AAISM Practice Test 21 — 15 Questions

Question 1

When establishing a risk management framework for GenAI, which THREE factors should be prioritized to satisfy the NIST AI Risk Management Framework requirements?

Accepted Answer

Continuous monitoring of model performance metrics.. Option A is correct because the NIST AI RMF (AI RMF 1.0) emphasizes ongoing measurement and monitoring of AI system performance, including accuracy, drift, and other trustworthiness characteristics, as part of the MEASURE and MANAGE functions. Option B is correct because the GOVERN function explicitly requires establishing a robust AI governance structure — policies, roles, responsibilities, and accountability — to ensure risk management is integrated across the organization. Option C is correct because the AI RMF identifies security and resilience as core trustworthiness characteristics, requiring systems to be protected against adversarial attacks and able to withstand or recover from failures. Option D is not required; the framework is technology-agnostic and does not mandate open-source models. Option E is also not required; the AI RMF does not prohibit external APIs and instead calls for managing risks regardless of deployment architecture.

Answer

Requiring all models to be open-source.

Answer

Implementing a strict 'no external API' policy for all models.

Question 2

An AI risk analyst is assessing a computer vision model used for quality inspection on a manufacturing line. The model occasionally misclassifies defective parts as acceptable, and the defect rate is low. Which risk metric BEST communicates the operational exposure to plant leadership?

Accepted Answer

False negative rate for defective parts, expressed as expected escaped defects per shift.. In a low defect-rate inspection process, the dominant risk is defective parts escaping detection. The false negative rate isolates that failure mode, and converting it into expected escaped defects per shift makes the exposure concrete for plant leadership. This is more actionable than aggregate accuracy or threshold-independent metrics.

Answer

Area under the receiver operating characteristic curve (AUC-ROC).

Answer

Overall model accuracy across all inspected parts.

Answer

Model inference latency measured in milliseconds per part.

Question 3

You are assessing the risk of 'Data Poisoning'. Which stage of the machine learning lifecycle is most vulnerable to this attack?

Accepted Answer

Training data collection and ingestion.. Data poisoning attacks work by corrupting the data a model learns from, so the training data collection and ingestion stage is where an adversary can inject malicious, mislabeled, or biased samples that the model will internalize. Once poisoned data is ingested, the resulting model weights encode the attacker's influence, making this the earliest and most impactful point of compromise. Later stages like inference or monitoring cannot retroactively undo poisoned training data.

Answer

The model design and architecture selection.

Answer

Model monitoring and logging.

Answer

Inference and deployment.

Question 4

Which THREE factors increase 'AI Model Risk'?

Accepted Answer

High model complexity (black box).. Option A is correct because high model complexity, such as deep neural networks or ensemble methods that behave as black boxes, makes it harder to understand decision boundaries, validate behavior, and detect hidden failure modes, which directly raises AI model risk. Option B is correct because when a model drives safety-critical business processes, errors or biased outputs can cause physical harm, regulatory violations, or major financial loss, so the potential impact magnifies the overall risk. Option E is correct because low explainability/interpretability prevents stakeholders, auditors, and regulators from understanding why a prediction was made, undermining trust, accountability, and the ability to challenge or correct harmful outputs. Option C is not correct because a low-latency network is a performance and infrastructure characteristic that does not inherently increase model risk. Option D is not correct because using a well-documented framework generally improves governance, reproducibility, and transparency, thereby reducing rather than increasing model risk.

Answer

Using a low-latency network.

Answer

Using a well-documented framework.

Question 5

Which TWO techniques are effective for detecting and mitigating 'Model Inversion' attacks where an adversary attempts to reconstruct training data from model outputs?

Accepted Answer

Rate limiting and monitoring query frequency. Option A (Rate limiting and monitoring query frequency) is correct because model inversion attacks typically require many repeated queries to the model to iteratively refine reconstructed inputs, so throttling and detecting abnormal query patterns reduces the adversary's ability to gather enough output samples. Option D (Implementing differential privacy during training) is correct because differential privacy adds calibrated noise to the training process, bounding how much any single training record can influence model outputs and thereby limiting the information an attacker can recover about training data. The unmarked options do not belong: disabling API documentation (B) is security-through-obscurity and does not stop inversion queries, increasing output score precision (C) actually leaks more information and worsens the risk, and using larger batch sizes during inference (E) has no meaningful effect on preventing reconstruction of training data.

