ISACA AAISM Practice Exam

• A. ISO/IEC 42001 for AI management systems Correct answer
• B. NIST AI Risk Management Framework and its core functions
• C. OWASP Top 10 for LLM Applications and its risk categories
• D. MITRE ATLAS and its adversary tactics for AI systems

Option A is correct because ISO/IEC 42001 is a certifiable AI management system standard, so an independent body can audit an organization against it. The NIST AI RMF is voluntary guidance with no certification, the OWASP Top 10 for LLM Applications is a catalog of risks, and MITRE ATLAS is a knowledge base of adversary tactics.

• A. Adopt the framework's practices inside the data science teams and keep the ISMS scope as it is today
• B. Pursue certification to an AI management system standard, then realign the existing processes to its requirements
• C. Map the framework's practices onto the existing ISMS and risk process, adding AI-specific controls for the gaps Correct answer
• D. Stand up a separate AI governance program with its own risk register, reviewed against the framework each year

Option C is correct because mapping framework practices onto the existing ISMS and risk process reuses established governance and adds AI-specific controls only where gaps exist. Keeping the ISMS scope unchanged leaves AI uncovered, certifying first inverts the order of work, and a separate parallel program duplicates risk management and fragments oversight.

• A. Pseudonymize the purchase history and begin training in an isolated environment while the notice question is reviewed
• B. Have legal and privacy determine whether the training purpose is compatible with the original notices before data is used Correct answer
• C. Restrict training to customers who opted into marketing e-mail, since they have already accepted promotional use
• D. Update the privacy notices to describe model training and proceed once the revised notices are published

Option B is correct because the first question is whether the new purpose is compatible with what customers were told when the data was collected, and that is a legal and privacy determination. Pseudonymizing or starting training in isolation still uses the data before that is settled, opt-in to e-mail does not cover model training, and rewriting notices afterwards does not legitimize data already collected under the old ones.

• A. A single detailed policy that lists each approved AI tool and its permitted data types, revised with each new tool
• B. A policy that adopts the regulator's current AI guidance word for word, updated when the guidance is revised
• C. Separate policies per department, each tailored to the AI tools that department has adopted
• D. A short policy of principles and risk-tier requirements, with approved tools and technical rules kept in standards Correct answer

Option D is correct because a short policy of principles and risk-tier requirements stays valid as tools change, while approved tools and technical rules live in standards that can be updated without board-level re-approval. Policies that list tools, copy regulator text, or split by department go out of date quickly or become inconsistent.

• A. Decline the request and ask the team to pilot with synthetic data until the policy itself is formally revised
• B. Approve the pilot as a temporary exception under the security manager's authority and record it in the policy register
• C. Route it through the exception process so the risk owner can accept it with compensating controls and an expiry date Correct answer
• D. Grant the exception for the pilot period and ask the team to report any incidents that occur during it

Option C is correct because a prohibition in the policy is waived only through the formal exception process, where the risk owner accepts the risk with compensating controls and an expiry date. The security manager has no authority to approve an exception alone, an informal grant with after-the-fact incident reporting lacks controls, and a flat refusal ignores the sanctioned route for a legitimate business need.

• A. Add reviewers so each can spend more time per claim, keeping the requirement that every recommendation be reviewed
• B. Require reviewers to record a written justification for each approval so that rubber-stamping becomes visible to audit
• C. Tier the review depth by claim value and model confidence, and seed test errors to confirm reviewers are scrutinizing Correct answer
• D. Retrain reviewers on automation bias and keep the procedure unchanged, then re-sample approvals next quarter

Option C is correct because the oversight has become ineffective through automation bias and volume, so review depth should be matched to claim value and model confidence, and seeded errors verify that reviewers are really scrutinizing. More reviewers, written justifications, or training alone keep an every-claim requirement that reviewers cannot meaningfully meet and do not show whether scrutiny is actually happening.

