AAISM Practice Test 13 — 15 Questions

Question 1

Which THREE of the following are technical controls to prevent 'Model Extraction' attacks?

Accepted Answer

API Rate Limiting. API Rate Limiting (A) is correct because throttling the number and frequency of inference queries per client makes it economically and practically infeasible to harvest enough input-output pairs to reconstruct a model's decision boundary. Output perturbation (B) is correct because injecting calibrated noise into returned predictions degrades the fidelity of the surrogate model an attacker can train, while preserving utility for legitimate users. Reducing output detail/granularity (D) is correct because returning only coarse labels or rounded confidence scores instead of full probability vectors removes the rich gradient-like information attackers rely on for high-fidelity extraction. Increasing the model learning rate (C) is not a security control at all—it is a training hyperparameter that affects convergence and could even destabilize the model—and providing all intermediate model outputs (E) is the opposite of a defense, since exposing internal representations gives attackers far more signal to clone the model.

Answer

Increasing the model learning rate

Answer

Providing all intermediate model outputs

Question 2

An enterprise risk committee is reviewing a generative AI assistant that recommends credit-limit increases. The model is a third-party SaaS large language model (LLM) accessed via API, with no visibility into its training data, weights, or fine-tuning process. The committee wants to know which risk treatment best addresses residual model risk before the assistant goes live, given that the vendor will not permit audits of the model itself.

Accepted Answer

Implement a human-in-the-loop review gate where a credit officer must approve every recommended limit increase before it is applied.. When a model cannot be audited or validated at the source, the enterprise must apply compensating controls at the point of decision. A human-in-the-loop approval gate ensures no unverified model output directly affects a customer, creating an auditable record and preserving accountability. Vendor attestations, randomness tuning, and insurance address adjacent concerns but do not reduce the residual model risk created by an opaque third-party LLM.

Answer

Increase the model's temperature setting so recommendations vary more and bias is averaged out across multiple runs.

Answer

Purchase cyber-liability insurance that explicitly names AI model error as a covered peril and close the risk item.

Answer

Request the vendor's SOC 2 Type II report and rely on it as evidence that model risk has been transferred.

Question 3

You are reviewing logs for an AI service. You notice a high frequency of '429 Too Many Requests' errors. Which security control is likely being triggered to protect the model from potential automated extraction or DoS?

Accepted Answer

API Rate Limiting. HTTP 429 'Too Many Requests' is the standard status code returned when a client exceeds a defined request rate. API rate limiting is the security control that enforces these thresholds, protecting the model endpoint from abuse such as automated model extraction (stealing the model via repeated queries) or denial-of-service. By capping requests per identity or IP, rate limiting preserves availability and limits data exfiltration.

Answer

Model Drift Monitoring

Answer

Data Encryption at Rest

Answer

Input Sanitization

Question 4

Which TWO of the following are primary risks associated with 'membership inference attacks' against an AI model?

Accepted Answer

Exposure of sensitive information about training data subjects.. Option A is correct because a membership inference attack determines whether a specific individual's record was part of the model's training set, which directly leaks sensitive information about those data subjects (e.g., revealing that a person was in a medical or financial dataset). Option B is correct because such exposure of personal data without consent or legal basis can breach privacy regulations such as GDPR or HIPAA, triggering legal and compliance consequences. Option C is not a membership inference risk, since modifying model weights is an integrity/poisoning attack, not an inference/privacy attack. Option D is incorrect because membership inference exploits the model's outputs and does not grant access to the training algorithm itself. Option E is also incorrect because resource exhaustion leading to system shutdown is a denial-of-service concern, unrelated to inferring training-set membership.

Answer

Unauthorized modification of model weights.

Answer

Unauthorized access to the model training algorithm.

Answer

Complete system shutdown via resource exhaustion.

Question 5

An AI risk manager is presenting to the board on the organization's AI risk appetite. The board asks how the organization should handle an AI system that delivers high business value but has a residual risk level that exceeds the stated risk appetite for model accuracy in financial forecasting. Which response BEST reflects ISACA's risk management principles?

Accepted Answer

Present options for risk treatment including additional controls to reduce residual risk, a time-bound exception with compensating controls, or suspension of the system, and document the board's decision.. ISACA's risk management principles require the risk manager to present decision makers with a full range of treatment options and ensure the chosen path is documented. When residual risk exceeds appetite but business value is high, the appropriate response is a managed exception with compensating controls and a remediation timeline, approved and recorded at the appropriate governance level. This preserves both accountability and business continuity.

