AAISM Practice Test 3 — 30 Questions

Question 1

A hospital is deploying an AI triage system that recommends patient priority levels. The risk committee wants to ensure ongoing risk visibility after go-live. Which TWO activities provide continuous risk visibility for this deployed system? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Monitoring model input distribution drift against the training baseline.. Continuous risk visibility after deployment requires monitoring activities that generate ongoing signals. Input distribution drift monitoring detects when live data diverges from training conditions, and tracking clinician override rates captures real-world disagreement that may indicate model errors or edge cases. Static artifacts such as validation reports, one-time audits, and architecture documentation do not provide continuous visibility.

Answer

Documenting the model architecture and hyperparameters in the model registry.

Answer

Conducting a one-time fairness audit before the system goes live.

Answer

Reviewing the model's original validation accuracy report from the pre-deployment assessment.

Question 2

A telecommunications company operates AI systems in twelve countries. Its AI governance committee must design a control testing program that provides assurance to the board that AI controls are operating effectively. The committee wants testing that is independent of the teams building and running the models. Which approach best meets this objective?

Accepted Answer

Commission the internal audit function to test AI controls against the governance framework, report findings independently, and track remediation to closure.. Independent assurance requires a testing function separate from the teams building and operating AI systems. Internal audit provides that independence, tests controls against the governance framework, reports findings through its own channel, and tracks remediation. Self-assessment, committee document review, and developer-run pipeline checks all originate from parties with a stake in the outcome and therefore cannot deliver objective assurance to the board.

Answer

Require each AI product team to complete a self-assessment questionnaire quarterly and aggregate the results into a board dashboard.

Answer

Ask the AI governance committee to review control documentation submitted by product teams and certify effectiveness at its monthly meeting.

Answer

Engage the model development teams to run automated control checks in their pipelines and publish the pass rates to the board each quarter.

Question 3

Which document outlines the 'Roles and Responsibilities' for AI security?

Accepted Answer

The AI Governance Charter.. The AI Governance Charter is the foundational document that defines the governance structure for AI, including who owns what — the roles and responsibilities of the AI governance board, model owners, data stewards, security teams, and business units. It establishes accountability, decision rights, and escalation paths. This makes it the authoritative source for 'Roles and Responsibilities' in AI security.

Answer

The printer configuration manual.

Answer

A software license file.

Answer

The company holiday calendar.

Question 4

An AI security manager is assessing the risk of model inversion attacks on a machine learning model that predicts patient outcomes. The model is accessible via an API that returns confidence scores. Which TWO controls are MOST effective at reducing the risk of model inversion? (Choose two.)

Accepted Answer

Limit the API to return only the top-1 predicted class without confidence scores.. Model inversion attacks exploit the model's tendency to memorize training data, often using confidence scores to reconstruct sensitive information. Limiting API output to top-1 class removes the granular data attackers need, while differential privacy mathematically bounds the influence of any single training record, directly preventing memorization. These two controls together provide strong defense, whereas rate limiting, encryption, and smaller models do not adequately address the core risk.

Answer

Encrypt the model's parameters at rest and in transit.

Answer

Use a model architecture with fewer parameters to reduce its memorization capacity.

Answer

Implement rate limiting on the API to restrict the number of queries per user per hour.

Question 5

A retail company's AI-powered recommendation engine begins suggesting products that are culturally insensitive in certain regions. The model has not been changed, but sales data from a newly acquired subsidiary was recently added to its training pipeline. Which risk management principle does this scenario BEST illustrate?

Accepted Answer

Model drift caused by changes in the data supply chain can introduce new ethical and reputational risks.. The scenario shows that integrating new data from an acquisition altered the recommendation engine's behavior, producing culturally insensitive outputs without any model code change. This is a data supply chain induced drift that creates ethical and reputational risk, underscoring the need to govern data provenance and monitor model behavior after data pipeline changes.

Answer

Acquiring a subsidiary always requires retraining all enterprise AI models from scratch.

Answer

Recommendation engines are inherently unbiased and only reflect objective customer preferences.

Answer

Ethical risks in AI are only relevant during the initial design phase and not after deployment.

Question 6

An organization is developing an AI risk register as part of its AI governance program. The AI security manager needs to ensure that risks are tracked and managed throughout the AI system lifecycle. Which element is MOST critical to include in the risk register for each identified AI risk?

