View Full Isaca AAISM Exam Dumps and Practice Test Dumps

 

Question 41. Which approach best supports governance throughout the AI system lifecycle?

1. Review the system only after deployment
2. Apply governance activities at planning, development, deployment, operation, and retirement stages
3. Assign governance responsibility exclusively to developers
4. Focus governance only on cybersecurity controls

Correct Answer: 2. Apply governance activities at planning, development, deployment, operation, and retirement stages

Explanation:

Effective AI governance should cover the complete lifecycle rather than being limited to a single checkpoint. Governance considerations should begin when an AI use case is proposed and continue through design, development, validation, deployment, monitoring, modification, and eventual retirement. This lifecycle approach helps organizations identify risks before they become embedded in production systems. It also establishes accountability for decisions made at different stages. For example, privacy requirements may be especially important during data preparation, while performance and fairness monitoring become critical after deployment. A lifecycle-based governance framework therefore provides ongoing oversight and helps ensure that AI systems remain aligned with organizational requirements throughout their operational existence.

Question 42. What is the primary purpose of a model card or similar AI model documentation?

1. To replace technical testing
2. To guarantee that a model is unbiased
3. To provide structured information about a model’s intended use, limitations, performance, and risks
4. To prevent all unauthorized access to model infrastructure

Correct Answer: 3. To provide structured information about a model’s intended use, limitations, performance, and risks

Explanation:

Model documentation provides stakeholders with important information needed to understand and govern an AI model. A model card can describe intended uses, prohibited or inappropriate uses, training information, evaluation methods, performance characteristics, limitations, and known risks. This documentation does not guarantee that a model is fair, accurate, or secure, nor does it replace independent validation. Instead, it creates transparency and supports informed decisions by developers, risk teams, auditors, management, and users. Well-maintained documentation also helps organizations compare model versions and investigate incidents. From a governance perspective, documenting the model’s characteristics and limitations makes oversight more consistent and supports accountability throughout the AI lifecycle.

Question 43. What should an organization do when classifying a proposed AI use case?

1. Evaluate factors such as business impact, affected individuals, data sensitivity, and potential risks
2. Classify every AI use case as low risk
3. Base classification only on the model’s size
4. Allow the development team to classify it without documented criteria

Correct Answer: 1. Evaluate factors such as business impact, affected individuals, data sensitivity, and potential risks

Explanation:

AI use-case classification should be based on meaningful risk factors rather than technical characteristics alone. Organizations can consider the potential impact of incorrect outputs, the sensitivity of information processed, the number and type of people affected, legal or regulatory obligations, the degree of human involvement, and the consequences of misuse. A system used for low-impact internal assistance may require different controls from one supporting decisions that significantly affect individuals. Documented classification criteria promote consistency and make governance decisions auditable. Once a use case is classified, the organization can apply controls proportionate to its risk level instead of imposing identical requirements on every AI application.

Question 44. Why is a risk-based approach important when establishing AI controls?

1. It eliminates the need for AI governance
2. It ensures every AI system receives identical controls
3. It allows organizations to avoid documenting risk decisions
4. It aligns the strength and type of controls with the nature and severity of identified risks

Correct Answer: 4. It aligns the strength and type of controls with the nature and severity of identified risks

Explanation:

A risk-based approach recognizes that AI systems do not all create the same level or type of exposure. Applying identical controls to every system may waste resources on low-risk applications while failing to provide sufficient safeguards for higher-risk use cases. Risk-based governance instead evaluates the potential consequences and likelihood of different risks and selects controls accordingly. Higher-risk systems may require stronger validation, human oversight, security testing, monitoring, documentation, and approval processes. Lower-risk systems may use proportionate safeguards. This approach also helps management prioritize resources and demonstrate that governance decisions are based on documented risk considerations rather than arbitrary or purely technical classifications.

Question 45. Which activity is most appropriate during due diligence of a third-party AI provider?

1. Evaluate the provider’s security, privacy, governance, performance, and compliance practices
2. Accept the provider’s marketing claims without verification
3. Review only the provider’s pricing
4. Avoid asking about data handling because the provider operates the model

Correct Answer: 1. Evaluate the provider’s security, privacy, governance, performance, and compliance practices

Explanation:

Third-party AI providers can introduce risks that an organization cannot control directly, making due diligence an important governance activity. An assessment should examine how the provider protects data, manages access, handles incidents, monitors model performance, addresses vulnerabilities, and meets applicable contractual and regulatory obligations. Organizations should also understand where data is processed, whether information may be retained for model improvement, and what happens when services are discontinued. Evidence such as independent assurance reports, security documentation, contractual commitments, and relevant policies can strengthen the assessment. Effective due diligence enables the organization to understand supplier risk before integrating an external AI service into important business processes.