Answer

Suspend the AI system immediately because any residual risk exceeding the stated appetite represents an unacceptable control failure.

Answer

Revise the risk appetite statement to accommodate the AI system's residual risk level so the system remains compliant with policy.

Answer

Accept the residual risk because the business value outweighs the risk and the board has ultimate authority to approve exceptions.

Question 6

Which security principle is violated when an AI model is allowed to access external data sources without sufficient authorization checks on the data itself?

Accepted Answer

Broken Access Control. Broken Access Control (A) is violated when an AI model accesses external data sources without proper authorization checks on the data itself — the model is effectively bypassing the access control layer that should govern which data it can read. This is the OWASP Top 10 #1 category and applies directly to AI systems that pull from APIs, databases, or file stores without enforcing per-resource authorization. The model should only reach data its service identity is explicitly permitted to access.

Answer

Model Poisoning

Answer

Model Inversion

Answer

Evasion Attack

Question 7

A security analyst is reviewing the risk register for a deployed credit-scoring AI model and notices that the 'Model Drift' risk entry has no owner and no monitoring threshold. The model currently performs well on the original validation set. What is the MOST appropriate action for the analyst to take?

Accepted Answer

Assign an accountable risk owner, define drift monitoring thresholds and triggers, and establish a documented response process.. An unowned, threshold-less drift risk in a credit-scoring model is an unmanaged risk, not an accepted one. Effective AI risk management requires an accountable owner, quantified monitoring thresholds with alerting, and a documented response process, which together turn a latent risk into a governed control. Deferring, decommissioning, or passively accepting the risk all fail to establish the governance the scenario demands.

Answer

Immediately decommission the model and replace it with a rules-based scoring system to eliminate drift risk entirely.

Answer

Document the drift risk in the register as accepted, noting that the model's current accuracy exceeds the business requirement.

Answer

Wait until the next scheduled annual model retraining to reassess drift, since the model currently meets performance targets.

Question 8

Which THREE items should be included in an 'AI Inventory'?

Accepted Answer

Unique model identifier and version.. An AI inventory must track each model's unique model identifier and version (B) so that specific artifacts can be located, audited, and reproduced, since different versions can behave differently and require distinct governance. It should also record the assigned risk classification (D), because risk tiering (e.g., high-risk vs. minimal-risk) determines the controls, documentation, and review cadence applied to the model. The designated business owner (E) is essential for accountability, ensuring a named party is responsible for the model's lifecycle, approvals, and incident response. Options A and C are irrelevant personal preferences that have no bearing on governance, traceability, or risk management, so they do not belong in an AI inventory.

Answer

The model's favorite color.

Answer

The developer's favorite food.

Question 9

Which team should lead the definition of 'AI Acceptable Use' policies?

Accepted Answer

A cross-functional committee including legal, privacy, and security.. AI Acceptable Use policies span legal liability, data privacy regulation (GDPR, CCPA), security controls, and business ethics — no single department owns all of these domains. A cross-functional committee ensures the policy reflects regulatory obligations, privacy constraints, security requirements, and operational realities simultaneously. This mirrors how organizations govern other enterprise-wide policies like information security and data retention.

Answer

The marketing department.

Answer

The software engineering team only.

Answer

The IT helpdesk team.

Question 10

What is the primary role of a 'Human-in-the-loop' (HITL) in AI risk management?

Accepted Answer

To provide oversight and intervention for critical model decisions.. Human-in-the-loop (HITL) in AI risk management ensures that a human reviews, approves, or overrides critical model decisions, providing oversight and accountability. This is essential for high-stakes domains such as healthcare, finance, and autonomous systems, where erroneous AI outputs can cause harm. HITL mitigates risks like bias, hallucination, and opaque decision-making by inserting human judgment at key decision points.

Answer

To write the model code.

Answer

To speed up the inference process.

Answer

To handle technical server maintenance.

Question 11

When establishing an AI steering committee, which reporting cadence is most effective for ensuring board-level oversight of residual AI risk?

