support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  1. Home
  2. Exams
  3. ISACA
  4. AAISM

ISACA AAISM Exam Actual Questions
ISACA Advanced in AI Security Management (Page 5 )

Updated On: 3-Aug-2026
Page 5 of 33
PDF with 371 Questions

In a new supply chain management system, AI models used by participating parties are interactively connected to generate advice in support of management decision making.
Which of the following is the GREATEST challenge related to this architecture?

  1. Establishing clear lines of responsibility for AI model outputs
  2. Identifying hallucinations returned by AI models
  3. Determining the aggregate risk of the system
  4. Explaining the overall benefit of the system to stakeholders

Answer(s): A

Explanation:

The AAISM governance framework notes that in multi-party AI ecosystems, the greatest challenge is ensuring clear accountability for AI outputs.
When models from different parties interact, responsibility for errors, bias, or harmful recommendations can be unclear, leading to disputes and compliance gaps.
While aggregate risk assessment and error identification are significant, they are secondary to the fundamental governance requirement of establishing transparent lines of responsibility. Without defined accountability, no stakeholder can reliably manage or mitigate risks. Therefore, the greatest challenge in such a distributed architecture is responsibility for AI outputs.


Reference:

AAISM Study Guide ­ AI Governance and Program Management (Accountability in Multi-Party Systems)

ISACA AI Governance Guidance ­ Roles and Responsibilities in AI Collaboration



Which of the following is the MOST important consideration when deciding how to compose an AI red team?

  1. Resource availability
  2. AI use cases
  3. Time-to-market constraints
  4. Compliance requirements

Answer(s): B

Explanation:

AAISM materials specify that the composition of an AI red team must be tailored to the organization's AI use cases. The purpose of red-teaming is to simulate realistic adversarial conditions aligned with the actual applications of AI. For example, testing a generative model requires different expertise than testing a fraud detection system.
While resource availability, compliance requirements, and time-to-market pressures are practical considerations, they are secondary to aligning team expertise with use case scenarios. The most important factor is therefore the AI use cases themselves.


Reference:

AAISM Exam Content Outline ­ AI Risk Management (Red Teaming Considerations)

AI Security Management Study Guide ­ Tailoring Adversarial Testing to Use Cases



Which of the following is the MOST critical key risk indicator (KRI) for an AI system?

  1. The accuracy rate of the model
  2. The amount of data in the model
  3. The response time of the model
  4. The rate of drift in the model

Answer(s): D

Explanation:

AAISM highlights that while accuracy and performance metrics are important, the rate of drift is the most critical KRI for AI systems. Model drift occurs when input data or environmental conditions shift, causing the system to degrade and produce unreliable outputs. This risk indicator directly reflects whether the AI continues to function as intended over time. Accuracy rates and response times are performance metrics, not primary risk signals. The amount of data in the model does not reliably indicate exposure to risk. Therefore, the greatest KRI for ongoing assurance and governance is the rate of drift.


Reference:

AAISM Study Guide ­ AI Risk Management (Monitoring and Drift Detection)

ISACA AI Security Management ­ Key Risk Indicators for AI Systems



Which of the following controls BEST mitigates the risk of bias in AI models?

  1. Robust access control techniques
  2. Regular data reconciliation
  3. Cryptographic hash functions
  4. Diverse data sourcing strategies

Answer(s): D

Explanation:

Bias in AI models primarily stems from limitations or imbalances in training data. The AAISM study materials emphasize that the most effective way to mitigate this risk is through diverse data sourcing strategies that ensure coverage across demographics, scenarios, and contexts. Access controls protect data security, not fairness. Data reconciliation ensures accuracy but does not address representational imbalance. Cryptographic hashing preserves integrity but has no impact on bias mitigation. To reduce systemic unfairness, the critical control is sourcing diverse and representative data.


Reference:

AAISM Exam Content Outline ­ AI Technologies and Controls (Bias and Fairness Management)

AI Security Management Study Guide ­ Data Governance and Bias Reduction Strategies



Which of the following is the MOST important course of action when implementing continuous monitoring and reporting for AI-based systems?

