ISACA AAISM Exam Prep
ISACA Advanced in AI Security Management (Page 17 )

• Manage multiple organizations from one hierarchy.
• Enterprise-wide policies, including repository visibility, forking, and GitHub Copilot policies.
• Centralized identity and access management, such as SAML SSO, SCIM provisioning, and—where applicable—Enterprise Managed Users.
• Centralized billing and licensing, including organization and Copilot seat management.
• Enterprise audit log, which aggregates activity across organizations.
• Security and compliance oversight, such as organization security visibility and enterprise-wide controls.
• Enterprise support and account management features, depending on the plan.

• Organization: manages its own repositories, teams, members, and local policies.
• Enterprise: governs multiple organizations and can enforce policies across them.

• The explanation states that Traffic Analytics can be enabled by a user with one of these subscription-level roles:

• Question 34 — Network Contributor: Yes
• Question 35 — Owner: Yes
• Question 36 — Reader: Yes, according to the stated explanation and documentation

• Azure Cosmos DB is a globally distributed NoSQL database service. It stores and retrieves application data, but it does not provide the tools needed to build, test, and deploy predictive analytics models.
• Azure Machine Learning—including the historical Azure Machine Learning Studio—is designed for the machine-learning lifecycle:

• Customer contains one row per customer and the customer’s Address ID.
• Address contains one row per address and the corresponding location details.

1. Select the Customer query.
2. Choose Merge Queries.
3. Match Customer[Address ID] with Address[Address ID].
4. Use a Left outer join so every customer is retained.
5. Expand the merged Address column and select City, State/Region, and Country.

• Append adds rows vertically and is used for tables with the same structure.
• Group By summarizes rows rather than adding related columns.
• Transpose switches rows and columns and does not establish a relationship.

• IaaS provides virtualized infrastructure, including VMs, disks, and networking. You manage the guest operating system and software installed on the VM.
• PaaS provides a managed platform for deploying applications without managing the underlying VMs or operating systems. Examples include Azure App Service and Azure Functions.

• A. Extranet
• B. VLAN
• C. Intranet
• D. VPN

• The target API uses HTTPS, so Mule must validate the server’s TLS certificate.
• The TLS configuration is set to None, meaning no custom truststore is configured.
• Mule therefore uses the JRE’s default truststore to determine whether the target certificate is trusted.
• If the issuing CA certificate is in that truststore, the TLS handshake can succeed.
• If it is absent—or the certificate is otherwise invalid—the request fails with a TLS/handshake error.

json 
"Resource": "arn:aws:s3:::bucket-name/*"

• A: Revoking or changing an instance profile does not reliably invalidate temporary credentials that have already been issued and may still be valid.
• B: Changing the EC2 security group does not necessarily stop the attacker from using the stolen credentials from elsewhere.
• C: Amazon Macie helps discover sensitive data; Object Lock prevents modification/deletion, not reads or downloads.

• Planning – identifying the need, objectives, scope and resources.
• Analysis – understanding business requirements and current problems.
• Design/development – determining how the system will work.
• Implementation – installing the system and putting it into operation.

• Assignment
• Decision
• Get Records
• Loop

• Screen flow: Would include a Screen element.
• Inactive version: Inactive status does not restrict the available elements.
• Activated version: Activation status also does not determine the toolbox contents.

• Due Date
• Order Date
• Delivery Date

DAX 
Order Date = 'Due Date' 
Delivery Date = 'Due Date'

• Due Date[Date] ? Sales[Due Date]
• Order Date[Date] ? Sales[Order Date]
• Delivery Date[Date] ? Sales[Delivery Date]

• Coordinate and manage the assessment team
• Assign assessment activities
• Direct interviews, examinations, and tests
• Ensure the assessment follows the CAP

• Answer key: Lead Assessor — likely wrong
• CAP-based answer: C3PAO

1. Ensure BOMs can include subcomponents ? Configure an entity relationship

1. Report changes made by engineers ? Enable auditing

• Configure entity relationship
• Configure auditing

• Entradas grandes, de até aproximadamente 1 GB.
• Processamentos demorados, que podem levar até cerca de 1 hora.
• O cliente envia a solicitação e consulta o resultado depois, sem precisar manter uma conexão aberta durante todo o processamento.

