View Full Isaca AAISM Exam Dumps and Practice Test Dumps

 

Question 1. What is the primary objective of an AI governance framework?

1. Increase the number of AI models deployed
2. Establish accountability, oversight, and responsible AI practices
3. Eliminate the need for human decision-making
4. Maximize AI system processing speed

Correct Answer: 2. Establish accountability, oversight, and responsible AI practices

Explanation:

An AI governance framework establishes the organizational structures, policies, responsibilities, and controls needed to manage artificial intelligence responsibly. It helps organizations define who is accountable for AI systems, how risks are identified and managed, and how compliance and ethical requirements are incorporated throughout the AI lifecycle. Effective governance should address areas such as transparency, security, privacy, fairness, accountability, monitoring, and human oversight. Governance is not primarily concerned with maximizing the number of AI deployments or eliminating human involvement. Instead, it provides a structured approach for ensuring that AI systems support organizational objectives while risks are appropriately identified, evaluated, controlled, and monitored.

Question 2. Which principle requires an organization to clearly identify who is responsible for decisions made by an AI system?

1. Accountability
2. Scalability
3. Availability
4. Portability

Correct Answer: 1. Accountability

Explanation:

Accountability means that appropriate individuals or organizational functions remain responsible for the design, deployment, operation, monitoring, and outcomes of AI systems. An AI system should not become a mechanism through which responsibility is avoided or transferred entirely to an automated process. Clear accountability helps organizations establish ownership for risk management, policy compliance, incident response, and system performance. Depending on the use case, accountability may involve business owners, technology teams, risk professionals, legal functions, and senior management. Clearly documented responsibilities also make it easier to investigate unexpected outcomes and determine who must take corrective action when an AI system does not operate as intended.

Question 3. Which activity should be performed before deploying a high-risk AI system?

1. Disable monitoring controls
2. Conduct an appropriate AI risk assessment
3. Remove human oversight
4. Publish all confidential training data

Correct Answer: 2. Conduct an appropriate AI risk assessment

Explanation:

A risk assessment should be performed before deploying a high-risk AI system so that potential threats, vulnerabilities, impacts, and compliance requirements can be identified and evaluated. The assessment should consider factors such as the purpose of the system, data quality, privacy implications, security threats, potential bias, explainability requirements, human oversight, third-party dependencies, and possible effects on affected individuals. The results can inform decisions about controls, approval requirements, testing, monitoring, and deployment conditions. Risk assessment is not a one-time activity; significant changes to the model, data, environment, or intended use may require reassessment during the AI system’s lifecycle.

Question 4. Why is data quality important when developing and deploying AI systems?

1. It guarantees that an AI model will never fail
2. It eliminates the need for security controls
3. Poor-quality data can negatively affect model reliability and outcomes
4. It makes governance unnecessary

Correct Answer: 3. Poor-quality data can negatively affect model reliability and outcomes

Explanation:

Data quality directly influences the reliability and usefulness of AI system outputs. Incomplete, inaccurate, outdated, inconsistent, or improperly representative data can introduce errors and undesirable patterns into model behavior. Depending on the application, poor data quality may also contribute to unfair outcomes or unreliable predictions. Organizations should therefore establish appropriate data-management controls covering data collection, validation, lineage, preparation, storage, access, and ongoing monitoring. High-quality data does not guarantee that a model will always produce correct results, but it provides a stronger foundation for trustworthy AI development. Data quality should consequently be treated as a governance and risk-management concern rather than merely a technical issue.

Question 5. Which control helps ensure that only authorized personnel can access sensitive AI training data?

1. Role-based access control
2. Model retraining
3. Data augmentation
4. Hyperparameter tuning

Correct Answer: 1. Role-based access control

Explanation:

Role-based access control restricts access to resources according to defined organizational roles and permissions. For AI environments, RBAC can be used to limit access to sensitive training datasets, model repositories, development platforms, production systems, and administrative functions. Applying least privilege ensures that users receive only the permissions necessary to perform their responsibilities. This reduces the risk of unauthorized data disclosure, accidental modification, or malicious activity. Access controls should be supported by authentication, authorization reviews, logging, and periodic access recertification. Technical teams should also distinguish between access required for model development and access required for production operations.