Accepted Answer

The risk owner, likelihood, impact, and current mitigation status.. An AI risk register must contain actionable information for managing each risk. The risk owner ensures accountability, while likelihood and impact allow prioritization. Mitigation status tracks progress in reducing the risk. These elements are essential for any risk management framework, including those aligned with NIST AI RMF or ISO/IEC 23894. Technical details like algorithm or parameter count are secondary.

Answer

The name of the data scientist who developed the model.

Answer

The number of parameters in the model.

Answer

The specific machine learning algorithm used, such as random forest or neural network.

Question 7

A hospital network is deploying a clinical decision support model that recommends triage priorities. The risk committee wants to establish human oversight that satisfies AI risk management expectations while preserving clinical workflow efficiency. Which TWO design choices BEST achieve meaningful human oversight? (Choose two.)

Accepted Answer

Require the clinician to record an override reason whenever the recommendation is rejected, and route that record into periodic model review.. Effective human oversight requires that the reviewer has enough information to evaluate the recommendation and that their disagreement produces a usable signal. Presenting rationale and uncertainty supports informed judgment, while capturing override reasons converts clinical disagreement into evidence that feeds model review. Together these choices create an oversight control that is both substantive at the point of care and useful for ongoing risk management, rather than a procedural formality.

Answer

Restrict clinician access to the model's inputs so that staff cannot second-guess the recommendation with incomplete information.

Answer

Configure the model to auto-populate the triage decision and require the clinician to click a single confirmation button to accept it.

Answer

Limit oversight to a monthly aggregate dashboard review by the quality committee after decisions have already been executed.

Question 8

An AI governance lead is mapping the organization's AI risk register to the NIST AI Risk Management Framework. A business unit asks why the 'Map' function must be completed before the 'Measure' function is fully executed for a new fraud-detection model. Which response BEST justifies the sequence?

Accepted Answer

Mapping identifies the model's context, purpose, and affected stakeholders, which establishes the baseline against which measurement metrics and tolerances are defined.. The Map function establishes context, purpose, dependencies, and affected stakeholders, and that context determines which risks are relevant and what metrics and tolerances are meaningful. Measurement without mapping yields data that cannot be tied to business impact or risk appetite. The framework's structure reflects this dependency, so completing mapping first ensures that subsequent measurement, monitoring, and treatment activities target the risks that actually apply to the model's deployment context.

Answer

Mapping must precede measurement because the Measure function can only be applied to models that have already achieved full production maturity.

Answer

Measurement requires production telemetry, and the Map function is the mechanism that deploys the monitoring agents into the inference pipeline.

Answer

Mapping is a regulatory filing requirement that must be submitted to the supervisory authority before any quantitative testing may begin.

Question 9

A retail company's AI team wants to deploy a customer-facing chatbot powered by a large language model. The chief information security officer asks the AI risk manager to identify the MOST significant risk introduced by this deployment that does not exist with traditional rule-based chatbots.

Accepted Answer

The potential for the model to generate unpredictable, contextually inappropriate, or harmful responses that bypass predefined business rules.. The defining new risk of generative AI in customer-facing applications is non-deterministic output generation. Rule-based chatbots follow predefined paths, so their responses can be fully anticipated and controlled. Large language models generate responses probabilistically, creating the possibility of harmful, off-brand, or policy-violating outputs. This requires a new layer of controls including output moderation, prompt injection defenses, and escalation procedures.

Answer

Increased infrastructure cost due to the computational requirements of large language models.

Answer

The difficulty of integrating the chatbot with existing customer relationship management systems.

Answer

The need to comply with data residency requirements when the model is hosted in a cloud environment.

Question 10

A retailer's AI system uses a third-party foundation model accessed through a vendor API to summarize customer support transcripts. During risk assessment, the team realizes the vendor may use submitted content to improve its own models, and the retailer cannot inspect the vendor's training data or security controls. Which approach BEST manages this third-party AI risk?

Accepted Answer

Negotiate contractual terms that prohibit training on submitted data, require breach notification and deletion rights, and then validate those commitments through vendor assessment.. When an organization cannot inspect a vendor's data handling or security controls, the practical treatment is to bind the vendor through contractual obligations and verify those obligations through assessment. Prohibiting training on submitted content, requiring breach notification and deletion rights, and validating the commitments provides enforceable protection and creates evidence for the risk register. Relying on certifications alone, assuming the data is harmless, or hastily self-hosting without capability does not address the identified exposure.