Answer

Disabling all model API documentation

Answer

Increasing the precision of model output scores

Answer

Using larger batch sizes during inference

Question 6

A multinational bank's AI governance committee is drafting its first enterprise AI policy. The CISO asks how the policy should address third-party foundation models that are accessed via API but not fine-tuned or hosted internally. Which approach BEST aligns with ISACA AI governance principles?

Accepted Answer

Include third-party API models in the AI inventory and apply proportionate controls such as vendor due diligence, output validation, and contractual security requirements.. Governance scope is determined by the organization's use of AI, not by who owns the model. Third-party API models influence decisions, process data, and create regulatory exposure, so they must be inventoried and governed proportionately. Contractual controls, vendor assessment, and output validation are the practical levers available when the organization cannot inspect weights or training data.

Answer

Require the vendor to share full model weights and training data before the API can be approved for any business use.

Answer

Delegate all responsibility for the third-party model to the procurement team, since the relationship is contractual rather than technical.

Answer

Exclude third-party API models from the AI policy because the organization does not own the model weights or training data.

Question 7

Which THREE technical controls are recommended to secure an AI model's API endpoint?

Accepted Answer

Enforcing strict schema validation on all inputs.. Option C is correct because enforcing strict schema validation on all inputs rejects malformed or unexpected payloads before they reach the model, mitigating injection attacks, prompt manipulation, and deserialization issues at the API boundary. Option D is correct because rate limiting (e.g., token-bucket or fixed-window limits per API key/IP) throttles abusive request volumes, which directly hinders model scraping, extraction attacks, and denial-of-service attempts against the endpoint. Option E is correct because OIDC or API key-based authentication verifies caller identity and enforces authorization before any inference request is processed, preventing anonymous or unauthorized access to the model API. Option A does not belong because encrypting model weights at rest protects stored artifacts, not the API endpoint's runtime traffic or access. Option B does not belong because removing all logging eliminates audit trails and detection capability; log injection should instead be prevented by sanitizing and encoding log output, not by disabling logging.

Answer

Encrypting the model weights at rest in the cloud.

Answer

Removing all logging to prevent log injection.

Question 8

What is 'Model Drift'?

Accepted Answer

Performance decay due to changing data distributions.. Model drift (specifically concept drift or data drift) is the degradation of a deployed model's predictive performance over time because the statistical distribution of input data or the input-to-output relationship changes relative to the training data. The model itself is unchanged, but the world it was trained on has shifted, so its predictions become stale or wrong. This is why production ML requires monitoring for drift and periodic retraining.

Answer

The model code being rewritten.

Answer

The model being moved to a different cloud region.

Answer

The model file becoming corrupted.

Question 9

A financial services firm is deploying a generative AI chatbot for customer support. The security team wants to ensure that the model cannot be tricked into revealing its system prompt or internal instructions, even when users craft adversarial inputs. Which control best addresses this specific risk?

Accepted Answer

Employ prompt injection defenses such as instruction hierarchy and output filtering to prevent system prompt disclosure.. Instruction hierarchy and output filtering are specifically designed to prevent prompt injection attacks that aim to extract system prompts. Instruction hierarchy enforces that system-level directives cannot be overridden by user inputs, while output filtering scans and redacts sensitive content. These controls together provide a robust defense against system prompt disclosure, unlike input sanitization which can be bypassed.

Answer

Implement input sanitization and prompt filtering to detect and block malicious prompt patterns.

Answer

Use a separate, isolated model instance for each user session to prevent cross-contamination.

Answer

Regularly retrain the model on adversarial examples to improve its robustness against prompt injection.

Question 10

A hospital's AI governance committee is evaluating a vendor-provided clinical decision support model. The vendor refuses to disclose training data composition or model architecture but provides accuracy metrics and a third-party audit attestation. The committee must decide how to treat the residual risk of unknown model provenance. Which approach BEST aligns with AI risk management principles?

Accepted Answer

Define compensating controls such as contractual audit rights, independent validation on local data, and human-in-the-loop review, then document and accept the residual risk.. When a vendor withholds training data and architecture details, the committee cannot eliminate provenance risk, but it can bound it with compensating controls: contractual audit rights, independent validation on local patient data, and human-in-the-loop clinical review. Documenting and accepting the residual risk with an accountable owner makes the decision defensible. Rejection, blind acceptance, and liability shifting each fail to establish the layered assurance the scenario requires.

Answer

Reject the vendor outright, since undisclosed training data composition makes any risk assessment impossible.

Answer

Accept the vendor's accuracy metrics as sufficient evidence and deploy the model without additional controls.

Answer

Require the vendor to sign a liability waiver transferring all clinical decision responsibility to the hospital.

