View Full Isaca AAISM Exam Dumps and Practice Test Dumps

 

Question 61. What is the primary purpose of establishing an AI system inventory?

1. To record only the names of AI vendors
2. To identify, classify, and maintain visibility into AI systems used across the organization
3. To eliminate the need for risk assessments
4. To prevent employees from using any AI tools

Correct Answer: 2. To identify, classify, and maintain visibility into AI systems used across the organization

Explanation:

An AI system inventory gives an organization a structured view of the AI systems it develops, purchases, integrates, or uses. Important inventory information can include the system owner, business purpose, risk classification, data types, model or provider, deployment environment, affected processes, and lifecycle status. Without an inventory, management may not know which AI systems are operating or which ones process sensitive information. An accurate inventory supports risk assessments, compliance reviews, monitoring, incident response, and accountability. It also helps organizations identify unauthorized or undocumented AI use. Governance teams should keep the inventory current as systems are introduced, modified, transferred between owners, or retired.

Question 62. Which factor should be considered when determining the risk classification of an AI system?

1. The font used in the user interface
2. The number of pages in the system documentation
3. The potential impact of incorrect or harmful AI decisions
4. The physical size of the server

Correct Answer: 3. The potential impact of incorrect or harmful AI decisions

Explanation:

Risk classification should reflect the potential consequences associated with an AI system. An organization may consider the sensitivity of processed data, number of affected individuals, degree of automation, business criticality, legal requirements, potential financial loss, safety implications, and consequences of inaccurate or biased outputs. A system that supports a low-impact administrative activity may present different risks from an AI system used to influence important decisions. Classification enables organizations to apply proportionate governance controls. It should be based on documented criteria that can be consistently applied and reviewed. A risk classification should also be reassessed when the system’s purpose, data, functionality, or operating environment changes significantly.

Question 63. Why should AI system ownership be clearly assigned?

1. To establish accountability for governance, risk management, and system performance
2. To ensure only one person can access the system
3. To eliminate the need for documentation
4. To transfer all organizational responsibility to the vendor

Correct Answer: 1. To establish accountability for governance, risk management, and system performance

Explanation:

Clear ownership ensures that responsibility for an AI system does not become ambiguous between technical teams, business units, vendors, and governance functions. An owner may be responsible for ensuring that the system has an approved purpose, appropriate risk assessment, required controls, monitoring, documentation, and periodic review. Ownership does not mean that one person performs every governance activity. Instead, responsibilities should be distributed across appropriate stakeholders while maintaining clear accountability. Clearly defined ownership also supports incident management because personnel know who should make decisions when an AI system produces harmful results or experiences a security or compliance issue. Governance frameworks are stronger when accountability is explicit and documented.

Question 64. Which control can help prevent unauthorized AI systems from being introduced into an organization?

1. Removing all AI documentation
2. Allowing unrestricted access to external AI services
3. Disabling employee security awareness training
4. Establishing an approved AI intake and authorization process

Correct Answer: 4. Establishing an approved AI intake and authorization process

Explanation:

An AI intake and authorization process provides a formal mechanism for employees and business units to propose new AI use cases before they are adopted. The process can require information about the business purpose, data involved, vendor or model, intended users, risks, security requirements, privacy considerations, and expected outcomes. Appropriate governance, legal, security, privacy, and business stakeholders can then determine whether additional assessment or approval is required. This reduces the likelihood of uncontrolled “shadow AI” usage involving sensitive organizational information. An authorization process should be practical enough that employees can use it easily while still providing sufficient oversight for systems that may introduce significant business, security, privacy, or compliance risks.

Question 65. What is a key benefit of maintaining AI model version history?

1. It guarantees that every model version performs identically
2. It supports traceability and helps determine which model produced a particular result
3. It eliminates the need for model validation
4. It prevents all unauthorized changes automatically

Correct Answer: 2. It supports traceability and helps determine which model produced a particular result

Explanation:

Model version history provides an important foundation for traceability and accountability. Organizations can record model versions, release dates, significant changes, validation results, approval decisions, associated datasets, configurations, and deployment environments. If an incident occurs, investigators can determine which version was active and compare it with earlier or later versions. Version history also helps teams reproduce or understand historical behavior and supports controlled rollback when necessary. It does not automatically prevent unauthorized modifications, so version control should be combined with access restrictions, approval processes, testing, and audit logging. Maintaining reliable version records is especially important for AI systems whose outputs influence important business or operational activities.

Question 66. Which practice best supports reproducibility of an AI model’s development process?

