Which of the following should be done FIRST when developing an acceptable use policy for generative AI?
Answer(s): C
Before creating an acceptable use policy, the organization must clearly define what the AI will be used for and in which contexts. Establishing the scope and intended use provides a foundation for aligning the policy with regulatory requirements, legal considerations, and internal governance standards.
An organization needs large data sets to perform application testing. Which of the following would BEST fulfill this need?
AI data augmentation generates additional training or testing data by creating modified versions of existing datasets (e.g., through transformations, synthesis, or simulation). This approach expands dataset size while maintaining relevance and variability, supporting effective application testing without relying solely on external sources.
In the context of generative AI, which of the following would be the MOST likely goal of penetration testing during a red-teaming exercise?
Answer(s): A
Penetration testing in red-teaming aims to uncover vulnerabilities by crafting adversarial inputs that cause the model to produce unexpected, unsafe, or incorrect outputs - validating robustness and revealing exploitable failure modes.
Which of the following is MOST important for an organization to consider when implementing a preventive security safeguard into a new AI product?
Answer(s): B
Input sanitization ensures that any data fed into the AI system is clean, well-formed, and free from malicious content. As a preventive security safeguard, it reduces the risk of attacks (e.g., injection, poisoning, or adversarial inputs) before they can compromise the AI model’s behavior or integrity.
As organizations increasingly rely on vendors to develop AI systems, which of the following is the MOST effective way to monitor vendors and ensure compliance with ethical and security standards?
Regular audits provide an independent, systematic way to verify that vendors comply with ethical, security, and regulatory standards throughout the AI development lifecycle. This approach ensures accountability and identifies gaps or risks that self-attestation or internal monitoring alone might miss.
Post your Comments and Discuss ISACA AAISM exam prep with other Community members: