ISACA · Free Practice Questions · Last reviewed May 2026
18 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
A company is adopting the ISO/IEC 42001 AI management system standard. What is the primary purpose of the 'Context of the Organization' clause?
To define the boundaries and strategic intent of the AI management system.
The Context of the Organization clause requires the organisation to determine external and internal factors, interested parties, and the scope and boundaries of the AI management system, aligning it with strategic direction. This establishes the foundation on which all subsequent ISO/IEC 42001 requirements are built.
To specify hardware requirements for training.
To mandate the use of cloud-based AI services.
To identify all bugs in the production code.
When drafting an AI policy, how should the organization address 'Human-in-the-Loop' (HITL) requirements?
Require HITL for every single AI inference.
Mandate HITL for high-impact or sensitive decision-making processes.
Mandating HITL for high-impact or sensitive decisions satisfies the risk-proportionate oversight constraint: human review is reserved for consequential outputs where errors cause material harm, while low-risk automation proceeds unreviewed. This aligns with governance frameworks requiring oversight intensity to match decision impact, avoiding blanket review that would render AI deployment impractical.
Delegate HITL requirements to the software development team.
Exclude HITL to maximize system throughput.
A multinational bank is deploying a proprietary LLM. Which approach provides the most robust assurance for model supply chain security?
Scanning all model weights using antivirus.
Reviewing the vendor's marketing brochure.
Limiting model access via VPN.
Implementing an AI Software Bill of Materials (SBOM).
An AI SBOM enumerates every model, dataset, library and dependency in the supply chain, giving the bank component-level visibility and provenance. This directly satisfies the demand for robust assurance by exposing tampered or vulnerable artefacts before deployment.
An AI security program manager is assessing AI risks. Which tool provides the most centralized oversight for AI model compliance?
An enterprise GRC platform with AI modules.
An enterprise GRC platform with AI capabilities holds an inventory of AI models and use cases with owners and risk ratings, maps controls to frameworks such as the NIST AI RMF, ISO/IEC 42001 and the EU AI Act, stores assessments and test evidence, tracks issues, and reports to management and auditors, all with access control and audit trails. That single system of record is what centralised oversight requires.
A local Python script for model testing.
A public open-source project management board.
A standard spreadsheet file.
When establishing an AI steering committee, which reporting cadence is most effective for ensuring board-level oversight of residual AI risk?
Weekly technical incident logs.
Quarterly strategic risk and compliance assessments.
Quarterly strategic risk and compliance assessments give the board a recurring, structured view of residual AI risk and control effectiveness, matching the cadence at which governance bodies meet. This satisfies board-level oversight without burying directors in operational detail between meetings.
Annual compliance attestation only.
Real-time dashboard access for all directors.
An enterprise is defining its 'AI System Inventory'. Which metadata attribute is most critical for assessing legal and regulatory risk?
Hardware acceleration type.
Inference latency in milliseconds.
Model training compute cost.
Training data source and provenance.
Training data source and provenance determines which copyright, licensing, privacy and sectoral regulations apply to each model, making it the attribute that most directly drives legal and regulatory risk assessment within the AI System Inventory.
Want more AI Governance And Program Management practice?
Practice this domainAn organization is using an LLM-based agent. What is the primary risk associated with 'indirect prompt injection' in this environment?
The model produces hallucinatory facts.
The API key for the LLM is exposed in the code.
The training data includes PII of users.
External data retrieved by the agent contains instructions that override system prompts.
Indirect prompt injection occurs when the agent ingests external content, such as web pages or documents, that embeds adversarial instructions. Those instructions are then processed as if legitimate, overriding the developer's system prompt and hijacking agent behaviour.
Which TWO of the following are primary risks associated with 'membership inference attacks' against an AI model?
Exposure of sensitive information about training data subjects.
Membership inference attacks determine whether a specific record was part of the training set. Success reveals that an individual's data was used for training, exposing sensitive information about those data subjects and potentially their attributes.
Violation of regulatory requirements like GDPR/HIPAA.
Membership inference reveals whether a specific individual's data trained the model, which constitutes processing of personal data. That disclosure can breach GDPR or HIPAA obligations covering lawful basis, confidentiality and patient privacy, making regulatory violation a primary risk.
Unauthorized modification of model weights.
Unauthorized access to the model training algorithm.
Complete system shutdown via resource exhaustion.
When establishing a risk management framework for GenAI, which THREE factors should be prioritized to satisfy the NIST AI Risk Management Framework requirements?
Continuous monitoring of model performance metrics.
Continuous monitoring of model performance metrics satisfies NIST AI RMF's MEASURE and MANAGE functions, detecting drift, degradation and emerging risks after deployment. It provides the ongoing evidence needed for GenAI risk frameworks, complementing governance and mapping activities rather than replacing them.
Establishing a robust AI governance structure.
A robust AI governance structure assigns accountability, oversight and decision rights across the GenAI lifecycle, which the NIST AI Risk Management Framework expects under its Govern function. This satisfies the stem's requirement to prioritise organisational accountability before technical controls are applied.
Ensuring the system is inherently secure and resilient.
Inherently secure and resilient systems resist adversarial manipulation, degradation and unexpected inputs, addressing the NIST AI Risk Management Framework's Secure and Resilient characteristic. This satisfies the stem's requirement by ensuring GenAI components maintain confidentiality, integrity and availability under attack or failure.
Requiring all models to be open-source.
Implementing a strict 'no external API' policy for all models.
A machine learning model is showing signs of 'data drift'. What is the most effective initial step in the risk assessment process?
Retrain the model immediately with all available data.
Analyze the statistical distribution of input production data versus training data.