1. Deleting historical training information
2. Changing model configurations without recording them
3. Recording relevant datasets, code versions, parameters, dependencies, and development conditions
4. Allowing developers to rely entirely on memory

Correct Answer: 3. Recording relevant datasets, code versions, parameters, dependencies, and development conditions

Explanation:

Reproducibility requires sufficient information to understand how a model was created and evaluated. Relevant records may include dataset versions, preprocessing procedures, source code, model architecture, configuration parameters, software dependencies, random seeds where applicable, evaluation methods, and development environment details. Without these records, teams may struggle to reproduce results or investigate why a model changed behavior. Reproducibility supports quality assurance, auditability, incident investigation, and controlled model development. It is particularly important when organizations need to demonstrate how a model was evaluated before deployment. Documentation should be proportionate to risk, but high-impact AI systems generally require more detailed records because their decisions may need to be explained and investigated later.

Question 67. Why should AI training and validation datasets be appropriately separated?

1. To help provide a more reliable evaluation of model performance on previously unseen data
2. To make every model completely unbiased
3. To eliminate the need for testing
4. To ensure the model memorizes all training examples

Correct Answer: 1. To help provide a more reliable evaluation of model performance on previously unseen data

Explanation:

Separating training and validation or test data helps organizations evaluate whether a model generalizes beyond the examples used to develop it. If the same information is repeatedly used for both training and evaluation, reported performance can become misleading because the model may have effectively learned characteristics of the evaluation data. Proper dataset separation provides a more independent indication of performance. Depending on the development methodology, additional techniques such as cross-validation may also be appropriate. Governance teams should ensure that dataset management procedures are documented and that evaluation results are interpreted within their limitations. This supports more credible model validation and reduces the risk of approving a model based on artificially optimistic performance measurements.

Question 68. What is data provenance in an AI governance context?

1. The physical location of an employee
2. The visual appearance of a model
3. The history and origin of data, including where it came from and how it was processed
4. The number of computers used for inference

Correct Answer: 3. The history and origin of data, including where it came from and how it was processed

Explanation:

Data provenance describes the origin, history, movement, transformation, and use of data. For AI governance, provenance can help organizations understand where training or inference data originated, who supplied it, what processing occurred, and which systems handled it. This information supports data quality, privacy, security, compliance, and incident investigation. If questionable data contributes to unexpected model behavior, provenance records can help identify the affected sources and determine whether corrective action is necessary. Provenance can also help demonstrate that data was obtained and processed according to applicable organizational requirements. Maintaining reliable provenance is especially valuable for complex AI environments where datasets may be assembled from multiple internal and external sources.

Question 69. Which control is most useful for detecting unauthorized changes to an AI model or critical dataset?

1. Integrity monitoring combined with access controls and audit logging
2. Removing all version information
3. Allowing unrestricted administrative privileges
4. Disabling system monitoring

Correct Answer: 1. Integrity monitoring combined with access controls and audit logging

Explanation:

Protecting the integrity of AI models and datasets requires multiple complementary controls. Access controls restrict who can make changes, while audit logs record relevant administrative and modification activities. Integrity mechanisms can help detect unexpected changes to important files, models, configurations, or datasets. Version control provides additional traceability by preserving known states and allowing authorized teams to compare changes. Together, these controls can help organizations detect unauthorized modification and investigate its source. No single mechanism provides complete protection, particularly when privileged accounts are compromised. Governance should therefore establish appropriate preventive and detective controls based on the sensitivity and criticality of the AI assets being protected.

Question 70. What should an organization consider when defining retention requirements for AI-related data?

1. Only the storage capacity available
2. Business needs, legal requirements, privacy obligations, security risks, and the purpose for retaining the data
3. Keeping every dataset indefinitely
4. Deleting all data immediately after collection

Correct Answer: 2. Business needs, legal requirements, privacy obligations, security risks, and the purpose for retaining the data

Explanation:

AI-related data should be retained according to defined business, legal, privacy, and security requirements rather than stored indefinitely by default. Organizations should determine why particular information needs to be retained, how long it is required, and what obligations apply to its storage and deletion. Sensitive information may create additional privacy and security risks when retained longer than necessary. Retention schedules can cover training data, evaluation datasets, prompts, outputs, logs, documentation, and other records, depending on the use case. Appropriate deletion or disposal procedures should also be established. Effective retention governance balances legitimate operational and regulatory needs with the risks associated with unnecessary data accumulation.

Question 71. Which principle helps ensure that AI access is limited to what users need for their responsibilities?

