A financial institution plans to deploy an AI system to provide credit risk assessments for loan applications. Which of the following should be given the HIGHEST priority in the system's design to ensure ethical decision-making and prevent bias?
Answer(s): C
In AI governance frameworks, credit scoring is treated as a high-risk application. For such systems, the highest-priority safeguard is human oversight to ensure fairness, accountability, and prevention of bias in automated decisions.The AI Security ManagementTM (AAISM) domain of AI Governance and Program Management emphasizes that high-impact AI systems require explicit governance structures and human accountability. Human-in-the-loop design ensures that final decisions remain the responsibility of human experts rather than being fully automated. This is particularly critical in financial contexts, where biased outputs can affect individuals' access to credit and create compliance risks.Official ISACA AI governance guidance specifies:High-risk AI systems must comply with strict requirements, including human oversight, transparency, and fairness.The purpose of human oversight is to reduce risks to fundamental rights by ensuring humans can intervene or override an automated decision.Bias controls are strengthened by requiring human review processes that can analyze outputs and prevent unfair discrimination.Why other options are not the highest priority:A . Regular updates improve accuracy but do not guarantee fairness or ethical decision-making. Model drift can introduce new bias if not governed properly.B . Appeals mechanisms are important for accountability, but they operate after harm has occurred. Governance frameworks emphasize prevention through human oversight in the decision loop.D . Restricting criteria to "objective metrics" is insufficient, as even objective data can contain hidden proxies for protected attributes. Bias mitigation requires monitoring, testing, and human oversight, not only feature restriction.AAISM Domain Alignment:Domain 1 AI Governance and Program Management: Ensures accountability, ethical oversight, and governance structures.Domain 2 AI Risk Management: Identifies and mitigates risks such as bias, discrimination, and lack of transparency.Domain 3 AI Technologies and Controls: Provides the technical enablers for implementing oversight mechanisms and bias detection tools.Reference from AAISM and ISACA materials:AAISM Exam Content Outline Domain 1: AI Governance and Program Management (roles, responsibilities, oversight).ISACA AI Governance Guidance (human oversight as mandatory in high-risk AI applications).Bias and Fairness Controls in AI (human review and intervention as a primary safeguard).
A retail organization implements an AI-driven recommendation system that utilizes customer purchase history. Which of the following is the BEST way for the organization to ensure privacy and comply with regulatory standards?
Answer(s): B
According to the AI Security ManagementTM (AAISM) study framework, compliance with privacy and regulatory standards must begin with a formalized process of identifying, documenting, and maintaining applicable obligations. The guidance explicitly notes that organizations should maintain a comprehensive register of legal and regulatory requirements to ensure accountability and alignment with privacy laws. This register serves as the foundation for all governance, risk, and control practices surrounding AI systems that handle personal data.Maintaining such a register ensures that the recommendation system operates under the principles of privacy by design and privacy by default. It allows decision-makers and auditors to trace every AI data processing activity back to relevant compliance obligations, thereby demonstrating adherence to laws such as GDPR, CCPA, or other jurisdictional mandates.Other measures listed in the options contribute to good practice but do not achieve the same direct compliance outcome. Retraining models improves technical accuracy but does not address legal obligations. Oversight committees are valuable but require the documented register as a baseline to oversee effectively. Indefinite storage of customer data contradicts regulatory requirements, particularly the principle of data minimization and storage limitation.AAISM Domain Alignment:This requirement falls under Domain 1 AI Governance and Program Management, which emphasizes organizational accountability, policy creation, and maintaining compliance documentation as part of a structured governance program.Reference from AAISM and ISACA materials:AAISM Exam Content Outline Domain 1: AI Governance and Program ManagementAI Security Management Study Guide Privacy and Regulatory Compliance ControlsISACA AI Governance Guidance Maintaining Registers of Applicable Legal Requirements
An organization is updating its vendor arrangements to facilitate the safe adoption of AI technologies. Which of the following would be the PRIMARY challenge in delivering this initiative?
In the AAISMTM guidance, vendor management for AI adoption highlights that large AI providers often resist contractual changes, particularly when customers seek to impose stricter security, transparency, or ethical obligations. The official study materials emphasize that while organizations must evaluate AI risk and build internal expertise, the primary challenge lies in negotiating acceptable contractual terms with dominant AI vendors who may not be willing to adjust their standardized agreements. This resistance limits the ability of organizations to enforce oversight, bias controls, and compliance requirements contractually.
AAISM Exam Content Outline AI Risk ManagementAI Security Management Study Guide Third-Party and Vendor Risk
After implementing a third-party generative AI tool, an organization learns about new regulations related to how organizations use AI. Which of the following would be the BEST justification for the organization to decide not to comply?