• A. Schedule retraining of both models at the next planned update cycle and record the withdrawal in the model documentation
• B. Confirm the records are deleted from every dataset copy and backup, and document that source deletion fulfills the withdrawal
• C. Test whether the models reproduce the withdrawn customers' records, and remediate when reproduction is demonstrated
• D. Trace the affected models through lineage records and have privacy and model owners decide on retraining or retirement Correct answer

Option D is correct because data lineage lets the team identify which models were trained on the withdrawn customers' data, and privacy and model owners can then decide between retraining and retirement. Deleting source records does not address models already trained on them, waiting for a routine update leaves the exposure open, and testing for reproduction only treats memorization as the issue.

• A. The model validation team that tested the model
• B. The business owner of the credit-limit process Correct answer
• C. The security manager who assessed the model's risk
• D. The data science lead who developed the model

Option B is correct because the business owner of the credit-limit process owns the outcome and the loss from bad recommendations, so that owner decides how much error is acceptable. Validators, security managers and developers advise on or measure the error but do not own the business risk.

• A. Run a limited pilot and extrapolate a loss distribution from the incidents recorded during it
• B. Reuse loss figures from the bank's past process-automation incidents as the nearest available historical analogue
• C. Run structured scenario analysis with experts and express exposure as calibrated loss ranges Correct answer
• D. Score likelihood and impact on the bank's standard qualitative heat map and report the resulting ratings

Option C is correct because structured scenario analysis with experts produces calibrated loss ranges when there is no loss history and little industry data. A pilot is too small to show rare, costly events, past automation incidents are a poor analogue for generative output, and a heat map gives ratings rather than a financial estimate.

• A. Add a statement to every answer that responses are informational and do not bind the insurer
• B. Retrain the assistant on a larger set of verified coverage questions to lower its wrong-answer rate
• C. Restrict the assistant to approved policy wording and route coverage determinations to licensed agents Correct answer
• D. Obtain executive acceptance of the residual risk and track the wrong-answer rate monthly against a threshold

Option C is correct because limiting the assistant to approved policy wording and sending coverage determinations to licensed agents cuts the chance of a binding wrong answer, without reviewing every answer. A disclaimer does not remove an obligation to honor stated coverage, retraining lowers but does not control the error rate, and accepting a risk that exceeds appetite with no insurance cover is not a mitigation.

• A. Ask the data protection officer to approve the residual risk as the independent reviewer
• B. Record the vice president's sign-off in the product's risk register and monitor the controls
• C. Have the vice president fund additional controls until the rating falls within the delegated limit
• D. Escalate the assessment to the executive risk committee for an enterprise-level acceptance decision Correct answer

Option D is correct because acceptance must be made by someone with authority equal to the risk, and impact across several legal entities exceeds the vice president's limit, so it goes to the executive risk committee. The data protection officer is an adviser rather than the accepting authority, signing off beyond one's limit is not valid, and further controls are already ruled out as impractical.

• A. Ask the scanner vendor to add a detection signature for the behavior before the issue is tracked
• B. Open a change request for the model owner to retrain the assistant, and track it in the data science backlog
• C. Log the red-team result as a vulnerability with an owner plus a deadline and severity based on data exposure Correct answer
• D. Raise the result with the AI governance committee as a model-quality concern rather than a vulnerability

Option C is correct because a demonstrated way to expose other policyholders' data is a real vulnerability whatever tool found it, so it should enter the process with an owner, a deadline and a severity based on data exposure. Waiting for a scanner signature, treating it only as a backlog or quality item, or letting the process definition hide it leaves a proven exposure unmanaged.

• A. Define the attack success criteria and the prompt categories the red team will use
• B. Review the provider's terms and obtain written permission for the planned testing Correct answer
• C. Schedule the testing outside business hours to limit the effect on portal users
• D. Replicate the model in a company-controlled environment and test the replica instead

Option B is correct because high-volume adversarial testing of a third-party API may breach the provider's terms and affect other customers, so permission must be settled before anything else. Success criteria, timing and a replica test are useful planning steps, but a replica does not test the hosted service the portal depends on.

