AAISM AI Risk Management — 10 Questions

Question 1

When utilizing a third-party AI vendor, which contractual requirement is most critical for addressing 'shadow AI' risks within an enterprise?

Accepted Answer

A clause requiring the vendor to disclose all sub-processors.. Shadow AI refers to the unsanctioned use of AI tools within an enterprise. To address this, a clause requiring the vendor to disclose all sub-processors is critical because it ensures visibility into the entire AI supply chain, including any third parties that might handle data. This helps identify and mitigate risks from unauthorized data processing.

Answer

A mandate to use the vendor's cloud region exclusively.

Answer

A request for a free trial period.

Answer

A requirement for 99.99% uptime SLA.

Question 2

An organization is performing threat modeling for a RAG (Retrieval-Augmented Generation) pipeline. Which specific vulnerability is unique to the retrieval component?

Accepted Answer

Database poisoning within the retrieved document index.. The retrieval component of a RAG pipeline depends on an external document index (vector store or knowledge base) that is queried at inference time. Because that index is populated from ingested documents, an attacker who can inject or tamper with those documents can poison the retrieval corpus, causing the LLM to ground its answers in malicious or false content. This 'database poisoning' (indirect prompt injection via the knowledge base) is a threat vector that exists only because of the retrieval step, not in a standalone LLM.

Answer

Overfitting of the LLM on the training set.

Answer

Gradient-based evasion attacks on the LLM.

Answer

Prompt injection targeting the LLM model weights.

Question 3

A model is vulnerable to 'Evasion Attacks' using FGSM (Fast Gradient Sign Method). Which architectural change most effectively increases robustness?

Accepted Answer

Applying Defensive Distillation.. Defensive distillation trains a student model on the softened probability outputs of a teacher model, smoothing the decision surface and reducing the gradient information an attacker can exploit in FGSM. This makes it harder to compute effective adversarial perturbations, increasing robustness against evasion attacks.

Answer

Increasing the learning rate during training.

Answer

Switching to a larger neural network.

Answer

Implementing input denoising.

Question 4

An attacker is performing a 'Model Extraction' attack. What is the most likely goal of the attacker?

Accepted Answer

To steal the intellectual property of the model architecture.. A Model Extraction attack aims to steal the intellectual property of a machine learning model by querying it and using the responses to train a replica model. The attacker's primary goal is to obtain a functionally equivalent model without access to the original training data or architecture, thereby stealing the model's proprietary knowledge.

Answer

To gain access to the raw training database.

Answer

To cause the model to crash.

Answer

To inject malicious weights into the model.

Question 5

An organization is building its AI risk register and wants to ensure that each identified risk is assigned an owner, a likelihood and impact rating, and a documented treatment decision. Which risk management principle does this practice MOST directly reflect?

Accepted Answer

Risk treatment should be proportionate to the organization's risk appetite and tolerance.. A risk register with owners, likelihood and impact ratings, and documented treatment decisions is the operational expression of risk appetite and tolerance. It ensures that risks are evaluated consistently, that accountability is explicit, and that treatment choices such as mitigate, transfer, avoid, or accept are made deliberately at the right level of authority. This is a foundational expectation of any AI risk management framework.

Answer

AI systems should be retired once they reach end of life in the technology portfolio.

Answer

Model performance metrics should be reported to the board on a quarterly basis.

Answer

All AI risks must be eliminated before any system can be deployed to production.

Question 6

A healthcare insurer deploys an AI model that predicts patient readmission risk. During post-deployment review, the risk team discovers the model performs well on the overall population but systematically underestimates risk for patients over 65. The team must address this finding within the AI risk management program. Which TWO actions BEST address this issue? (Choose two.)

Accepted Answer

Document the disparity in the model risk register, apply a manual override for patients over 65, and schedule retraining in the next development cycle.. The two most effective actions are retraining with representative data and cohort-level validation, combined with immediate mitigation through manual override and formal risk tracking. These address both the root cause and the immediate patient safety concern. ISACA's AI risk management framework requires that bias and performance disparities be treated as material risks with documented treatment plans, not merely noted and deferred.