• Real-time inference: indicada para respostas imediatas, com entradas menores e processamento rápido.
• Serverless inference: adequada para cargas variáveis e solicitações menores; não é ideal para processamento longo e arquivos grandes.
• Batch transform: processa grandes volumes em lote, mas não atende à necessidade de respostas próximas do tempo real.

• VM CPU, memory, disk, and network usage
• Storage transactions and latency
• App Service response time
• Database DTU or CPU utilization

• Azure Traffic Analytics analyzes network traffic flows and security patterns; it is not the general infrastructure metrics tool.
• Azure Activity Log records subscription-level control-plane operations, such as resource creation, deletion, or configuration changes.
• Azure Advisor provides recommendations about cost, security, reliability, performance, and operational excellence, but it is not the primary tool for investigating live metrics.

• The correct AAA mapping (per Cisco objectives) is:

• Why the given options aren’t fully correct:

• Quick takeaway: when you configure AAA, you should conceptually map them as:

• Example commands (to reinforce concepts):

• Authentication: Verifies a user’s identity, such as username and password.
• Authorization: Determines what the authenticated user is allowed to access.
• Accounting: Records connection and usage details, such as login time or session duration.

• CIA: Confidentiality, integrity, and availability are broad security objectives, not a specific RADIUS function.
• ACL: An access control list contains permit/deny rules on systems or network devices. RADIUS can support access decisions but is not itself an ACL.
• PEM: Privacy-Enhanced Mail is also associated with certificate and key encoding formats; it is unrelated to RADIUS’s primary purpose.

• A: Daily involvement is unnecessary and may not solve the availability problem.
• C: Clarifying all requirements at the start conflicts with agile’s iterative refinement.
• D: Simply reviewing based on availability leaves the problem unresolved and allows rework to continue.

• Secret scope: A named container that groups related secrets and defines access permissions. Example: finance-prod.
• Secret key: The name of an individual secret stored inside that scope. Example: db-password.

text 
Scope: finance-prod 
  Key: db-username 
  Key: db-password

python 
dbutils.secrets.get( 
    scope="finance-prod", 
    key="db-password" 
)

• Correct answer: B (No, it does not).

• A purchase agreement in Dynamics 365 SCM is a vendor-side price arrangement. It sets prices/discounts for what your company buys from suppliers, not for what you sell to customers.
• The objective in Question 2 is to give clients a quantity-based discount on items they purchase from you. To accomplish this, you should configure a sales price / trade agreement (on the customer/sales side), not a purchase agreement.
• In a sales price trade agreement, you can define quantity breaks such as:

• Create a Sales price trade agreement for the item and relevant customer (or customer group).
• Add quantity breaks: 51–100 with 10% discount, 101+ with 15% discount.
• Ensure the agreement is active for the desired date range.

• Answer: D

• The strongest security comes from enforcing access at the storage layer. An IAM policy scoped to the Cognito identity prefix restricts each user to their own S3 prefix (folder), so users can only access their own files regardless of client or server code.
• This per-user isolation reduces risk of cross-user data access and is more robust than UI validation or Lambda/API validation alone.
• Implementation note: attach a policy to the Cognito identity role that allows actions on arn:aws:s3:::your-bucket/${cognito-identity.amazonaws.com:sub}/* (per-user prefix). Ensure TLS in transit and enable at-rest encryption (SSE-S3 or SSE-KMS). Use multipart upload for large files up to 300 MB.

sql 
GRANT ALTER ON SCHEMA::schemaA TO User1;

• TRUNCATE TABLE is a DDL operation, not a normal DELETE.
• Having DELETE permission on a table is not sufficient to truncate it.
• The minimum relevant permission is ALTER on the table.
• Granting ALTER on SCHEMA::schemaA allows the user to truncate tables within schemaA.
• It does not grant equivalent permissions on schemaB or schemaC, satisfying least privilege.

• Le rôle n’a pas de clés propres. Des identifiants temporaires (via STS) sont émis lorsque quelqu’un ou quelque chose « assume » le rôle.
• La trust policy déclare qui peut assumer le rôle (par ex. une instance EC2, un utilisateur IAM, ou un service comme Lambda).
• Une fois attaché à une ressource (par exemple comme un instance profile sur une EC2), l’application peut appeler les services AWS avec les permissions du rôle.

