AAISM Practice Test 18 — 15 Questions

Question 1

A global bank has deployed a real-time fraud detection model that processes payment card transactions. The model was trained on historical transaction data and is now in production. To detect concept drift, the security team wants to monitor the model's performance without waiting for verified fraud labels, which may take weeks to obtain. Which approach should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Monitor the distribution of input features and model prediction scores using statistical distance metrics such as Population Stability Index (PSI) and compare against a baseline.. When ground truth labels are delayed, monitoring input feature distributions and prediction score distributions against a baseline is the most practical way to detect concept drift. Statistical metrics like PSI can signal when the data or model behavior deviates from the training distribution, prompting investigation or retraining. This approach is proactive and does not depend on immediate labels.

Answer

Implement a shadow model that uses the same features and compare its predictions to the production model's predictions in real time.

Answer

Retrain the fraud model daily on the most recent transactions to ensure it always captures the latest fraud patterns.

Answer

Set up alerts based on the model's false positive rate calculated from the previous day's transactions.

Question 2

A financial services firm's AI governance committee is establishing an enterprise-wide AI risk register. The CISO insists that every AI system be assigned a single residual risk rating at deployment so that systems can be ranked and remediation budgets allocated. During a pilot, a credit-scoring model was rated 'medium' residual risk, but six months later it was found to be making materially biased decisions for a protected class after a subtle drift in borrower behavior. Which governance approach BEST addresses this failure while preserving the committee's ability to rank systems?

Accepted Answer

Replace the single residual risk rating with a continuous AI risk monitoring process that re-evaluates inherent and residual risk on defined triggers and feeds updated ratings back into the enterprise AI risk register.. The scenario shows a static residual rating failing to reflect post-deployment model drift and emergent bias. The strongest governance response keeps the committee's ranking capability but makes ratings dynamic: defined triggers (drift thresholds, data shifts, incident reports, periodic review) force re-evaluation of inherent and residual risk, and refreshed ratings flow back into the enterprise AI risk register. This preserves prioritization and budgeting while ensuring ratings reflect current, not deployment-time, risk.

Answer

Require all AI systems to be rated 'high' residual risk until they have completed a full independent audit, then downgrade them once the audit report is signed off by the CISO.

Answer

Assign each AI system an owner accountable for the residual risk rating and require that owner to attest annually that the rating remains accurate and that no material model changes have occurred.

Answer

Move the AI risk register into the enterprise risk management (ERM) system and adopt the ERM likelihood-by-impact scoring scale so that AI risks are comparable to operational and financial risks.

Question 3

A global bank's AI governance committee is operationalizing 'AI Risk Appetite' for a portfolio of 40 generative AI use cases. The CISO wants the appetite expressed so that it can be measured continuously against live production telemetry rather than only reviewed annually. Which approach BEST enables continuous measurement of AI risk appetite?

Accepted Answer

Express appetite as quantified thresholds and tolerances on a defined set of AI risk metrics (for example, maximum hallucination rate, bias disparity limits, and incident severity bands), mapped to each use case and monitored through automated pipelines feeding a governance dashboard.. Risk appetite becomes measurable only when it is expressed as quantified thresholds on defined AI risk metrics that automated pipelines can evaluate continuously. Qualitative statements, subjective ratings, and inherited IT appetite all lack the specificity and data feed needed for real-time breach detection. Tying per-use-case thresholds to a governance dashboard preserves proportionality by criticality while giving the committee actionable escalation triggers.

Answer

Adopt the enterprise IT risk appetite statement unchanged and apply it to all AI use cases, relying on the existing IT risk register and periodic internal audit cycles to confirm alignment.

Answer

Define appetite as qualitative statements (for example, 'the bank has low tolerance for reputational harm from AI') and require each use case owner to self-attest compliance in an annual governance questionnaire.

Answer

Set risk appetite at the portfolio level only, using a single aggregate risk score per quarter derived from use case owners' subjective ratings, and escalate to the board whenever the aggregate score exceeds a fixed percentage.

Question 4

You are managing a model deployed in AWS SageMaker and observe drift in the ground truth data. Which SageMaker feature should be configured to automatically monitor and alert on this statistical deviation?

Accepted Answer

SageMaker Model Monitor. SageMaker Model Monitor is designed to continuously monitor deployed models for data quality, model quality, bias drift, and feature attribution drift. It can detect statistical deviations in ground truth data by comparing live data to a baseline and trigger CloudWatch alarms. This directly addresses the requirement to monitor and alert on drift.

Answer

SageMaker Clarify for Bias Detection

Answer

SageMaker Feature Store

Answer

SageMaker Experiments

Question 5

A financial services firm's AI governance committee is reviewing a new generative AI tool that creates personalized investment advice. The CISO asks the AI security manager to define accountability for the tool's outputs. According to ISACA's AI governance principles, who should ultimately be accountable for the ethical and secure use of the AI system?