The AAISM framework clarifies that compliance decisions must always be tied to an organization's risk appetite and tolerance. When new regulations emerge, management may choose not to comply if the associated risk remains within the documented and approved risk appetite, provided that accountability is established and governance structures support this decision. Other options such as widespread industry use, third-party audits, or lack of cost assessment do not justify noncompliance under the governance principles. The risk appetite framework is the only recognized justification under AI governance principles.
AAISM Study Guide AI Governance and Program ManagementISACA AI Risk Guidance Risk Appetite and Compliance Decisions
Which of the following is the MOST serious consequence of an AI system correctly guessing the personal information of individuals and drawing conclusions based on that information?
The AAISM curriculum states that the most serious privacy concern occurs when AI systems infer and disclose sensitive personal or group information without the knowledge or consent of the individuals. This constitutes a direct breach of privacy rights and data protection principles, including those enshrined in GDPR and other global regulations. While litigation, reputational damage, or loss of trust are significant consequences, the unauthorized revelation of personal information through inference is classified as the most severe, because it directly undermines individual autonomy and confidentiality.
AAISM Exam Content Outline AI Risk ManagementAI Security Management Study Guide Privacy and Confidentiality Risks
Which of the following should be done FIRST when developing an acceptable use policy for generative AI?
Answer(s): A
According to the AAISM framework, the first step in drafting an acceptable use policy is defining the scope and intended use of the AI system. This ensures that governance, regulatory considerations, risk assessments, and alignment with organizational policies are all tailored to the specific applications and functions the AI will serve. Once scope and intended use are clearly defined, legal, regulatory, and risk considerations can be systematically applied. Without this step, policies risk being generic and misaligned with business objectives.
AAISM Study Guide AI Governance and Program Management (Policy Development Lifecycle)ISACA AI Governance Guidance Defining Scope and Use Priorities
A model producing contradictory outputs based on highly similar inputs MOST likely indicates the presence of:
The AAISM study framework describes evasion attacks as attempts to manipulate or probe a trained model during inference by using crafted inputs that appear normal but cause the system to generate inconsistent or erroneous outputs. Contradictory results from nearly identical queries are a typical symptom of evasion, as the attacker is probing decision boundaries to find weaknesses. Poisoning attacks occur during training, not inference, while membership inference relates to exposing whether data was part of the training set, and model exfiltration involves extracting proprietary parameters or architecture. The clearest indication of contradictory outputs from similar queries therefore aligns directly with the definition of evasion attacks in AAISM materials.
AAISM Study Guide AI Technologies and Controls (Adversarial Machine Learning and Attack Types)ISACA AI Security Management Inference-time Attack Scenarios
Which of the following recommendations would BEST help a service provider mitigate the risk of lawsuits arising from generative AI's access to and use of internet data?
The AAISM materials highlight that one of the primary legal risks with generative AI systems is the unauthorized use of copyrighted or intellectual propertyprotected data drawn from internet sources. To mitigate lawsuits, the most effective recommendation is to implement filtering logic that actively excludes data flagged for intellectual property risks before ingestion or generation. While disclosing compliance policies, appointing governance roles, or reviewing logs are supportive measures, they do not directly prevent the core liability of using restricted content. The study guide explicitly emphasizes that proactive filtering and data governance controls are the most effective safeguards against legal disputes concerning content origin.
AAISM Exam Content Outline AI Risk Management (Legal and Intellectual Property Risks)AI Security Management Study Guide Generative AI Data Governance
Share your comments for ISACA AAISM exam with other users:
are they truely latest
questions appear contemporary.
good to prepare in this site
very helpful to crack first attempt
please upload this exam
please upload the c_activate22 dump questions with answer
q10 - the answer should be a. if its c, the criteria will meet if either the prospect is not part of the suppression lists or if the job title contains vice president
this was on the exam as of 1211/2023
great for prep
i think in question 7 the first answer should be power bi portal (not power bi)
on question 10 and so far 2 wrong answers as evident in the included reference link.
wonderful material
i passed!! ...but barely! got 728, but needed 720 to pass. the exam hit me with labs right out of the gate! then it went to multiple choice. protip: study the labs!
correct answer for question 92 is c -aws shield
great !! it is really good
explanations for the answers are to the point.
how can rea next
question: 128 d is the wrong answer...should be c
thanks for az 700 dumps
thank you for this tableau dumps . it will helpfull for tableau certification
good content
just testing if the comments are real
very helpful for exam preparation
question 11: https://help.salesforce.com/s/articleview?id=sf.admin_lead_to_patient_setup_overview.htm&type=5
i think the answer to question 42 is b not c
thanks for the dump
fantastic assessments
i find the xengine test engine simulator to be more fun than reading from pdf.
nice document
thank you for making the questions and answers intractive and selectable.
answers are correct?
can i belive this dump
great site to practice for sitecore exam
good for students