support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  1. Home
  2. Exams
  3. ISACA
  4. AAISM

ISACA AAISM Exam Prep
ISACA Advanced in AI Security Management (Page 10 )

Updated On: 24-Aug-2026
Page 6 of 33
PDF with 371 Questions

Which of the following would BEST help to prevent the compromise of a facial recognition AI system through the use of alterations in facial appearance?

  1. Enhancing training data to increase variance
  2. Monitoring the system for misuse cases
  3. Fine-tuning the AI model to decrease hallucinations
  4. Implementing a secondary AI system to confirm images

Answer(s): A

Explanation:

AAISM materials note that adversaries may attempt to bypass facial recognition by disguising or altering appearance. The most effective mitigation is to enhance training data with a wide range of variances in facial features, lighting, and disguises so the system can robustly detect authentic users despite adversarial attempts. Monitoring and secondary confirmation are supportive controls but are reactive. Fine-tuning to reduce hallucinations is irrelevant in this context, as hallucinations apply more to generative AI. The best preventive measure is strengthening the model with diverse, variance-rich training data.


Reference:

AAISM Study Guide ­ AI Technologies and Controls (Robust Training Data Strategies)

ISACA AI Security Management ­ Biometric AI Security Risks



Which of the following information is MOST important to include in a centralized AI inventory?

  1. Ownership and accountability of AI systems
  2. AI model use cases
  3. Training data sets
  4. Foundation model and package registry

Answer(s): A

Explanation:

AAISM governance practices identify ownership and accountability as the most critical element in any centralized AI inventory. An AI inventory provides oversight by cataloging all AI assets within an organization, and assigning responsibility ensures that each system has clear governance, monitoring, and compliance coverage.
While use cases, training data, and registries are valuable metadata, they do not guarantee accountability. Without defined ownership, no party is responsible for addressing risk, bias, or incidents. Therefore, the most important information to include is ownership and accountability details for each AI system.


Reference:

AAISM Exam Content Outline ­ AI Governance and Program Management (AI Inventories and Oversight)

AI Security Management Study Guide ­ Ownership and Accountability Structures



An organization is facing a deepfake attack intended to manipulate stock prices. The organization's crisis communication plan has been activated.
Which of the following is MOST important to include in the initial response?

  1. Conduct employee awareness training on recognizing deepfake videos and audio
  2. Provide clarifying information in a pre-approved public statement
  3. Conduct a detailed forensic analysis to identify the source of the deepfake
  4. Engage with brand monitoring services to track social media activity

Answer(s): B

Explanation:

AAISM guidance on crisis management and communication emphasizes that the initial priority in responding to a reputational or market manipulation attack is to provide accurate clarifying information to the public through a pre-approved statement. This ensures stakeholders and markets are given verified facts immediately, limiting the spread of misinformation.
While forensic analysis, employee training, and monitoring activities are important, they occur after the immediate need for public trust and damage control is addressed. Pre-approved statements are a central control in AI- related incident response to ensure consistency, timeliness, and credibility in communications.


Reference:

AAISM Study Guide ­ AI Governance and Program Management (Incident Response and Crisis Communication)

ISACA AI Security Management ­ Public Communication and Trust Preservation



An organization has requested a developer to apply AI algorithms to existing modules in order to improve customer service quality. At this stage, which of the following should be considered FIRST?

  1. The developer may need to be held accountable for business inquiries raised by customers
  2. IT management may need to revise the service agreement if AI behavior cannot be predefined
  3. Project sponsors may need to agree on a phased approach in order to ensure safe release
  4. The organization may need to explain the performance of the applied AI algorithm

Answer(s): B

Explanation:

According to AAISM governance principles, when AI functionality is added to existing services, the first consideration is contractual and service-level accountability. If AI outputs cannot be predefined, the existing service agreements may no longer reflect performance responsibilities or liability. Revising or updating the agreement ensures governance alignment, accountability, and risk management for AI-driven behavior. Phased approaches and performance explanations are valuable but occur later in project management. Developer accountability for customer inquiries is not a primary governance step. The most immediate consideration is revising service agreements when AI introduces new uncertainties.