  1. Establish an automated alert system for threshold breaches in risk metrics
  2. Develop standardized risk reporting templates for different stakeholder groups
  3. Implement real-time monitoring of key risk indicators (KRIs) for AI systems
  4. Implement a risk dashboard for visualizing and tracking AI-related risk over time

Answer(s): C

Explanation:

The AAISM governance framework specifies that the foundation of continuous monitoring is real- time tracking of key risk indicators. This ensures immediate detection of deviations, model drift, and operational anomalies. Automated alerts, dashboards, and reporting templates all support monitoring, but they rely on the presence of accurate, real-time KRI measurement as their source. Without live monitoring, the other controls are reactive rather than proactive. The most important course of action in establishing effective continuous monitoring is therefore real-time KRI tracking.


Reference:

AAISM Study Guide ­ AI Governance and Program Management (Continuous Monitoring and Assurance)

ISACA AI Risk Guidance ­ Monitoring Key Risk Indicators



Which of the following is the MOST important consideration for an organization that has decided to adopt AI to leverage its competitive advantage?

  1. Develop a comprehensive strategic roadmap for AI integration
  2. Develop a comprehensive risk management process to address AI-related issues
  3. Develop internal training programs on AI governance, risk, and compliance (GRC)
  4. Develop a business case for the procurement of AI monitoring tools

Answer(s): A

Explanation:

AAISM's governance guidance emphasizes that adopting AI for competitive advantage must begin with a comprehensive strategic roadmap for integration. This roadmap aligns AI adoption with business objectives, sets priorities, defines milestones, and ensures coordination across functions. Risk management, training, and tool procurement are essential, but they are tactical steps that follow once the strategic direction is defined. Without a roadmap, adoption becomes fragmented and risks misalignment with business strategy. The most important consideration at the adoption stage is therefore creating a strategic integration roadmap.


Reference:

AAISM Exam Content Outline ­ AI Governance and Program Management (Strategy and Roadmapping)

AI Security Management Study Guide ­ Business Alignment of AI Initiatives



Personal data used to train AI systems can BEST be protected by:

  1. Erasing personal data after training
  2. Ensuring the quality of personal data
  3. Anonymizing personal data
  4. Hashing personal data

Answer(s): C

Explanation:

AAISM guidance on privacy-preserving AI highlights anonymization as the most effective means of protecting personal data used in training. By irreversibly removing or masking identifiable attributes, anonymization ensures that training data cannot be linked back to individuals, thereby meeting key privacy obligations under laws such as GDPR. Erasing data after training may limit exposure but does not protect it during the training process. Ensuring data quality improves accuracy but does not mitigate privacy risk. Hashing protects data integrity but does not guarantee anonymity, as hashes can sometimes be reversed or correlated. Therefore, anonymization is the recommended control for protecting personal data in AI training.


Reference:

AAISM Study Guide ­ AI Technologies and Controls (Privacy-Preserving Methods)

ISACA AI Security Management ­ Data Anonymization Practices



How can an organization BEST protect itself from payment diversions caused by deepfake attacks impersonating management?

  1. Require mandatory deepfake detection training for all employees
  2. Mandate that payments be sent only once per week
  3. Issue a security policy on deepfakes
  4. Implement resilient payment approval processes

Answer(s): D

Explanation:

AAISM's risk management framework stresses that the most effective defense against deepfake- enabled fraud, such as payment diversion, is resilient payment approval processes. This includes multi-step verification, segregation of duties, and independent confirmations for high-value transactions. Employee training, policies, or limiting payment frequency may reduce exposure, but they cannot guarantee prevention. Only process-based controls enforce structural safeguards that prevent fraudulent instructions from being executed, even if a deepfake impersonation attempt is successful.


Reference:

AAISM Exam Content Outline ­ AI Risk Management (Fraud and Deepfake Risk)

AI Security Management Study Guide ­ Transactional Resilience and Controls



  PDF
Viewing page 5 of 33
Viewing questions 33 - 40 out of 371 questions


Post your Comments and Discuss ISACA AAISM exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!