Question 6. What is a key purpose of maintaining data lineage for an AI system?

1. To track the origin and transformation of data
2. To increase processor speed
3. To remove all model documentation
4. To prevent model monitoring

Correct Answer: 1. To track the origin and transformation of data

Explanation:

Data lineage provides visibility into where data originated, how it was collected, transformed, combined, processed, and ultimately used within an AI system. This information supports governance, accountability, troubleshooting, privacy management, and auditability. If an unexpected model outcome occurs, data lineage can help teams determine which datasets and processing steps contributed to the result. It can also help organizations demonstrate that data was obtained and processed according to applicable policies and requirements. Maintaining reliable lineage becomes increasingly important when AI systems depend on multiple internal and external datasets because undocumented transformations can make it difficult to understand or reproduce model behavior.

Question 7. Which concept refers to an AI system’s ability to provide understandable reasons or information about its outputs?

1. Explainability
2. Availability
3. Compression
4. Replication

Correct Answer: 1. Explainability

Explanation:

Explainability refers to the degree to which the behavior or outputs of an AI system can be understood by relevant stakeholders. Depending on the system and audience, explanations may describe important factors contributing to a prediction, decision, recommendation, or classification. Explainability can support user trust, governance, troubleshooting, accountability, and compliance requirements. The appropriate level of explanation depends on the use case and risk involved. A highly technical explanation may be appropriate for model developers, while business users or affected individuals may require simpler information. Explainability does not necessarily mean that every internal model calculation can be fully described in human terms.

Question 8. What is algorithmic bias in the context of AI systems?

1. A systematic tendency that can produce unfair or inappropriate outcomes
2. A method for increasing storage capacity
3. A technique for encrypting model files
4. A process for reducing network latency

Correct Answer: 1. A systematic tendency that can produce unfair or inappropriate outcomes

Explanation:

Algorithmic bias can occur when an AI system systematically produces outcomes that disadvantage certain individuals or groups or otherwise deviate from intended objectives. Bias can arise from training data, data collection methods, historical patterns, labeling decisions, model design, deployment context, or feedback mechanisms. Addressing bias requires more than examining the model algorithm alone. Organizations should evaluate relevant datasets, define appropriate fairness objectives, test model outcomes across meaningful groups, and monitor performance after deployment. Governance processes should also establish how identified issues are documented, escalated, remediated, and reassessed because bias can emerge or change as data and operational conditions evolve.

Question 9. Which practice is most effective for identifying unexpected changes in an AI model after deployment?

1. Continuous monitoring
2. Removing audit logs
3. Disabling performance metrics
4. Avoiding model reviews

Correct Answer: 1. Continuous monitoring

Explanation:

Continuous monitoring helps organizations identify changes in model performance, data characteristics, security conditions, and operational behavior after an AI system enters production. Models may degrade over time because real-world conditions change, input data shifts, user behavior evolves, or external factors affect the relationship between inputs and outcomes. Monitoring can track indicators such as accuracy, error rates, data distributions, fairness measures, security events, and operational performance. Appropriate thresholds and escalation procedures should be established so that significant deviations trigger investigation or corrective action. Monitoring therefore supports ongoing governance rather than treating AI approval as a one-time event completed before deployment.

Question 10. What is model drift?

1. A change in model performance or behavior caused by changing data or conditions
2. The physical movement of a server
3. A method for encrypting model parameters
4. A process for assigning user roles

Correct Answer: 1. A change in model performance or behavior caused by changing data or conditions

Explanation:

Model drift describes a situation in which an AI model’s effectiveness or behavior changes as the environment, input data, or relationships represented by the model evolve. A model that performed effectively during initial validation may become less accurate or less appropriate when real-world conditions change. Organizations can address drift through monitoring, validation, retraining, recalibration, or other controlled model-management processes. Drift should be considered during governance planning because it demonstrates why AI systems require ongoing oversight after deployment. Monitoring should identify meaningful changes early enough for responsible teams to investigate and determine whether continued operation remains appropriate.