Question 11

A manufacturing firm uses an AI system to prioritize maintenance tasks. The AI governance lead must ensure that the system's decisions can be explained to regulators and affected employees. Which action BEST supports this requirement?

Accepted Answer

Using a model-agnostic explanation technique, such as SHAP or LIME, to generate feature importance for each maintenance prioritization decision.. To explain individual AI decisions, the firm needs case-level insight into which factors drove each prioritization. Model-agnostic techniques like SHAP or LIME generate feature importance that translates model behaviour into understandable terms for regulators and employees. Logging, aggregate metrics, and human review support governance but do not provide the specific reasoning behind a given decision, making them insufficient for this requirement.

Answer

Requiring human review of every maintenance prioritization decision before it is executed.

Answer

Publishing the model's overall accuracy and F1 score on a validation dataset.

Answer

Maintaining a detailed log of all model inputs, outputs, and the version of the model used for each decision.

Question 12

A multinational bank has deployed an AI governance program aligned with the NIST AI Risk Management Framework. The Chief Risk Officer asks how to ensure that AI risks are consistently identified, assessed, and treated across all business units. Which structural element is most critical for achieving this consistency?

Accepted Answer

A centralized AI risk register integrated into the enterprise risk management framework. A centralized AI risk register integrated into ERM provides the structured, consistent mechanism to identify, assess, and treat AI risks across all business units. It aligns with NIST AI RMF and enables aggregated reporting to the CRO. Other options are either awareness-focused or operational, and do not deliver enterprise-wide risk management consistency.

Answer

An annual AI ethics training program for all employees

Answer

A quarterly AI innovation committee that reviews new use cases

Answer

A dedicated AI security operations center (SOC) that monitors model APIs

Question 13

An organization has a mature AI governance program with a complete AI asset inventory, but recent audits show that third-party foundation model providers are updating their models without notice, causing downstream performance drift in production. The CISO asks the AI security manager to reduce this supply-chain risk. Which action should the AI security manager take FIRST?

Accepted Answer

Establish contractual requirements with the foundation model provider for advance notification of model version changes and a stable, pinned model version for production use.. The core risk is that a third-party provider can change the model without the organization's knowledge, causing unexpected behavior. The most effective first step is to gain control over model versions through contractual terms and version pinning, which directly prevents silent updates from affecting production. Detection, red teaming, and replacement are either reactive or disproportionate as an initial response.

Answer

Deploy an automated anomaly detection system that alerts when model output distributions shift beyond a threshold.

Answer

Increase the frequency of red teaming exercises against the production AI system to identify new vulnerabilities introduced by provider updates.

Answer

Replace the third-party foundation model with an internally developed model that the organization fully controls.

Question 14

A startup is preparing to launch a generative AI customer service assistant. Before go-live, the risk team wants to ensure the system has a documented process for handling harmful or inappropriate outputs discovered after deployment. Which practice BEST satisfies this requirement?

Accepted Answer

Establish an incident response process specifically for AI outputs, including detection channels, triage criteria, containment options, and post-incident review.. The requirement is a documented process for handling harmful outputs after deployment, which is precisely what an AI-specific incident response process provides: detection channels, triage criteria, containment options, and post-incident review. Vendor filters, terms of service, and periodic meetings each address adjacent concerns but none establishes the timely, structured response capability the risk team is asking for.

Answer

Add a terms-of-service clause prohibiting users from attempting to elicit harmful outputs, and monitor for violations.

Answer

Schedule a quarterly review meeting where the team will discuss any known issues with the assistant's outputs.

Answer

Rely on the model vendor's content filter, since the vendor is responsible for the safety of outputs generated by their model.

Question 15

An AI risk analyst is reviewing a credit scoring model and finds that the model's output for an applicant can change materially when a single input feature is altered by a tiny amount within its normal range. The analyst is concerned this indicates the model is relying on unstable decision boundaries. Which technique should the analyst use to systematically quantify this sensitivity across the applicant population?

Accepted Answer

Global sensitivity analysis using variance-based methods such as Sobol indices.. To quantify output sensitivity across a population, the analyst needs a global method that attributes output variance to inputs over the whole distribution. Variance-based sensitivity analysis such as Sobol indices does precisely this, revealing which features, and which interactions, cause unstable decision boundaries. This evidence supports risk decisions such as constraining input precision, retraining, or adding human review for affected applicants.

Answer

Feature importance ranking derived from the model's built-in tree split gains.

Answer

SHAP values computed for a single high-risk applicant to explain that individual's score.

Answer

Adversarial example generation using the fast gradient sign method against the scoring model.