Accepted Answer

Quarterly strategic risk and compliance assessments.. Board-level oversight of residual AI risk requires a cadence that balances strategic depth with timeliness. Quarterly strategic risk and compliance assessments give the board enough time to review aggregated risk posture, emerging regulatory changes, and mitigation effectiveness without being overwhelmed by operational noise. This aligns with typical enterprise risk governance cycles and regulatory expectations for board engagement.

Answer

Weekly technical incident logs.

Answer

Annual compliance attestation only.

Answer

Real-time dashboard access for all directors.

Question 12

Which TWO factors are critical when assessing the risk of a new Generative AI use case?

Accepted Answer

The potential business impact if the system fails.. Option D is correct because risk assessment for a Generative AI use case must weigh the potential business impact if the system fails, including financial loss, operational disruption, reputational damage, and regulatory consequences, which determine the severity of the risk. Option E is correct because the sensitivity of the data being processed directly drives the likelihood and severity of harm, since handling PII, PHI, financial records, or trade secrets triggers stricter controls such as GDPR, HIPAA, or PCI DSS obligations and raises exposure to data leakage or misuse. Options A, B, and C are not critical risk factors: UI aesthetics affect user experience but not risk exposure, developer office location is irrelevant to the model's risk profile, and the programming language used is an implementation detail that does not materially change the business or data-sensitivity risk of the use case.

Answer

The aesthetic of the user interface.

Answer

The office location of the developers.

Answer

The programming language used.

Question 13

A multinational bank is deploying a proprietary LLM. Which approach provides the most robust assurance for model supply chain security?

Accepted Answer

Implementing an AI Software Bill of Materials (SBOM).. An AI Software Bill of Materials (SBOM) provides a structured, machine-readable inventory of all components in the model supply chain — base model, fine-tuning datasets, libraries, dependencies, and their versions and provenance. This transparency is the most robust assurance mechanism because it enables vulnerability tracking, license compliance, and provenance verification across the entire supply chain. It directly addresses the risk of hidden or compromised components in proprietary LLMs.

Answer

Scanning all model weights using antivirus.

Answer

Reviewing the vendor's marketing brochure.

Answer

Limiting model access via VPN.

Question 14

Which TWO security controls are recommended for protecting 'Training Data'?

Accepted Answer

Encryption at rest for all dataset storage.. Option D is correct because encryption at rest protects training datasets on disk, object storage, or backups from unauthorized disclosure if the underlying storage media or snapshots are compromised, using mechanisms such as AES-256 or cloud KMS-managed keys. Option E is correct because strict role-based access control (RBAC) limits who can read, modify, or export training data, enforcing least privilege and reducing insider or accidental exposure through defined roles and permissions. Together these controls address both data confidentiality at the storage layer and authorized access at the identity layer, which are core recommendations for protecting sensitive training data. Option A is not appropriate because publicly hosting data on GitHub exposes it to anyone and destroys confidentiality, even if reproducibility is a goal. Option B is wrong because embedding passwords in training data creates a severe credential leak and violates basic secret-handling practices. Option C is irrelevant because image resolution has no bearing on the security of training data.

Answer

Publicly hosting the data on GitHub for reproducibility.

Answer

Storing all passwords in the training data.

Answer

Using only high-resolution images.

Question 15

Which TWO actions should be taken when implementing an AI security monitoring strategy in a production environment?

Accepted Answer

Implement automated alerting for anomalous request patterns. Option A is correct because automated alerting for anomalous request patterns enables continuous detection of threats such as prompt injection, model abuse, credential stuffing, or data exfiltration attempts, which is essential for a production AI security monitoring strategy. Option C is correct because real-time logging of all model inputs and outputs provides the audit trail and forensic evidence needed to investigate incidents, detect drift or misuse, and satisfy compliance requirements in production. Option B is incorrect because disabling API telemetry removes the visibility needed to detect and respond to attacks, weakening rather than strengthening security. Option D is incorrect because a static IP allowlist is brittle and insufficient for AI workloads that may use dynamic or distributed clients; stronger authentication and authorization controls are required. Option E is incorrect because daily retraining regardless of drift is an operational model-management decision, not a security monitoring action, and can introduce instability or new vulnerabilities.

Answer

Disable all API telemetry to reduce attack surface

Answer

Use a static list of IP addresses for all model access

Answer

Perform daily model retraining regardless of drift