Reference:

AAISM Exam Content Outline ­ AI Governance and Program Management (Policies and Service Agreements)

AI Security Management Study Guide ­ Accountability in AI Deployments



Which of the following is MOST important to monitor in order to ensure the effectiveness of an organization's AI vendor management program?

  1. Vendor compliance with AI-related requirements
  2. Vendor reviews of external AI threat reports
  3. Vendor results in compliance training programs
  4. Vendor participation in industry AI research

Answer(s): A

Explanation:

The AAISM framework specifies that the primary metric of effectiveness in vendor management is the vendor's compliance with AI-related requirements defined in contracts and governance frameworks. This provides measurable assurance that vendors adhere to agreed-upon privacy, security, and ethical standards. Reviews of threat reports, training results, or research participation are supplemental and may support continuous improvement, but they do not establish compliance accountability. Governance requires a direct focus on whether contractual and regulatory obligations are being fulfilled. Therefore, vendor compliance with AI requirements is the most important monitoring focus.


Reference:

AAISM Study Guide ­ AI Risk Management (Third-Party Risk Oversight)

ISACA AI Security Management ­ Vendor Compliance Monitoring



When an attacker uses synthetic data to reverse engineer an organization's AI model, it is an example of which of the following types of attack?

  1. Distillation
  2. Inversion
  3. Prompt
  4. Poisoning

Answer(s): B

Explanation:

AAISM defines model inversion attacks as those where adversaries use queries or synthetic data to reconstruct sensitive information or approximate the inner workings of a model. By exploiting outputs, attackers attempt to reverse engineer training data or model functionality. Distillation refers to compressing models, not adversarial attacks. Prompt attacks relate to manipulating language model inputs, and poisoning occurs when adversaries corrupt training data rather than infer from outputs. The scenario describes attackers using synthetic data to reveal hidden characteristics, which aligns directly with inversion attacks.


Reference:

AAISM Exam Content Outline ­ AI Technologies and Controls (Attack Types and Mitigations)

AI Security Management Study Guide ­ Model Inversion Risks



Which of the following is MOST important for an organization to consider when implementing a preventive security safeguard into a new AI product?

  1. Input sanitization
  2. Model output monitoring
  3. Penetration testing
  4. Differential privacy

Answer(s): A

Explanation:

AAISM materials emphasize that the most effective preventive safeguard is to ensure input sanitization. Preventive controls stop malicious or malformed inputs from reaching the model in the first place, thereby reducing the likelihood of prompt injection, evasion, or poisoning at inference time. Model output monitoring is a detective control, not preventive. Penetration testing is an assessment technique rather than a safeguard. Differential privacy protects data privacy but does not prevent adversarial input manipulation. Therefore, the most important preventive safeguard in a new AI product is robust input sanitization.


Reference:

AAISM Study Guide ­ AI Technologies and Controls (Preventive vs. Detective Safeguards)

ISACA AI Security Management ­ Input Validation in AI Systems



Which of the following BEST ensures the integrity of data sets used to train AI models?

  1. Collection and retention of only necessary data sets
  2. Tracking and verification of data sets via cryptographic controls
  3. Appropriate storage of data sets according to documented classification processes
  4. Clear documentation of data sources, types used, and processing steps

Answer(s): B

Explanation:

AAISM defines cryptographic tracking and verification as the best control for ensuring the integrity of training data. By applying hashing and verification methods, organizations can confirm that datasets remain unaltered and authentic throughout collection, storage, and processing. Collecting only necessary data, proper storage, or clear documentation all support governance and compliance, but they do not guarantee that the data has not been tampered with. Integrity is specifically ensured by cryptographic verification techniques.


Reference:

AAISM Exam Content Outline ­ AI Risk Management (Data Integrity and Protection)

AI Security Management Study Guide ­ Cryptographic Controls for Dataset Integrity



  PDF
Viewing page 10 of 33
Viewing questions 73 - 80 out of 371 questions


Post your Comments and Discuss ISACA AAISM exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!