AAISM AI Governance And Program Management — 20 Questions

Question 1

An organization is deploying an AI application that processes PII. The governance policy requires a formal AI impact assessment. Which activity is the most critical first step before model training begins?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Executing an automated data lineage audit using Microsoft Purview to verify data provenance.. Before training a model on PII, the organization must know where the data came from, whether it is legally usable, and whether it contains sensitive elements requiring protection. An automated data lineage audit using Microsoft Purview verifies provenance and classification, which is the foundational input to the AI impact assessment. Without this, training could proceed on unlawfully obtained or misclassified data, invalidating the entire assessment.

Answer

Configuring model weight encryption in the secure vault.

Answer

Setting up a model drift detection dashboard in Azure Machine Learning.

Answer

Performing a sensitivity analysis on model output latency.

Question 2

A company is adopting the ISO/IEC 42001 AI management system standard. What is the primary purpose of the 'Context of the Organization' clause?

Accepted Answer

To define the boundaries and strategic intent of the AI management system.. In ISO/IEC 42001, Clause 4 'Context of the Organization' establishes why the AI management system exists and what it must cover. It requires the organization to determine external and internal issues, identify interested parties and their requirements, and define the scope and boundaries of the AIMS aligned with strategic direction. Option A captures this purpose: defining boundaries and strategic intent so all subsequent clauses (leadership, planning, support, operation, evaluation, improvement) operate within a coherent frame.

Answer

To specify hardware requirements for training.

Answer

To mandate the use of cloud-based AI services.

Answer

To identify all bugs in the production code.

Question 3

When drafting an AI policy, how should the organization address 'Human-in-the-Loop' (HITL) requirements?

Accepted Answer

Mandate HITL for high-impact or sensitive decision-making processes.. HITL should be applied proportionally to risk, so the policy must mandate human review specifically for high-impact or sensitive decisions such as credit, hiring, medical, or legal outcomes. Requiring HITL for every inference is operationally impossible at scale and defeats the purpose of automation. The correct answer reflects a risk-based governance approach where oversight intensity matches the potential harm of the AI decision.

Answer

Require HITL for every single AI inference.

Answer

Delegate HITL requirements to the software development team.

Answer

Exclude HITL to maximize system throughput.

Question 4

A multinational bank is deploying a proprietary LLM. Which approach provides the most robust assurance for model supply chain security?

Accepted Answer

Implementing an AI Software Bill of Materials (SBOM).. An AI Software Bill of Materials (SBOM) provides a structured, machine-readable inventory of all components in the model supply chain — base model, fine-tuning datasets, libraries, dependencies, and their versions and provenance. This transparency is the most robust assurance mechanism because it enables vulnerability tracking, license compliance, and provenance verification across the entire supply chain. It directly addresses the risk of hidden or compromised components in proprietary LLMs.

Answer

Scanning all model weights using antivirus.

Answer

Reviewing the vendor's marketing brochure.

Answer

Limiting model access via VPN.

Question 5

An AI security program manager is assessing AI risks. Which tool provides the most centralized oversight for AI model compliance?

Accepted Answer

An enterprise GRC platform with AI modules.. An enterprise GRC (Governance, Risk, and Compliance) platform with AI-specific modules centralizes policy management, control mapping, risk registers, evidence collection, and regulatory reporting across all AI models in one system of record. This gives the AI security program manager a single pane of glass for compliance status, audit trails, and cross-model risk aggregation — the definition of centralized oversight. Purpose-built AI modules map controls to frameworks like NIST AI RMF, ISO/IEC 42001, and the EU AI Act.

Answer

A local Python script for model testing.

Answer

A public open-source project management board.

Answer

A standard spreadsheet file.

Question 6

When establishing an AI steering committee, which reporting cadence is most effective for ensuring board-level oversight of residual AI risk?

Accepted Answer

Quarterly strategic risk and compliance assessments.. Board-level oversight of residual AI risk requires a cadence that balances strategic depth with timeliness. Quarterly strategic risk and compliance assessments give the board enough time to review aggregated risk posture, emerging regulatory changes, and mitigation effectiveness without being overwhelmed by operational noise. This aligns with typical enterprise risk governance cycles and regulatory expectations for board engagement.

Answer

Weekly technical incident logs.