Answer

Accept the risk because the transcripts contain no regulated personal data and the model output is only used internally.

Answer

Rely on the vendor's published security certifications as sufficient evidence that the data handling risk is acceptable.

Answer

Move the workload to a self-hosted open-weight model immediately, regardless of whether the organization has the operational capacity to run it.

Question 11

An e-commerce company discovers that its recommendation model, trained on historical customer data, systematically under-recommends products to users from certain demographic groups, reducing their access to promotional offers. The legal team flags potential fair-lending-style exposure even though no credit is involved. Which action BEST addresses this risk within an AI risk management framework?

Accepted Answer

Conduct a fairness assessment across demographic groups, document the disparity and its potential harms, then apply mitigation such as reweighting or post-processing and monitor outcomes continuously.. Addressing algorithmic disparity requires measuring outcomes across groups, documenting the disparity and its harms, applying targeted mitigation, and monitoring continuously. This mirrors the standard risk treatment cycle and produces auditable evidence of due diligence. Attribute removal fails because proxies persist, shutdown is disproportionate and unverifiable, and disclaimers change nothing about the outcome, so none of those options genuinely treat the risk.

Answer

Add a disclaimer to the website stating that recommendations are automated and may vary, transferring responsibility to the user.

Answer

Remove all demographic attributes from the training data and retrain, assuming that will eliminate the disparate impact.

Answer

Disable the recommendation model for all users and revert to a static, non-personalized product listing until the issue is resolved.

Question 12

A financial services firm is building an AI risk taxonomy for its enterprise risk management framework. The CISO asks which characteristics distinguish AI-specific risks from traditional IT risks so that appropriate controls can be designed. Which TWO characteristics should be included? (Choose two.)

Accepted Answer

AI risk exposure changes continuously as models learn from or are exposed to new data, requiring ongoing rather than point-in-time assessment.. Two characteristics genuinely distinguish AI risk from traditional IT risk: emergent behavior that defies component-level prediction, and continuous change that invalidates point-in-time assessments. Together they justify ongoing monitoring, staged deployment, red-teaming, and version governance. The other characteristics either describe similarities, restate legal misconceptions, or falsely claim determinism, none of which belong in a defensible AI risk taxonomy.

Answer

AI systems are exempt from data protection regulations because their outputs are statistical rather than factual.

Answer

AI models are subject to the same patch management and vulnerability disclosure cycles as conventional enterprise software.

Answer

AI models always produce deterministic outputs, allowing identical risk treatment to traditional deterministic business logic.

Question 13

Which TWO strategies are recommended for 'Human-in-the-Loop' governance?

Accepted Answer

Standardizing workflows for human intervention.. Option C is correct because standardizing workflows for human intervention ensures that Human-in-the-Loop governance is applied consistently, repeatably, and auditably across processes rather than relying on ad hoc judgment. Option E is correct because defining clear decision-making thresholds specifies exactly when a human must review, approve, or escalate an AI-generated decision, which is the core mechanism that keeps humans meaningfully in control. Together, these strategies establish both the process structure and the trigger criteria needed for effective human oversight. Option A is incorrect because using only AI for all HR decisions eliminates the human element entirely, which contradicts the Human-in-the-Loop principle. Option B is incorrect because allowing overrides without logging destroys the audit trail and accountability that governance requires. Option D is incorrect because removing humans to save money is the opposite of Human-in-the-Loop governance and removes necessary oversight.

Answer

Using only AI for all HR decisions.

Answer

Allowing humans to override without logging.

Answer

Removing humans to save money.

Question 14

To mitigate adversarial evasion attacks against a vision model, you decide to implement defensive distillation on your TensorFlow model. What is the primary operational trade-off you must evaluate?

Accepted Answer

Reduced model sensitivity to noise and potential drop in clean accuracy. Defensive distillation trains a student model on soft labels produced by a teacher, smoothing the decision surface and reducing sensitivity to small adversarial perturbations. The trade-off is that this smoothing can lower accuracy on clean, unperturbed inputs because the model becomes less confident and more regularized. Practitioners must measure this drop before deploying.

Answer

Requirement for GPU-based training clusters only

Answer

Incompatibility with gradient-based optimizers

Answer

Increased latency in inference requests

Question 15

When assessing the risk of 'Prompt Leaking', what is the most important control to implement?