Question 46. Which contractual requirement can help manage risks associated with an external AI provider?

1. Allow unlimited provider access to organizational data
2. Define requirements for data handling, security, incident notification, audit rights, and service termination
3. Prohibit the organization from monitoring the service
4. Permit the provider to change material terms without notification

Correct Answer: 2. Define requirements for data handling, security, incident notification, audit rights, and service termination

Explanation:

Contracts are an important mechanism for translating third-party AI risk expectations into enforceable obligations. A well-designed agreement can specify how organizational and customer data may be collected, processed, stored, retained, and deleted. It can also establish security requirements, incident notification timelines, subcontractor obligations, service-level expectations, audit or assurance rights, and procedures for terminating the relationship. These provisions help reduce uncertainty when an AI service is integrated into business operations. Without appropriate contractual controls, an organization may have limited ability to respond when a provider experiences a breach, changes its service, uses data differently, or fails to meet established governance requirements.

Question 47. What is a key concern associated with the AI supply chain?

1. Only the physical location of a data center
2. The number of employees using the AI system
3. Risks introduced by models, datasets, libraries, APIs, vendors, and other external dependencies
4. The visual design of the AI application’s interface

Correct Answer: 3. Risks introduced by models, datasets, libraries, APIs, vendors, and other external dependencies

Explanation:

AI systems frequently depend on components supplied by multiple parties. These may include foundation models, pretrained datasets, open-source libraries, APIs, cloud platforms, model repositories, and specialized vendors. Each dependency can introduce security, privacy, integrity, availability, licensing, or compliance risks. A compromised library, manipulated dataset, vulnerable API, or poorly governed external model could affect the reliability and security of the final AI application. Supply-chain governance therefore requires organizations to identify important dependencies, evaluate their risks, maintain appropriate records, and monitor significant changes. Understanding the complete AI supply chain helps organizations avoid assuming that internally developed applications are automatically safe simply because external components are hidden behind an interface.

Question 48. Which practice best represents a secure AI development lifecycle?

1. Integrate security and governance activities from requirements through maintenance
2. Perform security testing only after a public incident
3. Leave security decisions entirely to end users
4. Disable testing to accelerate deployment

Correct Answer: 1. Integrate security and governance activities from requirements through maintenance

Explanation:

A secure AI development lifecycle incorporates security and governance throughout development rather than treating them as final-stage activities. During requirements definition, teams can identify security objectives, privacy constraints, and acceptable-use requirements. During design and development, they can implement appropriate access controls, secure data handling, dependency management, testing, and logging. Validation should examine model behavior and relevant security threats before production deployment. After release, monitoring and incident response remain necessary because threats and model behavior can change over time. Integrating these activities early reduces the chance that expensive security weaknesses will be discovered after deployment and provides clearer accountability for managing AI-related risks throughout development.

Question 49. What is the main purpose of threat modeling for an AI system?

1. To determine the model’s marketing strategy
2. To identify potential threats, attack paths, vulnerabilities, and impacts before or during deployment
3. To guarantee perfect model accuracy
4. To eliminate the need for security monitoring

Correct Answer: 2. To identify potential threats, attack paths, vulnerabilities, and impacts before or during deployment

Explanation:

Threat modeling provides a structured way to identify and analyze security threats affecting an AI system. The process can consider the model, training data, inference interfaces, supporting infrastructure, users, external integrations, and administrative functions. Examples of threats may include unauthorized access, prompt injection, data poisoning, model extraction, malicious inputs, and compromised dependencies. Understanding potential attack paths helps security and governance teams prioritize appropriate controls before an incident occurs. Threat modeling does not guarantee that an AI system will remain secure, but it provides a systematic foundation for identifying likely attack scenarios, assessing their potential impact, and determining where preventive or detective controls should be implemented.

Question 50. What is prompt injection in the context of generative AI?

1. A method for improving hardware performance
2. A process for encrypting model weights
3. A technique for compressing training datasets
4. An attack that attempts to manipulate model instructions through crafted input

Correct Answer: 4. An attack that attempts to manipulate model instructions through crafted input

Explanation:

Prompt injection occurs when an attacker crafts input intended to influence a generative AI system in ways that conflict with its intended instructions or controls. Depending on the system design, an attacker may attempt to make the model reveal sensitive information, ignore established instructions, generate unsafe content, or perform unauthorized actions through connected tools. The risk can be particularly significant when a model has access to business data, applications, or external services. Mitigations can include separating trusted instructions from untrusted content, limiting tool permissions, validating outputs, applying access controls, monitoring interactions, and requiring human approval for sensitive actions. Prompt injection should therefore be considered in AI threat modeling and application design.