Answer

Decommission the model immediately and revert to the previous manual readmission assessment process until a new model is built from scratch.

Answer

Remove the age variable from the model's feature set to eliminate the source of the disparity.

Answer

Increase the model's overall accuracy threshold from 85% to 95% to ensure better predictions for all patients including those over 65.

Question 7

A global retailer is preparing to launch an AI system that dynamically prices products for online shoppers. Legal counsel has flagged that the system may indirectly use postal code as a proxy for protected characteristics. The AI governance team must select risk controls that address proxy discrimination in the model. (Choose two.)

Accepted Answer

Conduct a disparate impact analysis on model outputs across protected groups and document the results in the model risk register.. Proxy discrimination is controlled through two complementary actions: eliminating the proxy feature and its correlates from the model, and validating that outcomes across protected groups fall within acceptable parity thresholds. Measurement without mitigation leaves the harm in place; mitigation without measurement cannot be evidenced. Encryption, disclosure, and regularization address security, transparency, and generalization respectively, none of which reduce discriminatory pricing outcomes.

Answer

Encrypt the postal code field at rest and in transit so the model cannot use it for pricing decisions.

Answer

Increase the model's regularization strength to reduce overfitting to local pricing patterns.

Answer

Add a disclaimer to the checkout page stating that prices are generated by an automated system and may vary.

Question 8

An organization is using an LLM-based agent. What is the primary risk associated with 'indirect prompt injection' in this environment?

Accepted Answer

External data retrieved by the agent contains instructions that override system prompts.. Indirect prompt injection occurs when an LLM-based agent retrieves external content (web pages, documents, emails, tool outputs) that contains hidden instructions, and those instructions are interpreted by the model as if they came from the system or user. The attacker does not need direct access to the prompt — they poison the data the agent will later ingest. This can cause the agent to exfiltrate data, call tools with malicious parameters, or ignore its original system prompt.

Answer

The model produces hallucinatory facts.

Answer

The API key for the LLM is exposed in the code.

Answer

The training data includes PII of users.

Question 9

Which TWO of the following are primary risks associated with 'membership inference attacks' against an AI model?

Accepted Answer

Exposure of sensitive information about training data subjects.. Option A is correct because a membership inference attack determines whether a specific individual's record was part of the model's training set, which directly leaks sensitive information about those data subjects (e.g., revealing that a person was in a medical or financial dataset). Option B is correct because such exposure of personal data without consent or legal basis can breach privacy regulations such as GDPR or HIPAA, triggering legal and compliance consequences. Option C is not a membership inference risk, since modifying model weights is an integrity/poisoning attack, not an inference/privacy attack. Option D is incorrect because membership inference exploits the model's outputs and does not grant access to the training algorithm itself. Option E is also incorrect because resource exhaustion leading to system shutdown is a denial-of-service concern, unrelated to inferring training-set membership.

Answer

Unauthorized modification of model weights.

Answer

Unauthorized access to the model training algorithm.

Answer

Complete system shutdown via resource exhaustion.

Question 10

When establishing a risk management framework for GenAI, which THREE factors should be prioritized to satisfy the NIST AI Risk Management Framework requirements?

Accepted Answer

Continuous monitoring of model performance metrics.. Option A is correct because the NIST AI RMF (AI RMF 1.0) emphasizes ongoing measurement and monitoring of AI system performance, including accuracy, drift, and other trustworthiness characteristics, as part of the MEASURE and MANAGE functions. Option B is correct because the GOVERN function explicitly requires establishing a robust AI governance structure — policies, roles, responsibilities, and accountability — to ensure risk management is integrated across the organization. Option C is correct because the AI RMF identifies security and resilience as core trustworthiness characteristics, requiring systems to be protected against adversarial attacks and able to withstand or recover from failures. Option D is not required; the framework is technology-agnostic and does not mandate open-source models. Option E is also not required; the AI RMF does not prohibit external APIs and instead calls for managing risks regardless of deployment architecture.

Answer

Requiring all models to be open-source.

Answer

Implementing a strict 'no external API' policy for all models.