes earlier in design. Management sign-off provides approval but cannot substitute for assurance of technical reliability.

  Deploying prototypes is a testing method but not the final assurance step. The critical requirement is a complete cycle of testing, validation, and verification.

  References:

  AAISM Exam Content Outline - AI Risk Management (Lifecycle Testing and Validation)

  AI Security Management Study Guide - Production Readiness Checks

• Question 88:

  A PRIMARY objective of responsibly providing AI services is to:

  A. Enable AI models to operate autonomously
  B. Ensure the confidentiality and integrity of data processed by AI models
  C. Build trust for decisions and predictions made by AI models
  D. Improve the ability of AI models to learn from new data
  C. Build trust for decisions and predictions made by AI models

  ---

  AAISM emphasizes that the primary objective of responsible AI is to establish and maintain trust in AI-driven decisions and predictions. Trust is achieved through transparency, accountability, fairness, and governance. While confidentiality and integrity are critical technical objectives, they are not the overarching purpose of responsible AI service provision. Autonomy and learning ability are features of AI, but without trust, adoption and compliance falter. The correct answer is that responsible AI services must

  focus on building trust in AI

  outcomes.

  References:

  AAISM Exam Content Outline - AI Governance and Program Management (Responsible AI Principles)

  AI Security Management Study Guide - Trust and Ethical AI Adoption

• Question 89:

  Which of the following BEST describes the role of transparency in AI?

  A. Talking through a decision tree to better understand how the algorithm made each of its choices
  B. Publishing AI mechanisms, data sources, and decision-making processes while making them openly available
  C. Explaining the AI system in an understandable and logical way so reasons for decisions can be given
  D. Persuading someone that the AI tool in use is beneficial and operates as expected
  C. Explaining the AI system in an understandable and logical way so reasons for decisions can be given

  ---

  Transparency in AI is a governance principle requiring that systems be explainable to stakeholders in ways that are understandable and meaningful, enabling clear articulation of how decisions were reached and why. Within an AI program, transparency supports accountability, auditability, and trust by ensuring that reasons for decisions can be communicated and scrutinized. Option C reflects this definition by focusing on intelligible, logical explanations of system behavior and decision rationale. Option A is a narrow technique (model-specific interpretability for decision trees) and does not capture transparency as a broad governance requirement. Option B conflates transparency with full public disclosure; transparency does not require making all artifacts openly available. Option D is persuasion/advocacy, not transparency.

  References: AI Security Management. (AAISM) Body of Knowledge: "AI Governance-Transparency and Explainability," "Accountability and Assurance"; AAISM Study Guide: "Explainability Objectives and Stakeholder Communication," "Documentation for Decision Rationale."

• Question 90:

  Which testing technique is BEST for determining how an AI model makes decisions?

  A. Red team
  B. Black box
  C. White box
  D. Blue team
  C. White box

  ---

  AAISM indicates that white-box testing allows evaluators full visibility into: . internal logic . weights .

  decision pathways . model architecture This makes it ideal for understanding how decisions are made. Black box (B) provides no internal visibility. Red/blue team tests (A, D) focus on security, not decision

  mechanics.

  References: AAISM Study Guide - AI Testing; Explainability Through White-Box Analysis.