Question 51. Which scenario is an example of data poisoning?

1. An attacker intentionally introduces manipulated training data to influence model behavior
2. A user forgets a password
3. A system administrator changes a dashboard layout
4. A model is hosted on a new server

Correct Answer: 1. An attacker intentionally introduces manipulated training data to influence model behavior

Explanation:

Data poisoning involves deliberately manipulating data used to train or otherwise develop an AI model so that the resulting system behaves in an undesirable way. An attacker might insert misleading, mislabeled, biased, or malicious records into a training dataset. If the compromised data is not detected, the model may learn patterns that reduce accuracy, create unwanted behavior, or potentially support targeted attacks. Controls can include data provenance, validation rules, access restrictions, anomaly detection, dataset versioning, review procedures, and integrity monitoring. Governance teams should treat training-data integrity as an important part of AI risk management because weaknesses in data management can directly affect model behavior and downstream decisions.

Question 52. What type of attack attempts to reconstruct sensitive information about training data by interacting with a model?

1. Denial-of-service attack
2. Model inversion attack
3. Network segmentation
4. Patch management

Correct Answer: 2. Model inversion attack

Explanation:

Model inversion attacks attempt to infer or reconstruct information about data used by a machine-learning model by analyzing its outputs or behavior. Depending on the model and information available to the attacker, this could expose characteristics of sensitive training examples or enable reconstruction of representative information. The risk is especially important when models are trained using confidential or personal data. Appropriate mitigations depend on the system and may include minimizing sensitive training data, limiting model-query capabilities, applying privacy-enhancing techniques, controlling output detail, monitoring unusual query behavior, and conducting privacy testing. Organizations should consider model inversion during AI privacy assessments when models may expose information through their outputs.

Question 53. What is the primary objective of a membership inference attack?

1. To determine whether a particular record was included in a model’s training data
2. To physically damage AI infrastructure
3. To modify the organization’s governance policy
4. To improve model explainability

Correct Answer: 1. To determine whether a particular record was included in a model’s training data

Explanation:

A membership inference attack attempts to determine whether a particular individual record or data sample was part of the dataset used to train a model. This can create privacy concerns because confirming membership in a sensitive dataset may itself reveal confidential information. The risk can be influenced by model behavior, overfitting, the type of data involved, and the amount of information exposed through model interfaces. Organizations can evaluate this risk through privacy-focused testing and can reduce exposure through measures such as data minimization, access restrictions, appropriate model training techniques, and careful output design. Membership inference is therefore relevant to AI governance when training datasets contain sensitive or personal information.

Question 54. Why should AI-generated outputs be validated before being used for consequential actions?

1. Because AI systems can produce inaccurate, incomplete, or inappropriate results
2. Because every AI output is intentionally malicious
3. Because validation makes cybersecurity unnecessary
4. Because human review is never required for AI

Correct Answer: 1. Because AI systems can produce inaccurate, incomplete, or inappropriate results

Explanation:

AI-generated outputs should not automatically be treated as correct simply because they were produced by a sophisticated model. AI systems can generate inaccurate information, omit important context, misunderstand inputs, or produce plausible-looking but unsupported results. The consequences become more significant when outputs influence financial, legal, employment, safety, security, or other important decisions. Validation controls can include deterministic business rules, source verification, confidence thresholds, secondary checks, human review, and restrictions on automated actions. The appropriate control depends on the risk of the use case. Governance should ensure that organizations understand where validation is required and that users know when AI output requires independent confirmation.

Question 55. What governance concern is most directly associated with AI hallucinations?

1. Excessive physical storage capacity
2. The model producing plausible but unsupported or factually incorrect information
3. Reduced electricity consumption
4. Improved network bandwidth

Correct Answer: 2. The model producing plausible but unsupported or factually incorrect information

Explanation:

AI hallucinations occur when an AI system produces information that appears credible but is unsupported, inaccurate, or fabricated. From a governance perspective, the concern is not merely that an answer may be incorrect but that users may trust it because it is presented confidently. This can create operational, compliance, reputational, or decision-making risks. Organizations can address hallucination risk through retrieval from trusted sources, output validation, grounding techniques, human review, user training, and clearly defined restrictions on high-impact automated decisions. Monitoring should also examine the frequency and consequences of unreliable outputs. Governance requirements should reflect the potential impact of incorrect information in the specific business context.

Question 56. Which design best represents effective human-in-the-loop oversight for a high-impact AI process?