• A. Ask each AI vendor to notify the company of new attack techniques that affect its products
• B. Track AI-specific threat intelligence and review new techniques against the AI inventory regularly Correct answer
• C. Repeat the original threat modeling workshop every year with the same participants and update the register
• D. Update the register after each incident that affects one of the company's own AI systems

Option B is correct because tracking AI-specific threat intelligence and checking new techniques against the AI inventory keeps the register current on a regular basis. Relying on vendor notices, repeating the same workshop with the same people, or waiting for the company's own incidents all leave the register behind the threats that are already public.

• A. During pre-deployment testing, when behavior is observable
• B. During data preparation and labeling
• C. During use-case scoping, before data is gathered Correct answer
• D. During validation of the candidate models

Option C is correct because security, privacy and fairness requirements shape which data may be collected and how the system is designed, so they must be set at use-case scoping before any data is gathered. Options A, B and D place the requirements at later stages, where gaps are found only after data and design choices are fixed and costly to reverse.

• A. Run it in shadow mode beside the current model and compare its scores with confirmed outcomes before any go-live decision Correct answer
• B. Obtain sign-off from the independent validation team on the model's design documentation and training approach
• C. Route a small share of live traffic to it with a rapid rollback path, widening exposure while complaint rates stay low
• D. Repeat offline validation on a fresh sample that includes the latest month of transactions and the newest fraud patterns

Option A is correct because shadow mode scores live transactions without affecting any customer, so the model is compared with confirmed outcomes on current traffic before it drives any decision. Option C exposes real customers to wrongful declines, which the requirement rules out. Options B and D rely on documentation or retrospective data and do not show how the model behaves on live traffic.

• A. Safety and misuse testing of the tuned model itself, using the evaluation suite already applied to the base model Correct answer
• B. Acceptance testing of tone and accuracy on a larger sample of questions written to resemble live customer requests
• C. Reliance on the base model's published safety results, documented in the release record along with the tuning data sources
• D. Written confirmation from the vendor that fine-tuned variants inherit the safety behavior of the base model

Option A is correct because fine-tuning can erode a base model's safety behavior, so the tuned model itself must be run through safety and misuse testing. Options B tests only tone and accuracy, and options C and D rely on the base model's results or a vendor assurance, none of which show how the tuned model behaves.

• A. Encrypt the model under a hardware-backed device key and accept only signed update packages Correct answer
• B. Apply a license check that disables the application if the device has not contacted the vendor within 30 days
• C. Obfuscate the model file layout and strip identifying metadata before it is shipped
• D. Run inference on a central service that holds the model, sending inspection images from the device

Option A is correct because encrypting the model under a hardware-backed key protects it from theft, and accepting only signed updates stops tampered models from being loaded, and both work offline. Option B and C do not stop extraction or tampering, and option D needs connectivity the devices often lack.

• A. Create a separate service account for each business unit, limited to the mailboxes of that unit's staff
• B. Retain the single account and require users to approve each message the assistant sends before it leaves
• C. Keep the shared service account, restrict it to mail and calendar interfaces and log each action against the requesting user
• D. Have the assistant act on a token delegated by the signed-in employee, scoped to that mailbox and the task's actions Correct answer

Option D is correct because a token delegated by the signed-in employee limits the assistant to that person's mailbox and the task's actions, which removes the over-privileged shared identity. Options A, B and C keep a standing account with broad access, and approval prompts or logging do not reduce what a compromised or manipulated assistant can reach.

• A. Move the sensitive training data to a separate network that notebooks cannot reach
• B. Require data scientists to record the source of each download in the project wiki
• C. Offer an internal mirror of vetted packages and models, and block direct downloads Correct answer
• D. Allow direct downloads but scan the notebook hosts for known vulnerabilities each week

Option C is correct because an internal mirror of vetted packages and models gives data scientists what they need while removing unvetted direct downloads, which directly reduces supply chain exposure. Options A, B and D either block the work, only document downloads, or detect problems after untrusted code has already run next to sensitive data.