• Respect du principe du moindre privilège: on accorde uniquement ce qui est nécessaire.
• Pas de stockages de clés sur les instances; les credentials se renouvellent automatiquement.

• Rôles pour EC2, rôles pour Lambda, accès cross-compte, etc.

• A. Number ? Decimal — Correct. Salesforce Number fields are represented in Apex as Decimal.
• D. Date/Time ? Datetime — This is correct conceptually, but “Dateline” is not an Apex type. If the option literally says “Dateline,” it is incorrect.
• E. Checkbox ? Boolean — Correct. A checkbox contains true or false.

• Number ? Integer — A Number field maps to Decimal, even when its scale is zero.
• Text Area ? List<String> — A text area maps to a single String, not a list.

• Customers access the portal without needing a full Dynamics 365 license.
• They submit case information through portal forms.
• The submitted data is stored in Dataverse tables, such as the Case table.
• Security is controlled using web roles and table permissions, so customers can access only appropriate records.

• Dynamics 365 Connector — connects apps to Dynamics 365 data but is not the portal’s underlying data platform.
• Microsoft SharePoint — useful for documents and collaboration, not the standard case-management data source for portals.
• Microsoft Azure Storage — stores files or other data, but is not the native portal business-data platform.

• In the source query: apply UPPER() or LOWER() to the column.
• In Power Query Editor: use Text.Upper or Text.Lower on the column, then load.

• This fixes the root cause when comparisons/joins depend on case.
• In DirectQuery, transformations are pushed to the source or query layer; ensure the transformation is supported by your data source/connector.
• After normalization, verify relationships and any downstream visuals that rely on that column.

• D. Provide public endpoints to store and retrieve data

• E. Manage the infrastructure layer and the operating system

• Classifying data
• Configuring access permissions, such as IAM policies
• Selecting or configuring available encryption options, depending on the requirement

• Microsoft Teams: Connects to Teams-related data, but it isn’t the primary connector for the Power Apps data tables.
• Personal Analytics: Provides personal productivity insights, not application data.
• SQL Server database: Only applies if the app explicitly uses SQL Server as its data source.
• Dataflows: Used for preparing and centralizing data, not as the normal direct connection to a Power Apps app.

• Cutover: The old system is replaced immediately. It may be fast, but any failure can cause significant disruption.
• Phased: The system is introduced in stages, which reduces implementation risk but may prolong the transition.
• Pilot: The system is first deployed to a limited group or location. This is useful for testing but does not necessarily minimize downtime for the entire organization.

sql 
SELECT COUNT(*) FROM table;

• A: It does not normally need to scan all data files for this operation.
• B: Results are not simply reused from a query cache every time. Caching is separate from Delta’s metadata optimization.
• D: The relevant metadata is maintained through the Delta transaction log, not directly treated as a Parquet-file metadata operation in this context.

• Use one Azure AD directory for the organization.
• Separate divisions with subscriptions and/or resource groups.
• Assign each division’s administrator appropriate Azure role-based access control (RBAC) permissions, scoped to their subscription or resource group.

• Assign users or their team an appropriate security role.
• Ensure the role has the required table privileges, such as read, create, write, and append.
• Share the app with that security role in the app designer.

• Dynamics administration center: Used for environment and service administration, not routine app access configuration.
• Manage Roles: Not the specific Dataverse area used to define app and data permissions.
• Security Roles: Define what users can access and which operations they can perform.

• The legacy system creates a signed JWT assertion.
• Salesforce validates the assertion using a certificate configured on a Connected App.
• Salesforce issues an access token for the integration user.
• No refresh token is required; the system can request a new access token when needed.

• Web Server Flow: normally uses a client secret and authorization/refresh tokens.
• Username-Password Flow: requires storing Salesforce credentials and is discouraged for integrations where stronger options are available.
• User Agent Flow: intended for user-interactive applications, not unattended server-to-server processing.

• ?????? CPU
• ?????????????????
• ??????????????????????????
• ???????????? throughput
• ??????????????????????????????