Answer

Annual compliance attestation only.

Answer

Real-time dashboard access for all directors.

Question 7

An enterprise is defining its 'AI System Inventory'. Which metadata attribute is most critical for assessing legal and regulatory risk?

Accepted Answer

Training data source and provenance.. Training data source and provenance is the metadata attribute most directly tied to legal and regulatory risk because it determines data rights, consent, licensing, copyright exposure, and privacy obligations. Regulators need to know where data came from, whether it was lawfully obtained, and whether it contains personal or protected information. Without provenance, an organization cannot demonstrate compliance with GDPR, CCPA, or IP law.

Answer

Hardware acceleration type.

Answer

Inference latency in milliseconds.

Answer

Model training compute cost.

Question 8

An AI security manager is implementing an AI governance framework using the NIST AI RMF. Which action best demonstrates the 'Govern' function for a new generative AI deployment?

Accepted Answer

Defining roles, responsibilities, and accountability for AI system outcomes.. The NIST AI RMF 'Govern' function establishes the organizational structures, policies, and accountability mechanisms that permeate all other functions (Map, Measure, Manage). Defining roles, responsibilities, and accountability for AI outcomes is the canonical Govern activity because it creates the human and procedural infrastructure for AI risk management. Without clear ownership, no other control — technical or otherwise — can be reliably enforced.

Answer

Configuring API rate limits in the AI gateway.

Answer

Conducting a red-teaming exercise for prompt injection.

Answer

Performing automated unit testing on model outputs.

Question 9

Which metric is most appropriate for reporting the 'AI Security Posture' to the board?

Accepted Answer

Percentage of AI systems with completed risk assessments.. Board-level reporting on AI security posture should reflect governance effectiveness and risk coverage, not operational throughput. The percentage of AI systems with completed risk assessments directly measures how much of the AI estate has been evaluated against security and compliance criteria. It is an actionable, trendable governance metric that boards can use to hold management accountable.

Answer

Number of GPU hours consumed.

Answer

Average model inference accuracy.

Answer

Total number of model versions created.

Question 10

What is the primary role of an 'AI Ethics Board' in an organization's governance structure?

Accepted Answer

Reviewing AI use cases against organizational values and principles.. An AI Ethics Board is a governance body whose primary function is to review AI use cases, projects, and deployments against the organization's stated ethical values, principles, and policies. It provides oversight and guidance on fairness, transparency, accountability, and societal impact — not operational execution. This aligns with governance frameworks like the NIST AI RMF 'Govern' function and ISO/IEC 42001.

Answer

Directing daily stock market trades.

Answer

Conducting server hardware maintenance.

Answer

Writing all the Python code for the AI.

Question 11

In the context of the EU AI Act, what is the 'Provider's' obligation regarding conformity assessments for high-risk AI systems?

Accepted Answer

Ensuring conformity assessment and compliance with technical standards.. Under the EU AI Act, the Provider (the entity that develops or places a high-risk AI system on the market) bears the primary obligation to ensure the system undergoes a conformity assessment and complies with the applicable technical standards before market placement. This includes maintaining technical documentation, a quality management system, and a declaration of conformity, and affixing the CE marking. The obligation cannot be shifted to the deployer.

Answer

Self-assessment is prohibited for all high-risk systems.

Answer

Providing a written promise of security.

Answer

Delegating all compliance to the system deployer.

Question 12

Which document should define the organization's stance on AI transparency and explainability?

Accepted Answer

The Corporate AI Policy.. The Corporate AI Policy is the governing document that defines the organization's principles, commitments, and requirements for AI transparency and explainability. It establishes the official stance that all AI systems must be documented, explainable to relevant stakeholders, and subject to disclosure rules. Other documents listed are either operational artifacts or external marketing materials that do not carry governance authority.

Answer

The employee breakroom notice.

Answer

The server configuration log.

Answer

The marketing brochure.

Question 13

How should an organization classify AI systems for governance?

Accepted Answer

By the potential impact on safety, privacy, and business operations.. AI governance classification must be risk-based, driven by the potential impact an AI system can have on safety, privacy, and business operations. This aligns with frameworks like the NIST AI RMF and EU AI Act, which tier systems by risk level (unacceptable, high, limited, minimal) to determine the controls, oversight, and documentation required. Technical implementation details such as language or team size do not determine governance obligations.