1. Least privilege
2. Unlimited authorization
3. Shared administrative accounts
4. Anonymous access

Correct Answer: 1. Least privilege

Explanation:

The principle of least privilege requires users, applications, and services to receive only the permissions necessary to perform their authorized responsibilities. In AI environments, this can limit who may access training datasets, modify models, approve deployments, retrieve sensitive outputs, or configure connected tools. Least privilege reduces the potential impact of compromised accounts and limits opportunities for accidental or intentional misuse. It should be supported by strong authentication, role-based access controls, periodic access reviews, and appropriate logging. Permissions should also be removed or adjusted when responsibilities change. Applying least privilege to AI systems is particularly important when models interact with sensitive information or have the ability to perform actions in connected enterprise systems.

Question 72. Why are privileged AI administration activities subject to additional monitoring?

1. Administrators never create security risks
2. Privileged actions can affect models, data, configurations, and security controls
3. Monitoring administrators makes auditing unnecessary
4. Privileged accounts require no authentication

Correct Answer: 2. Privileged actions can affect models, data, configurations, and security controls

Explanation:

Privileged accounts can make changes that significantly affect the confidentiality, integrity, availability, and behavior of AI systems. An administrator may modify access permissions, replace models, change configurations, alter data pipelines, disable security controls, or connect new services. Because these activities have elevated impact, they should be subject to appropriate authentication, authorization, logging, monitoring, and periodic review. Organizations may also use privileged access management to limit administrative sessions and reduce standing privileges. Monitoring does not imply that administrators are inherently untrustworthy; it provides accountability and helps detect unauthorized or anomalous activity. Strong oversight of privileged operations is a fundamental part of secure AI governance.

Question 73. What is the purpose of defining acceptable use requirements for generative AI?

1. To establish permitted, restricted, and prohibited uses based on organizational risk
2. To guarantee that employees will never make mistakes
3. To remove all human oversight
4. To allow unrestricted submission of confidential information

Correct Answer: 1. To establish permitted, restricted, and prohibited uses based on organizational risk

Explanation:

Acceptable-use requirements establish boundaries for how employees and other authorized users may interact with generative AI systems. Policies can address prohibited activities, handling of confidential or personal information, verification of generated content, intellectual property considerations, approved tools, and requirements for human review. Clear requirements help users understand that convenience does not override security, privacy, legal, or business obligations. The rules should reflect the organization’s actual risk environment and should distinguish between low-risk and high-risk uses where appropriate. User education and technical controls can reinforce the policy. Periodic review is also important because AI capabilities, business use cases, and external requirements can change over time.

Question 74. What should an organization do when an AI system reaches the end of its approved lifecycle?

1. Continue using it indefinitely without review
2. Remove all records immediately without considering obligations
3. Follow a controlled retirement process covering data, access, dependencies, records, and replacement arrangements
4. Transfer ownership to an unknown user

Correct Answer: 3. Follow a controlled retirement process covering data, access, dependencies, records, and replacement arrangements

Explanation:

AI retirement should be managed as a formal lifecycle stage rather than simply turning off the application. Organizations should identify dependent processes, revoke unnecessary access, handle retained data according to approved requirements, preserve records needed for legal or audit purposes, and document the retirement decision. If another system replaces the retired AI capability, the organization should ensure that the replacement has undergone the appropriate assessment and approval. External provider arrangements may also need to be terminated and data deletion confirmed where applicable. A controlled retirement process reduces the risk of abandoned accounts, forgotten integrations, unnecessary data retention, and unsupported systems remaining accessible after their business purpose has ended.

Question 75. Which governance activity helps determine whether an AI system continues to meet its approved purpose?

1. Periodic review of system performance, use, risks, and business alignment
2. Avoiding all monitoring after deployment
3. Assuming the original approval remains valid forever
4. Removing system ownership records

Correct Answer: 1. Periodic review of system performance, use, risks, and business alignment

Explanation:

An AI system may change significantly after its initial approval because business requirements, datasets, models, users, regulations, threats, or operating conditions can evolve. Periodic review allows the organization to determine whether the system still performs its approved function and whether existing controls remain appropriate. Reviews can examine performance results, incidents, complaints, risk indicators, data changes, model updates, access rights, and continued business need. If material changes are identified, the system may require reassessment or additional approval. Periodic governance therefore prevents initial authorization from becoming permanent without further scrutiny. The frequency of review should be proportionate to the system’s risk and operational importance.

Question 76. What is an AI risk register primarily used for?