Accepted Answer

The board of directors and executive leadership, who own the organization's risk appetite.. ISACA's AI governance model treats AI as an enterprise risk domain, so ultimate accountability must reside with the board and executive leadership. They define risk appetite, approve AI strategies, and are answerable to regulators and stakeholders. Operational duties may be delegated, but accountability cannot. This ensures AI decisions align with organizational values and legal obligations.

Answer

The internal audit function, because it independently reviews AI controls.

Answer

The data science team that trained and fine-tuned the model.

Answer

The AI vendor's product manager, because they designed the model architecture.

Question 6

An insurance company uses a gradient-boosted model to score auto claims. After a vendor update to the feature-engineering pipeline, the model's predictions shift sharply, but no alerts fire because the input schema and types are unchanged. Which control would most directly detect this silent data drift before it affects claim decisions?

Accepted Answer

Deploying Amazon SageMaker Model Monitor with a data quality baseline that tracks feature distribution statistics and emits violations when they deviate beyond configured thresholds.. Silent data drift occurs when live feature distributions move away from the training baseline while schemas and types still validate, so schema checks and latency alarms stay quiet. Statistical baseline monitoring of feature distributions, with thresholds that raise violations, is the control purpose-built to catch that shift early. The other controls address audit logging, operational health, or fairness rather than distributional change.

Answer

Running periodic SageMaker Clarify bias reports against the training dataset to confirm that the protected-class disparity metrics remain within tolerance.

Answer

Configuring an Amazon CloudWatch alarm on the endpoint's ModelLatency and Invocations metrics to trigger when throughput or response time leaves the expected band.

Answer

Enabling AWS CloudTrail data events on the model endpoint to capture every InvokeEndpoint call and its request payload for later forensic review.

Question 7

A retail company is deploying an AI-based customer sentiment analysis tool across its social media channels. The AI governance lead needs to ensure that the tool's data collection and processing comply with the organization's AI policy. Which document should the lead reference first to understand the organization's approved AI risk tolerance and control requirements?

Accepted Answer

The organization's AI governance policy and risk appetite statement.. The AI governance policy and risk appetite statement are the foundational internal documents that express the organization's approved risk tolerance and control expectations. Reviewing them first ensures the sentiment analysis tool's data handling aligns with enterprise requirements before any technical or contractual evaluation. This reflects ISACA's principle that governance artifacts drive AI risk decisions.

Answer

The vendor's end-user license agreement.

Answer

The AI system's technical architecture diagram.

Answer

The latest industry benchmark report on AI sentiment analysis.

Question 8

A retailer wants to let data scientists query a customer churn model's predictions for analysis without exposing the underlying training records. The scientists need aggregate statistics and individual prediction scores but must not be able to reconstruct any single customer's training data. Which technique best supports this requirement?

Accepted Answer

Adding differential privacy noise calibrated to the model's query sensitivity when returning aggregate statistics.. Differential privacy is the technique that bounds how much any single individual's data can influence a query result, which is exactly the guarantee needed when analysts may run many queries against a model trained on sensitive records. Encryption, authenticated access, and identifier hashing all protect the data at rest or at the gate but leave the information content of legitimate outputs unconstrained, so they do not prevent reconstruction.

Answer

Hashing customer identifiers with SHA-256 before storing them in the training feature table.

Answer

Placing the model behind an API Gateway endpoint that authenticates callers with IAM and logs every invocation to CloudWatch.

Answer

Encrypting the training dataset at rest with an AWS KMS customer managed key and restricting key access to the model owner.

Question 9

A global logistics company uses an AI system to optimize delivery routes. The AI governance committee is concerned that the system's decisions may inadvertently favor certain regions due to historical data biases. Which governance mechanism is MOST effective for continuously monitoring and mitigating this risk throughout the AI lifecycle?

Accepted Answer

Implementing an AI risk register with periodic reviews and automated fairness metrics.. An AI risk register with periodic reviews and automated fairness metrics creates a continuous feedback loop that detects regional bias as it emerges. It assigns ownership, tracks mitigation, and escalates when thresholds are breached. This lifecycle approach is more effective than one-time assessments or formal attestations, which do not provide ongoing detection or correction of bias in route optimization.

Answer

Outsourcing all route decisions to a third-party auditor.

Answer

Conducting a one-time bias assessment before deployment.

Answer

Requiring the data science team to sign an ethics attestation annually.

Question 10

A bank's fraud team trains a graph neural network on transaction relationships. An attacker who cannot access the model or its weights submits many carefully crafted synthetic accounts and transfers designed to shift the learned decision boundary over several retraining cycles. Which term best describes this attack?

Accepted Answer

Data poisoning. Attacks that place crafted data into the training pipeline to influence what the model learns are poisoning attacks, and the multi-cycle, boundary-shifting nature described here is their signature. Evasion acts only at inference against a fixed model, model inversion extracts information rather than injecting it, and prompt injection applies to instruction-following generative systems, so none matches the described manipulation of training data.

