AAISM Flashcards — Free ISACA Advanced in AI Security Management (AAISM) (AAISM) Study Cards

To define the boundaries and strategic intent of the AI management system.

In ISO/IEC 42001, Clause 4 'Context of the Organization' establishes why the AI management system exists and what it must cover. It requires the organization to determine external and internal issues, identify interested parties and their requirements, and define the scope and boundaries of the AIMS aligned with strategic direction. Option A captures this purpose: defining boundaries and strategic intent so all subsequent clauses (leadership, planning, support, operation, evaluation, improvement) operate within a coherent frame.

External data retrieved by the agent contains instructions that override system prompts.

Indirect prompt injection occurs when an LLM-based agent retrieves external content (web pages, documents, emails, tool outputs) that contains hidden instructions, and those instructions are interpreted by the model as if they came from the system or user. The attacker does not need direct access to the prompt — they poison the data the agent will later ingest. This can cause the agent to exfiltrate data, call tools with malicious parameters, or ignore its original system prompt.

Enable PII filtering in the Policy Settings for both 'input' and 'output' content flows.

AWS Bedrock Guardrails provides a dedicated PII filter that must be explicitly enabled in the sensitive information policy settings, with separate configuration for input (prompt) and output (response) flows. Enabling PII filtering on both flows ensures detection and masking/blocking of PII in either direction, which is the only configuration that satisfies the requirement.

It is the theft of intellectual property via query analysis

Model stealing is the extraction of a model's functionality or intellectual property through repeated query analysis — an attacker probes the API with crafted inputs and uses the input-output pairs to train a surrogate model that approximates the original. It is a security incident because it compromises the owner's IP and can enable further attacks such as adversarial example transfer and evasion of the original model. The economic value of a trained model is directly eroded when it can be cloned via the inference API.

Tracking changes in the statistical distribution of input data over time.

Tracking changes in input data distributions is the most critical element for detecting model drift because it directly identifies covariate shift, a primary cause of performance degradation. Other options focus on usage metrics, static historical performance, or code management, none of which provide early warning of drift in a live supply chain environment.

Containment and impact assessment.

The first step in incident response, including AI model failures, is containment and impact assessment. Containment stops the failure from spreading or causing further harm (e.g., disabling the model endpoint, reverting to a safe version), while impact assessment determines the scope, affected users, and business damage. This aligns with standard IR frameworks like NIST SP 800-61, where containment follows detection and precedes eradication and recovery.

aiplatform.endpoints.create

Deploying a model to a Vertex AI endpoint requires creating an endpoint resource, which is governed by the aiplatform.endpoints.create permission. Without this permission, a user cannot provision a public endpoint even if they can read metadata or upload models. Restricting this permission to authorized principals is the direct IAM control that prevents unauthorized public exposure of a base model.

Manage identities and access to resources

Identity and Access Management (IAM) in an AI-driven cloud environment governs who (users, services, applications) can access which resources (models, datasets, compute, APIs) and under what conditions. Its primary function is authentication, authorization, and policy enforcement across the cloud environment, ensuring least-privilege access to AI assets.

Data quality, lineage, and access controls.

The primary focus of a Data Governance review in an AI audit is to ensure that the data used for training, validation, and inference is reliable, traceable, and properly protected. Data quality ensures the model's outputs are accurate and unbiased; lineage provides an audit trail from source to model; and access controls enforce security and privacy. These elements are foundational to trustworthy AI systems and are explicitly covered in governance frameworks like the NIST AI RMF and ISO/IEC 42001.

A defined AI accountability structure that assigns ultimate ownership of AI outcomes to a named executive body

The General Counsel is asking for governance ownership, not operational controls. An AI governance charter must name the executive or board-level body that ultimately owns AI outcomes, including legal and regulatory consequences. Intake processes, monitoring standards, and control baselines support that ownership but do not establish it.

Opacus

Opacus is a library developed by Meta specifically for training PyTorch models with differential privacy. It provides a PrivacyEngine that wraps standard PyTorch optimizers and DataLoaders to add per-sample gradient clipping and calibrated Gaussian noise, implementing the DP-SGD algorithm natively within the PyTorch autograd graph. This tight integration means you can make an existing PyTorch training loop differentially private with only a few lines of code.

It trains the model on adversarial examples alongside clean data.

Adversarial training is a defense technique where the model is trained on a dataset that includes both clean examples and adversarial examples—inputs intentionally perturbed to fool the model. By learning from these adversarial examples, the model becomes more robust and can correctly classify them, thereby improving its resistance to evasion attacks.

To provide an audit trail for incident investigation

Logging in an AI system captures events, inputs, outputs, model versions, and decisions over time so that incidents can be reconstructed and responsibility assigned. Its primary governance purpose is to provide an audit trail for incident investigation (B) — determining what the model did, why, and under what conditions when something goes wrong. This is foundational to AI incident response, regulatory reporting, and post-mortem analysis.

Implement output perturbation

Output perturbation deliberately adds noise or rounds confidence scores returned by the API, degrading the fidelity of the information an adversary can use to train a clone. Model extraction relies on precise output signals, so perturbing them reduces clone accuracy while preserving acceptable utility for legitimate users. This is a direct, low-cost mitigation at the inference boundary.

Implement continuous monitoring of model outputs with fairness metrics and a defined mitigation workflow.

Continuous monitoring with fairness metrics and a mitigation workflow is the most effective approach because it provides ongoing detection and correction of bias in production. It acknowledges that bias is not a one-time issue and requires sustained vigilance. This control enables the governance team to fulfill its responsibility to ensure equitable AI outcomes and comply with regulations.

The model may contain backdoors or malicious code.

Pre-trained models downloaded from public hubs (e.g., Hugging Face, TensorFlow Hub) are serialized artifacts that may execute arbitrary code on load — Python pickle files, custom layers, or Lambda layers can embed malicious payloads. Without verification (checksums, signatures, model cards, or scanning), an attacker who uploaded a poisoned model can achieve code execution or implant a backdoor that triggers on specific inputs. This is the primary supply-chain risk of consuming untrusted model artifacts.

Prohibiting the input of confidential, personal, or proprietary data into public generative AI tools.

The most direct way to prevent sensitive data leakage through public generative AI tools is to prohibit entering such data into them. This policy element removes the risky behaviour itself, rather than relying on training, access controls, or endpoint monitoring that do not specifically address the content shared with external AI services. It is clear, enforceable, and targeted at the root cause.

Mandatory disclosure requirements when content is generated by AI.

Mandatory disclosure requirements when content is generated by AI directly support transparency and accountability obligations under data protection regulations like GDPR and CCPA. These laws require individuals to be informed about how their data is used and to have the ability to exercise rights; AI-generated content that involves personal data must be disclosed to avoid deceptive practices. By embedding disclosure into the marketing policy, the firm ensures that consumers are aware of automated decision-making and can challenge or opt out, aligning with legal requirements for fair and transparent processing.

Maintaining model documentation that records features, decision logic, and known limitations

Model documentation that records features, decision logic, and known limitations is the practice that enables the provider to explain triage recommendations to clinicians and regulators. It creates an inspectable record of how the model behaves, which is what explainability governance requires, unlike architecture choice, access restriction, or dataset size.

Digital signatures

Digital signatures use asymmetric cryptography to provide authenticity and integrity for a model file. The signer creates a hash of the model artifact and encrypts it with their private key; anyone with the public key can verify that the file originated from the trusted source and has not been tampered with. This is the standard mechanism for ensuring model provenance in S3 or any artifact repository.