• A ??????? system software ????????????????????????????????? ??????????????????????????????????
• B ?????????????????????????? ????????????????????????? ?????????????????????????????
• D ????????????????????????? ?????????????? ?????????????????????????????????????????

• Works across SaaS and internal applications: TOTP is widely supported by authentication systems and can be integrated into many applications.
• Device manufacturer agnostic: A hardware token or authenticator application can generate the code without depending on a specific computer or phone manufacturer.
• Offline capability: The code is generated locally using a shared secret and the current time; an internet connection or cellular service is not required.

• Username and password: May work offline but provides weaker authentication and does not meet the intended improvement in security.
• Biometrics: Can depend on device hardware, operating-system support, and enrollment mechanisms.
• SMS verification: Requires cellular connectivity and is vulnerable to threats such as SIM swapping.

• Honeypots: Decoy systems or services designed to attract attackers. Legitimate users should not access them, so activity on a honeypot is a strong indicator of unauthorized activity. Security teams can also observe attacker behavior.

• DNS sinkhole: Redirects requests for known malicious domains to a controlled internal server or blocks them. If an infected workstation attempts to contact command-and-control infrastructure, the sinkhole records the request and helps identify the compromised device.

• Tokenization: Protects sensitive data by replacing it with tokens.
• CI/CD: Automates software development and deployment.
• Threat modeling: Identifies potential risks before or during system design.
• Data obfuscation: Makes data harder to understand, but does not detect intruders.

• Modelo de embeddings multimodal: transforma texto e imagens em vetores no mesmo espaço semântico. Isso permite comparar uma consulta textual com imagens, ou uma imagem com textos relacionados.
• Modelo generativo multimodal: interpreta diferentes modalidades e gera conteúdo, mas não é a escolha específica para indexação e busca vetorial.
• Modelo de geração de imagens: cria imagens, portanto é inadequado.
• Modelo de embeddings de texto: não atende consultas com imagens.

• Compensating control: The server is end-of-life, so it may no longer receive security patches or support. Placing it on a restricted VLAN provides an alternative layer of protection by reducing who can access it and limiting its exposure.
• Technical control: VLAN segmentation and access control lists (ACLs) are technology-based mechanisms that enforce network access restrictions automatically.

• Managerial: Policies, procedures, and governance—not network configuration.
• Physical: Locks, guards, or barriers.
• Corrective: Restores systems after an incident.
• Detective: Identifies suspicious activity rather than restricting access.
• Deterrent: Discourages behavior but does not enforce access rules.

• B: Moving the task may affect the critical path and should not be done before evaluating the planned response and impacts.
• C: Excluding a required task is not appropriate without formal analysis and stakeholder approval.
• D: Lessons learned and the risk log should be updated, but only after or alongside managing the immediate issue; updating them is not the first action.

• 25 — Traditional SMTP server-to-server mail transfer; not normally used for secure client submission.
• 110 — POP3, used to retrieve email and typically unencrypted.
• 143 — IMAP, used to access email and typically unencrypted.

• Progress iteratively with feedback focuses on making improvements in manageable steps and learning from feedback.
• Optimize and automate focuses on maximizing value from resources and automating suitable activities.
• Start where you are focuses on assessing the current situation and reusing what already exists.

• Whether a user has a console password
• Password age and last password change
• Whether MFA is enabled
• Access key status
• Access key creation date and last-use information
• Access key age, which helps audit rotation

• IAM Access Analyzer identifies unintended access to resources; it does not report credential age or rotation.
• AWS Artifact provides AWS compliance documents and agreements, not details about your IAM users.
• AWS Audit Manager helps collect evidence for audits, but it is not the direct tool for viewing IAM credential rotation details.

python 
import azure.cognitiveservices.speech as speechsdk 


speech_config = speechsdk.SpeechConfig( 
    subscription="YOUR_KEY", 
    region="YOUR_REGION" 
)

Important Azure Speech SDK classes

• SpeechConfig

• AudioConfig

python 
  audio_config = speechsdk.audio.AudioConfig( 
      use_default_microphone=True 
  )

• SpeechRecognizer

python 
  recognizer = speechsdk.SpeechRecognizer( 
      speech_config=speech_config, 
      audio_config=audio_config 
  )

• SpeechSynthesizer

• AudioOutputConfig

 Bogotá, Colombia