Answer

Prompt injection

Answer

Model inversion

Answer

Model evasion

Question 11

A media company runs a retrieval-augmented generation (RAG) assistant over its internal knowledge base. During a red-team exercise, testers plant a document containing hidden instructions that cause the assistant to reveal content from unrelated confidential documents. Which TWO controls most directly reduce this risk? (Choose two.)

Accepted Answer

Enforcing per-user document-level access control in the retrieval layer so the assistant can only retrieve chunks the requesting user is authorized to read.. Indirect prompt injection through retrieved documents is best contained by removing the malicious instructions before they reach the model and by ensuring retrieval only returns content the requesting user is entitled to see. Sanitization attacks the vector, while authorization limits the consequence. Sampling parameters and retrieval breadth do not block instruction following, and logging observes rather than prevents the disclosure.

Answer

Raising the retrieval top-k value so the model has more context and can recognize which retrieved documents are trustworthy.

Answer

Enabling verbose prompt logging that records the full assembled prompt and model response for every user interaction.

Answer

Increasing the model's temperature setting so responses are more varied and less likely to follow a single injected instruction pattern.

Question 12

A global bank deploys a generative AI assistant that drafts personalized wealth-management emails using the bank's proprietary product catalogue and live client portfolio data. The AI risk manager must classify the assistant's risk tier before go-live. The assistant can only read data, never execute trades, and all drafts require advisor approval before sending. Which classification approach BEST aligns with an AI risk management framework?

Accepted Answer

Classify based on the potential impact of the assistant's output and the sensitivity of the data it processes, not solely on its lack of write access.. Risk classification should be driven by the potential impact of the AI output and the sensitivity of the data involved. The assistant processes live client portfolio data and generates regulated financial content, so confidentiality and accuracy risks persist even with advisor review. Technical capabilities like read-only access are relevant inputs but insufficient on their own, and blanket high-risk labelling ignores proportionality.

Answer

Classify as low risk because the human advisor approval step fully eliminates any residual risk from the AI output.

Answer

Classify as minimal risk because the assistant is read-only and therefore cannot directly modify any production systems or client accounts.

Answer

Classify as high risk automatically because any use of generative AI in a regulated financial institution must be treated as high risk by default.

Question 13

A technology company's AI governance team is reviewing its AI incident response plan. A recent incident involved an AI model that generated offensive language in customer interactions. The team wants to ensure future incidents are handled consistently. Which governance artifact should define the steps for detecting, reporting, and remediating AI-related incidents?

Accepted Answer

The AI incident response plan.. An AI incident response plan is the governance artifact that specifies how to detect, report, escalate, and remediate AI-related incidents. It provides a consistent, repeatable process with defined roles and timelines. Model cards, DPIAs, and ethics statements serve different purposes and cannot substitute for an operational response plan when handling offensive language incidents.

Answer

The data privacy impact assessment.

Answer

The AI model card for the customer interaction system.

Answer

The AI ethics statement.

Question 14

A logistics firm has trained a demand-forecasting model on three years of shipment data. A security manager asks how the team can reliably reproduce the exact model that generated last quarter's forecasts after the data scientists have left the company. Which practice most directly enables that reproduction?

Accepted Answer

Maintaining model versioning that ties each model artifact to its training dataset snapshot, code commit, hyperparameters, and environment.. Reproducing a model requires more than the trained artifact: you need the lineage that connects the artifact to the data snapshot, code commit, hyperparameters, and environment used to produce it. A versioning practice that records all of those elements enables retraining or reloading the identical model. Artifact-only storage, access logging, and committing the binary to Git each capture only part of the picture.

Answer

Exporting the model as a TensorFlow SavedModel and committing it to the same Git repository as the application code.

Answer

Storing only the final serialized model artifact in Amazon S3 with versioning enabled.

Answer

Enabling AWS CloudTrail logging on the S3 bucket that holds the training data.

Question 15

A retail company is onboarding a third-party AI vendor that provides a recommendation engine for product pricing. The AI risk manager must assess the vendor's risk posture before contract signature. Which action is MOST appropriate as an initial step in third-party AI risk management?

Accepted Answer

Conduct a structured due-diligence assessment covering the vendor's AI governance, data handling, model lifecycle, and incident response practices.. Before signing with a third-party AI vendor, the risk manager should perform structured due diligence on governance, data handling, model lifecycle, and incident response. This establishes a defensible risk picture and informs contractual and monitoring requirements. Replication, premature pilots, and reliance on a single generic attestation each fail to deliver that foundational understanding.

Answer

Deploy the recommendation engine in a limited production pilot and observe outcomes before conducting any vendor assessment.

Answer

Request the vendor's model architecture diagrams and training data schemas for independent replication of the model.

Answer

Rely on the vendor's published SOC 2 report as sufficient evidence that AI-specific risks have been adequately managed.