Question 11. Which principle requires organizations to maintain meaningful human oversight over appropriate AI decisions?

1. Human oversight
2. Data compression
3. Network segmentation
4. Infrastructure scaling

Correct Answer: 1. Human oversight

Explanation:

Human oversight provides mechanisms through which qualified people can review, supervise, challenge, intervene in, or override AI system behavior when appropriate. The degree of oversight should reflect the system’s risk, intended purpose, and potential impact on individuals or organizations. High-impact applications may require stronger review and intervention capabilities than low-risk applications. Human oversight is meaningful only when responsible personnel have sufficient authority, information, training, and opportunity to act. Simply placing a person somewhere in the workflow does not automatically provide effective oversight. Governance should therefore define when human review is required and what actions personnel can take when concerns arise.

Question 12. Why should organizations maintain an inventory of AI systems?

1. To identify and manage AI assets, owners, uses, and associated risks
2. To eliminate the need for risk assessments
3. To prevent all AI development
4. To increase model complexity

Correct Answer: 1. To identify and manage AI assets, owners, uses, and associated risks

Explanation:

An AI inventory provides an organized record of the AI systems an organization develops, acquires, or operates. Useful inventory information can include the system’s purpose, business owner, technical owner, data sources, model type, deployment environment, risk classification, third-party dependencies, applicable controls, and lifecycle status. Maintaining an inventory helps governance teams understand the organization’s overall AI exposure and determine which systems require additional oversight. Without an inventory, an organization may overlook models operating outside established governance processes. The inventory should be maintained as systems change, are retired, or are replaced so that governance information remains aligned with the actual AI environment.

Question 13. Which document should define the intended purpose, limitations, and acceptable use of an AI system?

1. AI system documentation
2. Unrelated network configuration
3. Temporary password list
4. Hardware inventory only

Correct Answer: 1. AI system documentation

Explanation:

AI system documentation should clearly describe the system’s intended purpose, scope, important limitations, assumptions, dependencies, and acceptable use. Depending on the system, documentation may also include information about training data, evaluation methods, model versions, known risks, performance characteristics, security controls, human oversight, and monitoring requirements. Clear documentation supports accountability and helps users understand what the system is designed to do and where it should not be used. It also assists auditors, risk teams, developers, and operators during reviews and investigations. Documentation should be updated when significant changes are made to the model, data, architecture, or intended use.

Question 14. What is the primary purpose of an AI impact assessment?

1. Evaluate potential effects and risks of an AI system on affected stakeholders
2. Increase the model’s training speed
3. Replace cybersecurity testing
4. Eliminate organizational accountability

Correct Answer: 1. Evaluate potential effects and risks of an AI system on affected stakeholders

Explanation:

An AI impact assessment examines how an AI system could affect individuals, groups, organizations, and other relevant stakeholders. Depending on the use case, the assessment may consider privacy, fairness, security, safety, economic effects, human rights, transparency, and other consequences. It can help organizations identify risks before deployment and determine whether additional safeguards, controls, or human review are required. The depth of an impact assessment should be proportionate to the potential consequences of the AI system. It does not replace technical security testing or general risk management; instead, it provides a broader perspective on the system’s potential societal and organizational effects.

Question 15. Which practice helps protect confidential information used by an AI model from unauthorized disclosure?

1. Data minimization and appropriate security controls
2. Publishing all training datasets publicly
3. Disabling access logging
4. Sharing credentials among developers

Correct Answer: 1. Data minimization and appropriate security controls

Explanation:

Data minimization reduces privacy and security exposure by limiting the collection and retention of information to what is necessary for the intended purpose. When sensitive information is required, organizations should apply appropriate security controls such as access restrictions, encryption, monitoring, secure storage, and retention management. AI systems can introduce additional concerns because sensitive information may appear in training datasets, prompts, logs, outputs, or model-related artifacts. Organizations should therefore consider the complete data lifecycle rather than protecting only the original dataset. Strong controls can reduce the likelihood of unauthorized disclosure while supporting legitimate AI processing requirements.