1. Allow the model to make irreversible decisions without review
2. Remove human access after deployment
3. Require qualified human review and intervention at defined decision points
4. Allow any user to override the model without authentication

Correct Answer: 3. Require qualified human review and intervention at defined decision points

Explanation:

Human-in-the-loop oversight is most effective when human responsibilities are clearly defined rather than treated as a general instruction to “check the AI.” For high-impact processes, qualified personnel should understand when review is required, what evidence should be examined, and when a decision must be escalated or rejected. Human reviewers should also have sufficient authority and system access to intervene when necessary. Controls such as authentication, documented procedures, audit trails, and escalation thresholds can strengthen the process. Simply placing a human somewhere in the workflow does not guarantee meaningful oversight. Governance should ensure that the human reviewer can understand relevant information and exercise independent judgment before consequential actions occur.

Question 57. What should an AI business continuity plan address?

1. Only employee vacation schedules
2. Only the color scheme of AI dashboards
3. Recovery requirements for critical AI services, dependencies, data, infrastructure, and alternative processes
4. Only model accuracy during normal operation

Correct Answer: 3. Recovery requirements for critical AI services, dependencies, data, infrastructure, and alternative processes

Explanation:

Business continuity planning for AI should consider what happens when an important AI service becomes unavailable, unreliable, compromised, or inaccessible. Organizations should identify critical AI capabilities and their dependencies, including data sources, APIs, infrastructure, model providers, authentication services, and supporting applications. Recovery objectives should be defined according to business impact. Plans may include backup arrangements, alternative models or manual processes, data recovery procedures, provider escalation contacts, and testing requirements. The organization should also determine when an AI service should be taken offline because continued operation creates greater risk. A well-designed continuity strategy helps maintain essential business functions while providing controlled alternatives during AI service disruption.

Question 58. Why is change management important for governed AI systems?

1. AI systems can change behavior or risk characteristics when models, data, configurations, or dependencies change
2. Changes never affect AI system performance
3. Change management is needed only for office applications
4. AI models should never be versioned

Correct Answer: 1. AI systems can change behavior or risk characteristics when models, data, configurations, or dependencies change

Explanation:

Changes to AI systems can affect accuracy, fairness, security, privacy, explainability, and compliance. A seemingly minor modification to a model, prompt, training dataset, API, configuration, or external dependency can produce different outputs or introduce new risks. Change management helps organizations identify significant changes, assess their potential impact, obtain appropriate approval, conduct required testing, update documentation, and maintain traceability between versions. Not every change requires the same level of review, so risk-based change categories can improve efficiency. Effective change management ensures that AI governance continues after initial approval and prevents teams from treating an updated system as though it were identical to the previously validated version.

Question 59. What is the value of independent assurance over an AI governance program?

1. It guarantees that no AI incident can occur
2. It provides an objective assessment of whether governance controls are designed and operating effectively
3. It eliminates management accountability
4. It replaces all operational monitoring

Correct Answer: 2. It provides an objective assessment of whether governance controls are designed and operating effectively

Explanation:

Independent assurance provides stakeholders with an assessment that is separate from the teams responsible for operating the AI system. Depending on the organization’s assurance model, independent reviewers may evaluate governance structures, risk assessments, policies, controls, documentation, monitoring, and compliance activities. The purpose is not to guarantee that incidents will never occur, but to identify weaknesses and provide evidence about control effectiveness. Independence can also reduce conflicts of interest that may arise when teams assess their own work. Findings from assurance activities can be used to improve governance and prioritize remediation. Management remains accountable for addressing identified issues and maintaining an effective AI governance environment.

Question 60. Which metric is most useful for reporting AI governance risk to senior management?

1. Number of AI-related desktop wallpapers
2. Number of developers’ preferred programming languages
3. Number of AI systems, high-risk findings, overdue remediation items, and significant incidents tracked over time
4. Number of informal conversations about AI

Correct Answer: 3. Number of AI systems, high-risk findings, overdue remediation items, and significant incidents tracked over time

Explanation:

AI governance reporting should provide senior management with meaningful information about risk exposure, control performance, and unresolved issues. Useful indicators may include the number of AI systems by risk category, high-risk assessment findings, overdue remediation actions, significant incidents, exceptions, monitoring failures, third-party risks, and completion of required reviews. Trend information is particularly valuable because a single number may not reveal whether risk is increasing or decreasing. Metrics should be aligned with organizational objectives and governance requirements rather than focusing on activity counts that have little decision value. Effective reporting enables management to understand where attention or resources may be needed and supports informed oversight of the AI environment.