1. Tracking identified AI risks, their owners, treatments, status, and related actions
2. Storing employee vacation requests
3. Replacing all security logs
4. Recording only successful AI outputs

Correct Answer: 1. Tracking identified AI risks, their owners, treatments, status, and related actions

Explanation:

An AI risk register provides a centralized record of risks identified during assessments, monitoring, audits, incidents, or other governance activities. Typical information can include the risk description, affected system, likelihood and impact considerations, risk owner, existing controls, treatment strategy, target dates, and current status. A risk register helps management maintain visibility into unresolved exposures and supports accountability for remediation. It can also reveal recurring risk patterns across multiple AI systems. The register should be maintained as a living governance artifact rather than a document created only for an initial assessment. Regular updates help ensure that decisions remain aligned with the organization’s current AI environment and risk profile.

Question 77. Why should AI risk treatment decisions be documented?

1. To provide traceability for how identified risks were evaluated and addressed
2. To prevent management from reviewing risks
3. To guarantee that all risks are eliminated
4. To replace technical controls

Correct Answer: 1. To provide traceability for how identified risks were evaluated and addressed

Explanation:

Documenting risk treatment decisions creates an auditable record of how an organization responded to identified AI risks. The record can show whether a risk was mitigated, transferred, avoided, accepted, or otherwise treated, along with the rationale, responsible owner, supporting controls, and approval where required. This is particularly important when residual risk remains after controls are implemented. Documentation enables management and assurance teams to understand why a particular decision was made and whether it remains appropriate. It also supports consistency across AI systems. Risk decisions should be reviewed when circumstances change because an earlier acceptance or treatment strategy may no longer provide an appropriate response to the current risk.

Question 78. Which approach best supports responsible management of residual AI risk?

1. Assume that implemented controls eliminate every possible risk
2. Identify remaining risk after controls and obtain appropriate acceptance or further treatment
3. Ignore risks that are difficult to measure
4. Transfer all responsibility to end users

Correct Answer: 2. Identify remaining risk after controls and obtain appropriate acceptance or further treatment

Explanation:

Residual risk is the level of risk that remains after controls have been implemented. In AI governance, organizations should recognize that controls rarely eliminate every possible exposure. After treatment measures are applied, the remaining risk should be evaluated against established risk criteria or appetite. If it is acceptable, an appropriately authorized person may formally accept it. If it is not acceptable, additional controls or alternative treatment may be required. Documenting this process creates accountability and helps prevent informal acceptance of significant exposures. Residual risk should also be monitored because changes in threats, model behavior, data, regulations, or business use can alter the level of remaining risk.

Question 79. What is a useful purpose of AI governance training for employees?

1. To ensure every employee becomes an AI developer
2. To eliminate the need for organizational policies
3. To help personnel understand their responsibilities, acceptable use requirements, risks, and reporting procedures
4. To allow unrestricted use of AI tools

Correct Answer: 3. To help personnel understand their responsibilities, acceptable use requirements, risks, and reporting procedures

Explanation:

AI governance depends not only on technical controls but also on informed users. Training can help employees understand approved AI tools, acceptable-use requirements, sensitive-data handling rules, verification expectations, common AI risks, and procedures for reporting suspicious or harmful behavior. Role-specific training can provide additional information to developers, administrators, managers, reviewers, and business users. Training should be practical and updated as organizational policies and AI capabilities evolve. It does not replace technical safeguards or governance processes, but it strengthens them by reducing misunderstandings and encouraging appropriate behavior. Well-designed awareness programs also help employees recognize when an AI use case requires additional review before deployment or use.

Question 80. Which indicator can help an organization monitor whether AI governance actions are being completed on time?

1. Number of AI-related logos in presentations
2. Percentage of overdue risk remediation or required governance reviews
3. Number of AI-related emails sent
4. Number of employees who have heard about AI

Correct Answer: 2. Percentage of overdue risk remediation or required governance reviews

Explanation:

The percentage of overdue remediation actions or governance reviews can provide a useful indicator of governance execution. If many high-priority actions remain overdue, management may need to investigate resource constraints, unclear ownership, ineffective processes, or insufficient escalation. The metric becomes more useful when segmented by risk level, business unit, system type, or age of the outstanding item. It should not be viewed in isolation because a low overdue percentage does not necessarily mean that an organization’s AI risks are low. Governance reporting should combine completion indicators with information about incidents, high-risk findings, exceptions, and emerging threats. This provides a more meaningful picture of whether governance processes are operating as intended.