Comparing production input distributions against training distributions directly quantifies drift, satisfying the stem's requirement for an initial risk assessment step. This statistical comparison reveals which features have shifted and by how much, providing the evidence needed before deciding on retraining, monitoring thresholds, or mitigation. It precedes remediation, making it the correct first action.
Shut down the application to prevent incorrect predictions.
Change the model architecture to a more complex design.
During an adversarial threat modeling exercise for a facial recognition system, you identify a risk of pixel perturbation attacks. Which countermeasure is the most appropriate technical control to implement?
Apply data masking to the input images.
Implement differential privacy during data preprocessing.
Conduct adversarial training by injecting perturbed samples into the training set.
Adversarial training injects deliberately perturbed samples into the training set, hardening the model's decision boundaries against pixel-level manipulation. This is a technical control applied within the model itself, satisfying the stem's requirement to counter pixel perturbation attacks at the algorithm level.
Increase the model epoch count to improve generalization.
You are assessing a supply chain risk where an AI model uses a pre-trained base model from a third-party hub. Which action most effectively mitigates the risk of model poisoning during the integration phase?
Implement role-based access control for the training pipeline.
Run a sensitivity analysis on the model output.
Validate the model hash against the vendor's provided checksum manifest.
Verifying the downloaded model's hash against the vendor's published checksum manifest detects any tampering introduced during transfer or hosting, directly addressing poisoning before integration. This cryptographic integrity check confirms the artefact matches the trusted original.
Enable MFA for the model registry access.
Want more AI Risk Management practice?
Practice this domainYou are configuring AWS Bedrock Guardrails to prevent the model from returning PII. Which specific configuration setting should be enabled to ensure PII filtering is applied to both prompt and response?
Use the prompt engineering instruction 'Do not output PII' in the System Prompt field.
Set the content moderation filter level to 'High' in the model configuration.
Apply an IAM policy to the Bedrock execution role restricting access to PII-containing datasets.
Enable PII filtering in the Policy Settings for both 'input' and 'output' content flows.
Bedrock Guardrails apply PII filters per content flow, so enabling the sensitive-information policy for both input and output ensures prompts and completions are each screened. Configuring only one flow would leave the other unfiltered, breaching the requirement.
You are configuring Microsoft Defender for Cloud to monitor your Azure OpenAI service. Which specific resource diagnostic setting must be enabled to ensure that prompt injection attempts are logged in the Log Analytics workspace?
Enable 'AccessControl' logging in Entra ID
Enable 'RequestResponse' diagnostic logs for the AI resource
The RequestResponse diagnostic log category captures the prompt and completion payloads exchanged with the Azure OpenAI resource. Enabling it streams those interaction records to the Log Analytics workspace, where Defender for Cloud can detect and surface prompt injection attempts, satisfying the logging requirement.
Enable 'MetricAlerts' at the subscription level
Enable 'AuditLogs' in the Storage Account settings
An organization is using Google Cloud Vertex AI and suspects an adversarial poisoning attack on a custom training dataset. Which tool should be used to verify the integrity and provenance of the training artifacts?
Vertex AI Pipelines caching
Cloud Data Loss Prevention (DLP) API
Cloud Armor WAF
Vertex AI ML Metadata
Vertex AI ML Metadata records lineage, parameters and artifact hashes for each training run, letting you trace dataset provenance and detect tampering. This satisfies the stem's requirement to verify integrity and provenance of training artifacts.
You are auditing access controls for a Microsoft Azure OpenAI deployment. Which TWO of the following configurations are required to ensure identity-based access and logging for model inference?
Enable the 'Prompt Injection' toggle in the Azure Portal global settings.
Enable 'Diagnostic settings' to route logs to a Log Analytics workspace.
Diagnostic settings stream inference request and response logs from the Azure OpenAI resource to a Log Analytics workspace, satisfying the logging half of the requirement. Without this routing, audit records of model inference remain unavailable for review, so identity-based access alone cannot be evidenced.
Assign RBAC role 'Cognitive Services OpenAI User' to the service principal.
The 'Cognitive Services OpenAI User' role grants the service principal data-plane permission to invoke model inference against the Azure OpenAI resource. Without this RBAC assignment, Microsoft Entra ID authentication succeeds but inference requests are rejected, so identity-based access to the deployment cannot function.
Create a shared API key for all users to simplify service account management.
Set the model to 'Public Access' in the Networking tab for easier debugging.
You are managing a PyTorch model and suspect data poisoning during the training phase. Which practice is the most effective technical control to verify training data integrity in an MLOps pipeline?
Increasing model quantization
Reducing the number of training epochs
Enabling 'Multi-Factor Authentication' on the training cluster
Implementing 'Data Lineage' with checksum validation
Checksum validation within data lineage detects any post-ingestion alteration of training records, directly satisfying the integrity-verification constraint for poisoning during training. Hashing each dataset version and comparing against recorded digests exposes tampering that statistical drift checks would miss.
To prevent unauthorized access to an Amazon Bedrock model, which AWS service is the primary point of control for enforcing 'Least Privilege' at the API layer?
AWS IAM
AWS IAM is the primary API-layer control point for Bedrock, using identity-based and resource-based policies plus condition keys to grant least-privilege access to model invocation actions. It enforces authorisation before any Bedrock API request is processed.
AWS Glue
AWS CloudFront
Amazon S3
Want more AI Technologies And Controls practice?
Practice this domainThe AAISM exam has 90 questions and must be completed in 150 minutes. The passing score is 450 (scaled 200–800). Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 3 domains: AI Governance And Program Management, AI Risk Management, AI Technologies And Controls. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official ISACA AAISM exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.