Isaca AAISM Practice Exam Questions

Isaca AAISM Sample Question Answers

Question # 1

When evaluating a third-party AI service provider, which master services agreement (MSA) provision is MOST critical for managing security risk? 

A. Guaranteeing unlimited model retraining requests 
B. Sharing real-time log information 
C. Prohibiting the use of customer data for model training
 D. Restricting query volume thresholds 

Show Answer

Question # 2

A security assessment revealed that attackers could access sensitive company data through chat interface injection. What is the BEST mitigation?

A. Conducting regular security audits 
B. Manually reviewing AI model outputs 
C. Implementing input validation and templates
 D. Ensuring continuous monitoring and tagging 

Show Answer

Question # 3

Which of the following would MOST effectively obtain ongoing support from stakeholders to align AI initiatives with business objectives?

A. Conducting periodic organization-wide AI staff training 
B. Addressing and optimizing AI-related risk 
C. Developing and monitoring the AI strategic roadmap 
D. Quantifying and communicating the value of AI solutions 

Show Answer

Question # 4

Which of the following AI data management techniques involves creating validation and test data?

A. Training 
B. Annotating 
C. Splitting 
D. Learning 

Show Answer

Question # 5

Which of the following is the MOST critical success factor for an AI implementation project?

A. Developing and using model cards 
B. Ensuring AI risk is captured in the risk register 
C. Mapping data throughout the life cycle 
D. Obtaining senior management buy-in 

Show Answer

Question # 6

Which of the following BEST ensures AI components are validated during disaster recovery testing?

A. Running simulated data-loss scenarios by deleting test feature-store records 
B. Disconnecting model training clusters to test retraining workflows 
C. Simulating DoS attacks on AI APIs 
D. Monitoring model performance during failover and recovery 

Show Answer

Question # 7

AI developers often find it difficult to explain the processes inside deep learning systems PRIMARILY because: 

A. Training data input for learning is spread throughout the public domain and continues to change
B. Generated knowledge dynamically changes in memory without being tracked by change history logs 
C. Applied algorithms are based on probability theories to improve system performance 
D. Neural network architectures can include statistical methods that are not fully understood 

Show Answer

Question # 8

A preliminary risk assessment of a SaaS-based large language model (LLM) business support system has identified prompt injection, data poisoning, and model exfiltration as material threats. Which of the following is the BEST approach to ensure risks are treated consistently? 

A. Implementing an AI threat control matrix that maps threats to specific controls and assurance activities 
B. Applying control baselines from a recognized industry standard to AI components 
C. Relying on vendor independent audit reports and service level agreements (SLAs) as evidence of AI risk coverage 
D. Focusing resources on post-deployment red teaming and deferring control selection until post go-live feedback is received 

Show Answer

Question # 9

A vendor switched its chatbot’s AI model without due diligence, causing unethical investment advice. What control BEST prevents this scenario?

A. Master services agreement 
B. Change management 
C. Shared responsibility model 
D. Data minimization 

Show Answer

Question # 10

Which of the following is MOST important to ensure security throughout the AI data life cycle?

A. Leveraging selected open-source models 
B. Conducting periodic data reviews 
C. Restricting use of data in third-party models 
D. Maintaining a complete inventory with data lineage records 

Show Answer