Isaca AAISM Exam Questions Instant Access

Question 1

When using AI as part of incident response, which of the following BEST ensures the automation aligns with regulatory and governance obligations?

AUse deep learning models to autonomously classify all incidents

BTrain the AI incident response platform to mirror legacy response workflows and log containment

CApply anomaly detection models to filter incoming threats and automate containment

DImplement a tiered automation strategy where severity ratings inform the need for human oversight

Answer : D

AAISM prescribes risk-based, human-in-the-loop orchestration for safety-critical or regulated actions. A tiered automation strategy that gates autonomy by incident severity, data sensitivity, and regulatory requirements ensures accountability, auditability, and proportionality, satisfying governance obligations. Full autonomy (A) risks non-compliance; simply mirroring legacy workflows (B) may not meet current obligations; broad auto-containment (C) lacks necessary oversight controls.

===========

Question 2

An organization has requested a developer to apply AI algorithms to existing modules in order to improve customer service quality. At this stage, which of the following should be considered FIRST?

AThe developer may need to be held accountable for business inquiries raised by customers

BIT management may need to revise the service agreement if AI behavior cannot be predefined

CProject sponsors may need to agree on a phased approach in order to ensure safe release

DThe organization may need to explain the performance of the applied AI algorithm

Answer : B

According to AAISM governance principles, when AI functionality is added to existing services, the first consideration is contractual and service-level accountability. If AI outputs cannot be predefined, the existing service agreements may no longer reflect performance responsibilities or liability. Revising or updating the agreement ensures governance alignment, accountability, and risk management for AI-driven behavior. Phased approaches and performance explanations are valuable but occur later in project management. Developer accountability for customer inquiries is not a primary governance step. The most immediate consideration is revising service agreements when AI introduces new uncertainties.

AAISM Exam Content Outline -- AI Governance and Program Management (Policies and Service Agreements)

AI Security Management Study Guide -- Accountability in AI Deployments

Question 3

Which of the following controls would BEST help to prevent data poisoning in AI models?

AIncreasing the size of the training data set

BImplementing a strict data validation mechanism

CEstablishing continuous monitoring

DRegularly updating the foundational model

Answer : B

The most direct preventative control against data poisoning is robust data validation/ingestion gating: provenance checks, schema and constraint validation, anomaly/outlier screening, label consistency tests, and whitelist/blacklist source controls before data reaches training pipelines. Larger datasets (A) don't inherently prevent poisoning; monitoring (C) is detective; updating a foundation model (D) does not address tainted inputs entering the pipeline.

Question 4

Which of the following is the MOST important factor to consider when selecting industry frameworks to align organizational AI governance with business objectives?

ARisk tolerance

BRisk threshold

CRisk register

DRisk appetite

Answer : D

According to AAISM governance principles, the risk appetite of the organization is the most important factor in selecting appropriate frameworks for AI governance. Risk appetite defines the level of risk an organization is willing to accept in pursuit of its objectives, ensuring frameworks are aligned with strategic goals. Risk tolerance and thresholds are operational measures derived from appetite, and the risk register is a documentation tool. The foundational consideration for framework alignment is the organization's risk appetite.

AAISM Exam Content Outline -- AI Governance and Program Management (Risk Appetite in Governance Alignment)

AI Security Management Study Guide -- Framework Selection and Business Strategy

Question 5

An AI research team is developing a natural language processing model that relies on several open-source libraries. Which of the following is the team's BEST course of action to ensure the integrity of the software packages used?

AMaintain a list of frequently used libraries to ensure consistent application in projects

BScan the packages and libraries for malware prior to installation

CUse the latest version of all libraries from public repositories

DRetrain the model regularly to handle package and library updates

Answer : B

AAISM's technical control guidance emphasizes that when using open-source libraries, the best safeguard for integrity is to scan the packages for malware before installation. This ensures that compromised or malicious code does not enter the AI system environment. Maintaining lists aids consistency but not security. Always using the latest versions may introduce unverified vulnerabilities. Retraining models addresses functionality but not software integrity. Therefore, the strongest protective measure is pre-installation malware scanning of open-source packages.

AAISM Exam Content Outline -- AI Technologies and Controls (Software Supply Chain Security)

AI Security Management Study Guide -- Open-Source Package Risk Mitigation

Question 6

Which of the following AI-driven systems should have the MOST stringent recovery time objective (RTO)?

AHealth support system

BCredit risk modeling system

CCar navigation system

DIndustrial control system

Answer : D

AAISM risk guidance notes that the most stringent recovery objectives apply to industrial control systems, as downtime can directly disrupt critical infrastructure, manufacturing, or safety operations. Health support systems also require high availability, but industrial control often underpins safety-critical and real-time environments where delays can result in catastrophic outcomes. Credit risk models and navigation systems are important but less critical in terms of immediate physical and operational impact. Thus, industrial control systems require the tightest RTO.

AAISM Study Guide -- AI Risk Management (Business Continuity in AI)

ISACA AI Security Management -- RTO Priorities for AI Systems

Question 7

A financial organization is concerned about AI data poisoning. Which control BEST mitigates this risk?

AImplementing a break-glass policy

BTransparency with customers about data sources

CUsing training data from multiple sources

DDelivering AI-specific security awareness training

Answer : C

AAISM outlines that diversifying training data sources reduces the likelihood and impact of poisoning because:

* attack samples become harder to inject

* anomalies are easier to detect

* corrupted data has reduced influence on model behavior

Break-glass procedures (A) relate to incident response, not mitigation. Customer transparency (B) does not stop poisoning. Awareness training (D) is insufficient alone.

============================================

Isaca Advanced in AI Security Management AAISM Exam Questions