AAISM Practice Test 16 — 15 Questions

Question 1

Which THREE of the following are effective ways to secure the 'ML Pipeline' (MLOps) against supply chain attacks?

Accepted Answer

Use isolated environments for pipeline stages. Option A is correct because isolating pipeline stages (e.g., separate containers, namespaces, or VMs with least-privilege network and credential scoping) limits lateral movement and blast radius if an upstream stage or dependency is compromised. Option B is correct because cryptographically signing container images (e.g., with Sigstore Cosign, Notary, or Docker Content Trust) and verifying signatures at admission/deploy time ensures only trusted, untampered artifacts enter the pipeline, directly mitigating artifact-tampering supply chain attacks. Option E is correct because scanning third-party libraries and dependencies (e.g., with SCA tools like Trivy, Grype, or OWASP Dependency-Check against CVE databases) detects known vulnerabilities in externally sourced components before they are built into the pipeline. Option C is wrong because disabling CI/CD logging removes auditability and detection capability, which weakens incident response rather than securing the supply chain. Option D is wrong because running the pipeline as root violates least privilege and dramatically increases the impact of any compromise.

Answer

Disable all CI/CD pipeline logging

Answer

Always run the pipeline as a root user

Question 2

An AI security manager is implementing an AI governance framework using the NIST AI RMF. Which action best demonstrates the 'Govern' function for a new generative AI deployment?

Accepted Answer

Defining roles, responsibilities, and accountability for AI system outcomes.. The NIST AI RMF 'Govern' function establishes the organizational structures, policies, and accountability mechanisms that permeate all other functions (Map, Measure, Manage). Defining roles, responsibilities, and accountability for AI outcomes is the canonical Govern activity because it creates the human and procedural infrastructure for AI risk management. Without clear ownership, no other control — technical or otherwise — can be reliably enforced.

Answer

Configuring API rate limits in the AI gateway.

Answer

Conducting a red-teaming exercise for prompt injection.

Answer

Performing automated unit testing on model outputs.

Question 3

An AI security program manager is assessing AI risks. Which tool provides the most centralized oversight for AI model compliance?

Accepted Answer

An enterprise GRC platform with AI modules.. An enterprise GRC (Governance, Risk, and Compliance) platform with AI-specific modules centralizes policy management, control mapping, risk registers, evidence collection, and regulatory reporting across all AI models in one system of record. This gives the AI security program manager a single pane of glass for compliance status, audit trails, and cross-model risk aggregation — the definition of centralized oversight. Purpose-built AI modules map controls to frameworks like NIST AI RMF, ISO/IEC 42001, and the EU AI Act.

Answer

A local Python script for model testing.

Answer

A public open-source project management board.

Answer

A standard spreadsheet file.

Question 4

What is the primary risk associated with 'Data Poisoning' in an AI governance program?

Accepted Answer

Compromised model integrity and reliability.. Data poisoning is an integrity attack in which an adversary manipulates training data to corrupt the model's learned behavior, degrading its accuracy, reliability, and trustworthiness. The primary governance risk is therefore compromised model integrity and reliability, which can lead to incorrect decisions, safety failures, and loss of stakeholder trust. This is a foundational AI security concern because it attacks the model at its source rather than at inference time.

Answer

System uptime improvement.

Answer

Increased cloud storage bills.

Answer

Reduced model file size.

Question 5

Which of the following is a 'Control' for mitigating the risk of 'Prompt Injection'?

Accepted Answer

Sandboxed execution environment for agents. A sandboxed execution environment for agents is the correct control because prompt injection attacks aim to make an LLM-driven agent execute unintended actions (e.g., calling tools, accessing files, or making network requests). Sandboxing constrains what the agent can actually do even if the prompt is manipulated, enforcing least privilege at the execution layer. This is a defense-in-depth control that limits blast radius rather than trying to perfectly filter malicious prompts.

Answer

Using a larger language model

Answer

Providing the agent with full root access

Answer

Disabling output validation

Question 6

Which TWO factors help maintain 'AI Accountability'?