Accepted Answer

Strict output filtering and instruction separation.. Prompt leaking occurs when an attacker extracts the system prompt or confidential instructions embedded in an LLM application. The most effective control is strict output filtering combined with instruction separation — keeping system instructions isolated from user input and filtering responses that would reveal them. This directly addresses the exfiltration channel rather than the model's size, transport, or network location.

Answer

Increasing the model's parameter count.

Answer

Encrypting the model output.

Answer

Only allowing access from internal IP addresses.

Question 16

A healthcare organization is deploying a machine learning model to predict patient readmission risk. The model was trained on historical data that includes a 'zip code' feature, which strongly correlates with race. To comply with ISACA's AI governance principles and reduce bias, which technique should be applied during model development?

Accepted Answer

Apply adversarial debiasing during training to minimize the model's ability to predict the protected attribute.. Adversarial debiasing is a fairness-aware training technique that actively reduces a model's reliance on protected attributes by pitting the primary task against an adversary predicting those attributes. This addresses bias at its source during development, which is more effective than simply removing features or only measuring disparities. It aligns with ISACA's call for proactive controls to ensure ethical AI outcomes.

Answer

Implement differential privacy by adding noise to the training data.

Answer

Use a holdout test set to evaluate model performance across demographic groups.

Answer

Remove the 'zip code' feature from the training dataset and retrain the model.

Question 17

A retail company's board has approved an AI governance charter. The Chief AI Officer must now establish a mechanism to ensure that AI risks are escalated to the board when they exceed defined thresholds. Which element is most essential for this escalation mechanism to function effectively?

Accepted Answer

A defined AI risk appetite statement with quantified tolerance thresholds. A defined AI risk appetite statement with quantified tolerance thresholds is the essential foundation for board escalation because it establishes objective criteria for when a risk exceeds acceptable levels. Without agreed tolerances, escalation decisions are subjective and inconsistent, undermining the governance charter's intent.

Answer

An employee suggestion box for AI-related concerns

Answer

A monthly newsletter summarizing AI industry trends

Answer

A list of all AI vendors currently under contract

Question 18

A healthcare insurer is standing up an AI governance program and must decide which structural components to include in its governance framework to ensure AI systems are developed and operated consistently across business units. (Choose two.)

Accepted Answer

A defined governance body with assigned decision rights for AI approvals, exceptions, and oversight. A functioning AI governance framework rests on two structural pillars: a documented policy framework that sets principles, risk appetite, and mandatory controls, and a governance body with assigned decision rights for approvals, exceptions, and oversight. Together they ensure consistent treatment of AI across units, while controls and communications support execution.

Answer

A vendor contract template requiring AI suppliers to disclose training data sources

Answer

A monthly newsletter summarizing emerging AI regulations for interested employees

Answer

A data loss prevention tool configured to block outbound transfers of model weights

Question 19

An AI platform team must let data scientists run training jobs that access a sensitive feature store. Auditors require that no long-lived credentials exist in notebooks and that every access be attributable to a specific scientist. Which approach best satisfies both requirements?

Accepted Answer

Bind each scientist's workload to a federated identity that exchanges short-lived tokens for scoped access to the feature store.. The two requirements are eliminating long-lived secrets and preserving per-user attribution. Federating each scientist's identity and exchanging it for short-lived scoped tokens satisfies both, because credentials are ephemeral and every access carries the originating individual. Shared service accounts, a single platform key, and node-level roles all obscure or eliminate individual attribution while leaving standing or overly broad access in place.

Answer

Store a single platform API key in a managed secrets vault and inject it into every training job at runtime.

Answer

Grant the training cluster's node role broad read access to the feature store and rely on network segmentation to restrict callers.

Answer

Issue each scientist a shared service account whose password is rotated every 90 days and stored in the notebook environment file.

Question 20

When reviewing an AI architecture, what does the 'Attack Surface' refer to?

Accepted Answer

The set of points where an attacker can interact with the system. In AI architecture, the 'Attack Surface' refers to the set of points where an attacker can interact with the system, including inputs, outputs, APIs, and interfaces. This encompasses all potential entry points that could be exploited to compromise the model's integrity, confidentiality, or availability. Understanding the attack surface is crucial for threat modeling and implementing appropriate security controls.

Answer

The speed of the model's inference

Answer

The number of users allowed to access the system

Answer

The memory usage of the model during training