Answer

By the programming language used.

Answer

By the number of developers assigned.

Answer

By the date of deployment.

Question 14

When managing shadow AI, which strategy is most effective at the enterprise level?

Accepted Answer

Implementing AI-aware API discovery and CASB solutions.. Shadow AI — unsanctioned use of AI tools and APIs by employees — is best managed through AI-aware API discovery and Cloud Access Security Broker (CASB) solutions that detect, classify, and govern AI usage across the enterprise. These tools provide visibility into which AI services are being accessed, by whom, and with what data, enabling policy enforcement without blocking legitimate business activity. This balances security with productivity.

Answer

Disabling all network access to the internet.

Answer

Ignoring the usage until a breach occurs.

Answer

Sending disciplinary emails to all employees.

Question 15

An AI security lead is configuring a 'Model Risk Management' (MRM) framework. What is the main objective of a 'Model Validation' report?

Accepted Answer

To provide independent verification of model performance and risk mitigation effectiveness.. A Model Validation report provides independent verification that a model performs as intended and that its risks are adequately mitigated. It is produced by a party separate from the model developers (the 'three lines of defense' model places validation in the second line) and covers conceptual soundness, data quality, performance testing, and ongoing monitoring plans. Its purpose is to give governance bodies and regulators assurance that the model is fit for purpose and that identified risks are controlled.

Answer

To market the model to external customers.

Answer

To reduce the model development time.

Answer

To guarantee 100% accuracy in all scenarios.

Question 16

When assessing a third-party AI provider, which document is most essential for due diligence?

Accepted Answer

A SOC 2 Type II audit report.. A SOC 2 Type II audit report is the most essential document for third-party AI due diligence because it independently validates the provider's security, availability, and confidentiality controls over time. It provides assurance that the provider meets industry standards. The other options lack the depth and independence required for risk assessment.

Answer

A public press release.

Answer

A standard company invoice.

Answer

The employee directory.

Question 17

An AI project is failing to meet its security requirements. Which governance process should be triggered to address this?

Accepted Answer

Risk acceptance or remediation plan initiation.. When an AI project fails to meet security requirements, the appropriate governance response is to initiate a formal risk acceptance or remediation plan. This ensures the risk is documented, evaluated against the organization's risk appetite, and either mitigated through a remediation roadmap or explicitly accepted by an accountable authority. This process maintains auditability and aligns with NIST AI RMF Manage and Govern functions.

Answer

Re-training the model without a review.

Answer

Immediate deletion of all data.

Answer

Ignoring the policy until the end of the year.

Question 18

Which mechanism best ensures 'Auditability' of AI decision-making?

Accepted Answer

Maintaining immutable logs of inputs, model versions, and outputs.. Auditability of AI decision-making requires a traceable record of what inputs were provided, which model version was used, and what outputs were produced. Maintaining immutable logs of these elements ensures that decisions can be reviewed, reproduced, and audited for compliance, bias, or errors. This is the foundational mechanism for AI auditability.

Answer

Deleting logs after 24 hours.

Answer

Using proprietary black-box models only.

Answer

Hardcoding all decisions.

Question 19

Who is ultimately responsible for the outcomes of an AI system deployed by a business unit?

Accepted Answer

The Business Unit Leader.. Ultimate accountability for an AI system's outcomes rests with the business unit leader who owns the system, its use case, and its business impact. Governance frameworks consistently assign ownership to the accountable executive rather than to vendors, auditors, or individual technical staff. The business unit leader has the authority, budget, and organizational standing to enforce controls and accept or mitigate risk.

Answer

The Cloud Service Provider.

Answer

The external auditor.

Answer

The junior data scientist.

Question 20

What is the benefit of 'AI Model Watermarking' for governance?

Accepted Answer

Facilitating identification and provenance of AI-generated content.. AI model watermarking embeds a detectable signal into model outputs or weights so that content can later be attributed to a specific model or owner. Its governance benefit is provenance: it enables identification of AI-generated content, supports authenticity verification, and helps enforce usage policies or detect misuse. Option B correctly captures this identification and provenance function.

Answer

Improving model prediction speed.

Answer

Preventing unauthorized hardware usage.

Answer

Reducing model memory footprint.