Accepted Answer

Clearly defined roles for model owners and stakeholders.. Option A is correct because AI accountability requires clear ownership: defining who owns the model, who is responsible for its outcomes, and which stakeholders are accountable for decisions ensures that responsibility can be traced and enforced rather than diffused. Option E is correct because comprehensive documentation of the model's development and use—covering data sources, design choices, training, testing, and deployment context—creates the audit trail and transparency needed to review, explain, and justify the model's behavior. Together, defined roles and thorough documentation make it possible to attribute decisions and outcomes to specific people and processes. Option B is incorrect because relying only on external consultants does not establish internal accountability and can even obscure who is responsible. Option C is incorrect because fully automated, non-human review removes human judgment and oversight, which undermines rather than supports accountability. Option D is incorrect because removing audit logs destroys the evidence needed to trace and verify decisions, directly contradicting accountability.

Answer

Hiring only external consultants for AI.

Answer

Automated, non-human review of all processes.

Answer

Removing all audit logs.

Question 7

Which THREE items should be included in an 'AI Vendor Assessment'?

Accepted Answer

Review of the model transparency/model card documentation.. A is correct because reviewing model transparency and model card documentation lets the assessor verify what data, limitations, intended use, and performance characteristics the AI model has, which is essential for informed third-party risk decisions. C is correct because evaluating the vendor's AI risk framework shows whether they govern AI risks through policies, controls, monitoring, and accountability aligned to standards such as NIST AI RMF or ISO/IEC 42001. D is correct because evidence of secure development practices, such as SDLC controls, code review, testing, and vulnerability management, demonstrates that the AI system is built and maintained securely. B is not appropriate because employees' personal home addresses are private personal data irrelevant to assessing an AI vendor's risk posture. E is not appropriate because requiring the vendor's entire source code repository is excessive, impractical, and not a standard assessment item; source code may be proprietary and is typically reviewed only under specific escrow or audit arrangements.

Answer

The personal home addresses of all employees.

Answer

The vendor's entire source code repository.

Question 8

Which TWO steps are recommended to secure access to an AI model registry?

Accepted Answer

Implement Role-Based Access Control (RBAC). Option B is correct because implementing Role-Based Access Control (RBAC) enforces least-privilege access to the AI model registry, ensuring users and service accounts only receive the permissions (e.g., read, push, delete) required for their role, which limits unauthorized model access or tampering. Option D is correct because enforcing Multi-Factor Authentication (MFA) adds a second verification factor beyond a password, significantly reducing the risk of credential theft or replay attacks against registry accounts. The unmarked options do not belong: storing credentials in plain text (A) exposes secrets to anyone with file access, disabling audit logging (C) removes accountability and detection of suspicious registry activity, and allowing public access for all users (E) grants unrestricted access that violates least-privilege and confidentiality principles.

Answer

Store registry credentials in plain text configuration files

Answer

Disable audit logging to reduce storage costs

Answer

Allow 'Public' access for all users to promote model sharing

Question 9

Which THREE criteria are essential for evaluating the risk of an AI vendor's 'Model Card'?

Accepted Answer

Disclosure of training data sources.. Option A is correct because a Model Card must disclose training data sources so evaluators can assess provenance, licensing, consent, and potential bias introduced by the data. Option B is correct because performance metrics broken down across demographic groups reveal disparate impact and fairness risks that aggregate accuracy scores would hide. Option E is correct because documented known limitations and failure modes define the boundaries of safe use and the residual risk when the model is deployed outside its intended context. Option C does not belong because a vendor's annual financial report addresses corporate fiscal health, not the model's risk profile. Option D does not belong because headcount is an organizational metric with no direct bearing on model risk, bias, or reliability.

Answer

The vendor's annual financial report.

Answer

The number of employees at the vendor.

Question 10

An AI security team needs to ensure that internal AI tools comply with the organization's 'Human-in-the-Loop' policy. Which architectural control best enforces this governance requirement?

