AAISM Certification Exam Questions with AI Explanations

QUESTION: 41

The PRIMARY reason to conduct a privacy impact assessment (PIA) on an AI system is to:

Identify applicable regulations
Determine whether personal data is poisoned
Build customer confidence
Analyze how personal data is handled

Answer(s): D

Explanation:

According to AAISM privacy governance guidance, the primary reason for conducting a PIA is to analyze how personal data is collected, processed, shared, and retained by an AI system. This analysis ensures compliance with privacy laws, mitigates risks to individuals, and informs necessary safeguards. Identifying regulations is part of compliance but is secondary to analyzing actual data handling. Building customer confidence is an outcome, not the main purpose. Checking for poisoned data relates to data quality, not privacy assessment. The fundamental purpose of a PIA is therefore to analyze the handling of personal data.

Reference:

AAISM Study Guide AI Governance and Program Management (Privacy Impact Assessments)

ISACA AI Security Management Data Handling and Privacy Risk

Reveal Solution Next Question

QUESTION: 42

Which of the following AI system vulnerabilities is MOST easily exploited by adversaries?

Inaccurate generalizations from new data by the AI model
Weak controls for access to the AI model
Lack of protection against denial of service (DoS) attacks
Inability to detect input modifications causing inappropriate AI outputs

Answer(s): B

Explanation:

AAISM study materials stress that weak access controls are the most easily exploited vulnerability in AI systems. Without strong access restrictions, adversaries can directly query, extract, manipulate, or overload models, leading to data leakage or compromised outputs.
While inaccurate generalizations, DoS vulnerabilities, or susceptibility to input manipulation are serious, they typically require more effort or specific conditions. Weak access control provides the most direct and immediate entry point for attackers. As such, it is identified as the most easily exploited vulnerability.

Reference:

AAISM Exam Content Outline AI Risk Management (Access and Authentication Vulnerabilities)

AI Security Management Study Guide Exploitable Weaknesses in AI Systems

Reveal Solution Next Question

QUESTION: 43

An organization concerned about the ethical and responsible use of a newly developed AI product should consider implementing:

Model cards
Vendor monitoring
An accountability model
Security by design

Answer(s): C

Explanation:

The AAISM framework highlights that organizations adopting AI must ensure accountability structures are in place to govern ethical and responsible use. An accountability model assigns clear responsibility for decisions, outputs, and risks related to AI systems.
While model cards provide transparency about a model's design and performance, they are primarily documentation tools. Vendor monitoring focuses on third-party oversight, not internal accountability. Security by design improves resilience but does not by itself address ethical use. The governance approach that most directly supports responsible and ethical AI deployment is an accountability model.

Reference:

AAISM Study Guide AI Governance and Program Management (Ethical AI and Accountability)

ISACA AI Security Management Responsible AI Practices

Reveal Solution Next Question

QUESTION: 44

After deployment, an AI model's output begins to drift outside of the expected range.
Which of the following is the development team's BEST course of action?

Take the AI model offline
Adjust the hyperparameters of the AI model
Create an emergency change request to correct the issue
Return to an earlier phase in the AI life cycle

Answer(s): D

Explanation:

AAISM emphasizes that when model drift occurs, the best response is not a quick fix but rather to revisit an earlier phase of the AI life cycle to address data quality, retraining, or evaluation processes. Simply taking the model offline halts functionality without resolution, while adjusting hyperparameters or issuing emergency changes treats the symptom rather than the root cause. Proper governance requires returning to the design or training phases to re-establish stability, accuracy, and compliance of the model. Thus, the correct approach is to return to an earlier AI lifecycle phase.

Reference:

AAISM Exam Content Outline AI Risk Management (Model Drift and Lifecycle Responses)

AI Security Management Study Guide Continuous Improvement in AI Lifecycle

Reveal Solution Next Question

QUESTION: 45

When implementing a generative AI system, which of the following approaches will BEST prevent misalignment between the corporate risk appetite and tolerance?