Question 16. What is the purpose of AI model validation before production deployment?

1. Confirm that the model meets defined performance and risk requirements
2. Guarantee that the model will never require updates
3. Eliminate the need for governance
4. Prevent all future model changes

Correct Answer: 1. Confirm that the model meets defined performance and risk requirements

Explanation:

Model validation provides an independent or appropriately controlled evaluation of whether an AI model performs according to predefined requirements and whether identified risks are within acceptable boundaries. Validation may examine accuracy, robustness, fairness, security, explainability, data quality, and other characteristics relevant to the intended use. Testing should use appropriate datasets and scenarios that reflect realistic operating conditions. The results can inform deployment approval and identify issues requiring remediation before production use. Validation does not guarantee perfect future performance because operational environments can change, which is why post-deployment monitoring and periodic reassessment remain important.

Question 17. Which control helps preserve evidence of important actions performed on an AI platform?

1. Audit logging
2. Data duplication
3. Model compression
4. Interface redesign

Correct Answer: 1. Audit logging

Explanation:

Audit logging records relevant actions and events so organizations can establish a traceable history of activity within an AI environment. Depending on the system, logs may capture administrative changes, model deployments, data access, configuration modifications, authentication events, policy changes, or other security-relevant actions. Proper logging supports accountability, incident investigation, compliance activities, and operational troubleshooting. Logs should be protected against unauthorized modification and retained according to organizational and legal requirements. Excessive logging without appropriate management can create storage and privacy challenges, so organizations should identify which events are important and establish suitable retention and access controls.

Question 18. Why is third-party AI risk management important?

1. External providers can introduce additional security, privacy, compliance, and operational risks
2. Third-party systems are automatically risk-free
3. Vendor contracts eliminate all AI risks
4. External AI services never process organizational data

Correct Answer: 1. External providers can introduce additional security, privacy, compliance, and operational risks

Explanation:

Third-party AI services can introduce risks that an organization may not fully control directly. These risks can involve data handling, privacy, cybersecurity, model behavior, service availability, intellectual property, regulatory compliance, subcontractors, and changes to provider terms or technology. Organizations should therefore perform appropriate due diligence before adopting external AI services and establish contractual and technical safeguards where necessary. Vendor risk management should consider what data is shared, where it is processed, how long it is retained, who can access it, and how incidents are handled. Ongoing monitoring may also be necessary because third-party services and associated risks can change over time.

Question 19. Which security threat involves manipulating inputs so that an AI model produces an unintended result?

1. Adversarial attack
2. Capacity planning
3. Database normalization
4. Network load balancing

Correct Answer: 1. Adversarial attack

Explanation:

An adversarial attack attempts to manipulate inputs, model behavior, or other components of an AI system in order to cause unintended or harmful outcomes. In some cases, carefully crafted input changes can cause a model to misclassify information or produce an incorrect result while appearing normal to users. AI security assessments should therefore consider adversarial techniques relevant to the system’s architecture and use case. Appropriate defenses may include robust testing, input validation, monitoring, access controls, model hardening, and other security measures. Organizations should also recognize that AI security extends beyond the model itself to data pipelines, APIs, infrastructure, and users.

Question 20. What should senior management primarily establish for effective AI governance?

1. Organizational direction, accountability, risk oversight, and appropriate resources
2. Individual model hyperparameters
3. Source code for every AI system
4. Network cable configurations

Correct Answer: 1. Organizational direction, accountability, risk oversight, and appropriate resources

Explanation:

Senior management plays an important role in establishing the organizational direction and accountability needed for effective AI governance. Leadership should define expectations for responsible AI use, establish appropriate oversight structures, allocate resources for risk management and compliance, and ensure that significant AI risks receive appropriate attention. Management does not need to configure individual model parameters or perform every technical task. Instead, leadership establishes the governance environment in which technical and business teams operate. Clear sponsorship and accountability help ensure that AI initiatives are aligned with organizational objectives and that important risks are identified, escalated, and managed throughout the AI lifecycle.