Accepted Answer

Integrating a mandatory 'human approval' task within the business logic workflow of the AI orchestration layer.. Embedding a mandatory human approval task directly in the orchestration workflow's business logic ensures that no AI decision proceeds to action without explicit human sign-off. This is an architectural enforcement — it cannot be bypassed by model behavior or user configuration. The other options are supporting controls but do not enforce the HITL gate.

Answer

Enabling role-based access control (RBAC) in the AI model management system.

Answer

Configuring audit logs for all AI interactions.

Answer

Updating the model weights to penalize autonomous decision-making.

Answer

Applying data loss prevention (DLP) rules to the model training dataset.

Question 11

Why is it important to perform 'Model Validation' before production deployment?

Accepted Answer

To verify performance and safety against benchmarks. Model validation before production verifies that the model meets defined performance, fairness, robustness, and safety benchmarks on representative data, ensuring it behaves as intended in real-world conditions. It is a governance gate that catches degradation, bias, or unsafe behavior before customers or critical processes are affected. Removing users, encrypting weights, and reducing GPU costs are unrelated to validation's purpose.

Answer

To automatically remove users from the system

Answer

To encrypt the model weights

Answer

To reduce the cost of GPU hardware

Question 12

You are configuring AWS Bedrock Guardrails to prevent the model from returning PII. Which specific configuration setting should be enabled to ensure PII filtering is applied to both prompt and response?

Accepted Answer

Enable PII filtering in the Policy Settings for both 'input' and 'output' content flows.. AWS Bedrock Guardrails provides a dedicated PII filter that must be explicitly enabled in the sensitive information policy settings, with separate configuration for input (prompt) and output (response) flows. Enabling PII filtering on both flows ensures detection and masking/blocking of PII in either direction, which is the only configuration that satisfies the requirement.

Answer

Use the prompt engineering instruction 'Do not output PII' in the System Prompt field.

Answer

Set the content moderation filter level to 'High' in the model configuration.

Answer

Apply an IAM policy to the Bedrock execution role restricting access to PII-containing datasets.

Question 13

To prevent unauthorized access to an Amazon Bedrock model, which AWS service is the primary point of control for enforcing 'Least Privilege' at the API layer?

Accepted Answer

AWS IAM. AWS IAM is the primary control plane for authentication and authorization across AWS services, including Amazon Bedrock, and it is where least-privilege policies are defined for who can invoke which models and actions. Bedrock integrates with IAM so that permissions like bedrock:InvokeModel are granted or denied at the API layer through identity-based and resource-based policies. Glue, CloudFront, and S3 serve different purposes and do not govern Bedrock API access.

Answer

AWS Glue

Answer

AWS CloudFront

Answer

Amazon S3

Question 14

What is the purpose of 'AI Model Inventory'?

Accepted Answer

To provide a central list of all AI assets for risk oversight.. An AI Model Inventory is a centralized, governed catalog of all AI/ML models in an organization, capturing metadata such as owner, purpose, training data sources, version, risk classification, and deployment status. Its primary purpose is to enable risk oversight, compliance reporting, and lifecycle governance by giving stakeholders a single source of truth for what AI assets exist and how they are managed. This supports audit, incident response, and regulatory inquiries.

Answer

To increase the speed of the training pipeline.

Answer

To reduce the number of GPUs used.

Answer

To automatically retrain all models.

Question 15

You are managing an AI project and notice the model is performing poorly on a subset of data representing a protected class. What is the correct next step in the risk assessment process?

Accepted Answer

Investigate the data representation and training balance for that subgroup.. When a model underperforms on a protected subgroup, the correct risk-management response is to investigate root causes — typically data underrepresentation, label imbalance, or sampling bias — before taking remediation action. This diagnostic step preserves the model and data while identifying the specific fairness gap to address.

Answer

Immediately delete all training data.

Answer

Dismiss the finding as a minor edge case.

Answer

Replace the model architecture with a simpler one.