Ensuring effective AI key performance indicators (KPIs)
Performing an AI impact assessment
Creating and maintaining an AI risk register
Establishing and monitoring acceptable levels of AI system risk

Answer(s): D

Explanation:

AAISM governance guidance specifies that alignment between AI system adoption and organizational risk appetite is achieved by defining and monitoring acceptable levels of system risk. This ensures that generative AI operations remain within boundaries approved by leadership and compliance frameworks.
While KPIs track performance, they do not ensure alignment with risk tolerance. AI impact assessments help identify risks but do not maintain continuous oversight. A risk register records risks but does not dynamically enforce acceptable thresholds. The most effective governance approach is to establish and monitor acceptable AI system risk levels.

Reference:

AAISM Study Guide AI Governance and Program Management (Risk Appetite and Tolerance

Alignment)

ISACA AI Security Management Generative AI Risk Governance

Reveal Solution Next Question

QUESTION: 46

Which of the following BEST reduces the risk of exposing sensitive data through the output of large language models (LLMs) in applications?

Encrypting data in transit and at rest
Conducting adversarial testing
Implementing data sanitization techniques
Enforcing least privilege access

Answer(s): C

Explanation:

AAISM materials make clear that the best safeguard against sensitive information being leaked through the outputs of LLMs is data sanitization. This involves filtering, redacting, or masking sensitive content before the model can use it, thereby preventing unintended disclosure in outputs. Encryption protects confidentiality in storage and transmission but does not stop output leaks. Adversarial testing helps identify vulnerabilities but does not prevent exposure by itself. Least privilege access restricts who can interact with the model but does not sanitize the content of its outputs. The control most directly tied to preventing leakage is implementing data sanitization techniques.

Reference:

AAISM Exam Content Outline AI Technologies and Controls (Data Leakage Prevention)

AI Security Management Study Guide Sensitive Data Controls in Generative AI

Reveal Solution Next Question

QUESTION: 47

Which of the following is the GREATEST risk inherent to implementing generative AI?

Lack of employee training
Unidentified asset vulnerabilities
Inadequate return on investment (ROI)
Potential intellectual property violations

Answer(s): D

Explanation:

The AAISM framework identifies intellectual property (IP) violations as the most significant inherent risk in deploying generative AI. These systems often rely on large-scale internet data for training, which may inadvertently contain copyrighted or proprietary material. This creates legal and reputational exposure when outputs reproduce or reference protected content.
While employee training gaps, asset vulnerabilities, and ROI concerns are relevant risks, they are not inherent to generative models themselves. The greatest inherent risk tied directly to generative AI adoption is the possibility of violating intellectual property rights.

Reference:

AAISM Study Guide AI Risk Management (Generative AI Risks and Legal Exposure)

ISACA AI Security Management Copyright and IP Concerns in Generative AI

Reveal Solution Next Question

QUESTION: 48

Which of the following should be the PRIMARY consideration for an organization concerned about liabilities associated with unforeseen behavior from agentic AI systems?

Model dependencies
Approved base models
Accountability model
Acceptable risk level

Answer(s): C

Explanation:

AAISM governance guidance stresses that when dealing with agentic AI systems capable of autonomous decision-making, the primary consideration is accountability. Without clear accountability structures, unforeseen or harmful outcomes may result in unmitigated liability for the organization.
While dependencies, base models, and defined risk levels are important, they do not directly address who is responsible when systems act unpredictably. The key governance safeguard is the implementation of an accountability model that ensures liability and oversight are properly assigned.

Reference:

AAISM Exam Content Outline AI Governance and Program Management (Accountability and Liability Management)

AI Security Management Study Guide Responsible Oversight of Agentic AI

Reveal Solution Next Question

ISACA Advanced in AI Security Management AAISM Dumps in PDF

Free ISACA AAISM Real Questions (page: 25)

QUESTION: 41

Explanation:

Reference:

QUESTION: 42

Explanation:

Reference:

QUESTION: 43

Explanation:

Reference:

QUESTION: 44

Explanation:

Reference:

QUESTION: 45

Explanation:

Reference:

QUESTION: 46

Explanation:

Reference:

QUESTION: 47

Explanation:

Reference:

QUESTION: 48

Explanation:

Reference: