AAISM AI Risk Management — 50 Questions

Question 1

When utilizing a third-party AI vendor, which contractual requirement is most critical for addressing 'shadow AI' risks within an enterprise?

Accepted Answer

A clause requiring the vendor to disclose all sub-processors.. Shadow AI refers to the unsanctioned use of AI tools within an enterprise. To address this, a clause requiring the vendor to disclose all sub-processors is critical because it ensures visibility into the entire AI supply chain, including any third parties that might handle data. This helps identify and mitigate risks from unauthorized data processing.

Answer

A mandate to use the vendor's cloud region exclusively.

Answer

A request for a free trial period.

Answer

A requirement for 99.99% uptime SLA.

Question 2

An organization is performing threat modeling for a RAG (Retrieval-Augmented Generation) pipeline. Which specific vulnerability is unique to the retrieval component?

Accepted Answer

Database poisoning within the retrieved document index.. The retrieval component of a RAG pipeline depends on an external document index (vector store or knowledge base) that is queried at inference time. Because that index is populated from ingested documents, an attacker who can inject or tamper with those documents can poison the retrieval corpus, causing the LLM to ground its answers in malicious or false content. This 'database poisoning' (indirect prompt injection via the knowledge base) is a threat vector that exists only because of the retrieval step, not in a standalone LLM.

Answer

Overfitting of the LLM on the training set.

Answer

Gradient-based evasion attacks on the LLM.

Answer

Prompt injection targeting the LLM model weights.

Question 3

A model is vulnerable to 'Evasion Attacks' using FGSM (Fast Gradient Sign Method). Which architectural change most effectively increases robustness?

Accepted Answer

Applying Defensive Distillation.. Defensive distillation trains a student model on the softened probability outputs of a teacher model, smoothing the decision surface and reducing the gradient information an attacker can exploit in FGSM. This makes it harder to compute effective adversarial perturbations, increasing robustness against evasion attacks.

Answer

Increasing the learning rate during training.

Answer

Switching to a larger neural network.

Answer

Implementing input denoising.

Question 4

An attacker is performing a 'Model Extraction' attack. What is the most likely goal of the attacker?

Accepted Answer

To steal the intellectual property of the model architecture.. A Model Extraction attack aims to steal the intellectual property of a machine learning model by querying it and using the responses to train a replica model. The attacker's primary goal is to obtain a functionally equivalent model without access to the original training data or architecture, thereby stealing the model's proprietary knowledge.

Answer

To gain access to the raw training database.

Answer

To cause the model to crash.

Answer

To inject malicious weights into the model.

Question 5

An organization is building its AI risk register and wants to ensure that each identified risk is assigned an owner, a likelihood and impact rating, and a documented treatment decision. Which risk management principle does this practice MOST directly reflect?

Accepted Answer

Risk treatment should be proportionate to the organization's risk appetite and tolerance.. A risk register with owners, likelihood and impact ratings, and documented treatment decisions is the operational expression of risk appetite and tolerance. It ensures that risks are evaluated consistently, that accountability is explicit, and that treatment choices such as mitigate, transfer, avoid, or accept are made deliberately at the right level of authority. This is a foundational expectation of any AI risk management framework.

Answer

AI systems should be retired once they reach end of life in the technology portfolio.

Answer

Model performance metrics should be reported to the board on a quarterly basis.

Answer

All AI risks must be eliminated before any system can be deployed to production.

Question 6

A healthcare insurer deploys an AI model that predicts patient readmission risk. During post-deployment review, the risk team discovers the model performs well on the overall population but systematically underestimates risk for patients over 65. The team must address this finding within the AI risk management program. Which TWO actions BEST address this issue? (Choose two.)

Accepted Answer

Document the disparity in the model risk register, apply a manual override for patients over 65, and schedule retraining in the next development cycle.. The two most effective actions are retraining with representative data and cohort-level validation, combined with immediate mitigation through manual override and formal risk tracking. These address both the root cause and the immediate patient safety concern. ISACA's AI risk management framework requires that bias and performance disparities be treated as material risks with documented treatment plans, not merely noted and deferred.

Answer

Decommission the model immediately and revert to the previous manual readmission assessment process until a new model is built from scratch.

Answer

Remove the age variable from the model's feature set to eliminate the source of the disparity.

Answer

Increase the model's overall accuracy threshold from 85% to 95% to ensure better predictions for all patients including those over 65.

Question 7

A global retailer is preparing to launch an AI system that dynamically prices products for online shoppers. Legal counsel has flagged that the system may indirectly use postal code as a proxy for protected characteristics. The AI governance team must select risk controls that address proxy discrimination in the model. (Choose two.)

Accepted Answer

Conduct a disparate impact analysis on model outputs across protected groups and document the results in the model risk register.. Proxy discrimination is controlled through two complementary actions: eliminating the proxy feature and its correlates from the model, and validating that outcomes across protected groups fall within acceptable parity thresholds. Measurement without mitigation leaves the harm in place; mitigation without measurement cannot be evidenced. Encryption, disclosure, and regularization address security, transparency, and generalization respectively, none of which reduce discriminatory pricing outcomes.

Answer

Encrypt the postal code field at rest and in transit so the model cannot use it for pricing decisions.

Answer

Increase the model's regularization strength to reduce overfitting to local pricing patterns.

Answer

Add a disclaimer to the checkout page stating that prices are generated by an automated system and may vary.

Question 8

An organization is using an LLM-based agent. What is the primary risk associated with 'indirect prompt injection' in this environment?

Accepted Answer

External data retrieved by the agent contains instructions that override system prompts.. Indirect prompt injection occurs when an LLM-based agent retrieves external content (web pages, documents, emails, tool outputs) that contains hidden instructions, and those instructions are interpreted by the model as if they came from the system or user. The attacker does not need direct access to the prompt — they poison the data the agent will later ingest. This can cause the agent to exfiltrate data, call tools with malicious parameters, or ignore its original system prompt.

Answer

The model produces hallucinatory facts.

Answer

The API key for the LLM is exposed in the code.

Answer

The training data includes PII of users.

Question 9

Which TWO of the following are primary risks associated with 'membership inference attacks' against an AI model?

Accepted Answer

Exposure of sensitive information about training data subjects.. Option A is correct because a membership inference attack determines whether a specific individual's record was part of the model's training set, which directly leaks sensitive information about those data subjects (e.g., revealing that a person was in a medical or financial dataset). Option B is correct because such exposure of personal data without consent or legal basis can breach privacy regulations such as GDPR or HIPAA, triggering legal and compliance consequences. Option C is not a membership inference risk, since modifying model weights is an integrity/poisoning attack, not an inference/privacy attack. Option D is incorrect because membership inference exploits the model's outputs and does not grant access to the training algorithm itself. Option E is also incorrect because resource exhaustion leading to system shutdown is a denial-of-service concern, unrelated to inferring training-set membership.

Answer

Unauthorized modification of model weights.

Answer

Unauthorized access to the model training algorithm.

Answer

Complete system shutdown via resource exhaustion.

Question 10

When establishing a risk management framework for GenAI, which THREE factors should be prioritized to satisfy the NIST AI Risk Management Framework requirements?

Accepted Answer

Continuous monitoring of model performance metrics.. Option A is correct because the NIST AI RMF (AI RMF 1.0) emphasizes ongoing measurement and monitoring of AI system performance, including accuracy, drift, and other trustworthiness characteristics, as part of the MEASURE and MANAGE functions. Option B is correct because the GOVERN function explicitly requires establishing a robust AI governance structure — policies, roles, responsibilities, and accountability — to ensure risk management is integrated across the organization. Option C is correct because the AI RMF identifies security and resilience as core trustworthiness characteristics, requiring systems to be protected against adversarial attacks and able to withstand or recover from failures. Option D is not required; the framework is technology-agnostic and does not mandate open-source models. Option E is also not required; the AI RMF does not prohibit external APIs and instead calls for managing risks regardless of deployment architecture.

Answer

Requiring all models to be open-source.

Answer

Implementing a strict 'no external API' policy for all models.

Question 11

A machine learning model is showing signs of 'data drift'. What is the most effective initial step in the risk assessment process?

Accepted Answer

Analyze the statistical distribution of input production data versus training data.. Data drift means the statistical properties of production inputs have shifted away from the training distribution, so the first risk-assessment step is to quantify that shift. Analyzing the statistical distribution of production data versus training data (B) confirms whether drift is real, identifies which features drifted, and informs whether retraining, feature engineering, or monitoring changes are warranted. Acting before this analysis risks unnecessary or harmful interventions.

Answer

Retrain the model immediately with all available data.

Answer

Shut down the application to prevent incorrect predictions.

Answer

Change the model architecture to a more complex design.

Question 12

During an adversarial threat modeling exercise for a facial recognition system, you identify a risk of pixel perturbation attacks. Which countermeasure is the most appropriate technical control to implement?

Accepted Answer

Conduct adversarial training by injecting perturbed samples into the training set.. Adversarial training with perturbed samples directly hardens the model against pixel perturbation (adversarial) attacks by exposing it to the same class of manipulated inputs during training, forcing the model to learn robust decision boundaries. This is the standard defensive technique for evasion attacks against ML models, including facial recognition systems. It addresses the root cause — model sensitivity to small input perturbations — rather than the data pipeline or output.

Answer

Apply data masking to the input images.

Answer

Implement differential privacy during data preprocessing.

Answer

Increase the model epoch count to improve generalization.

Question 13

You are assessing a supply chain risk where an AI model uses a pre-trained base model from a third-party hub. Which action most effectively mitigates the risk of model poisoning during the integration phase?

Accepted Answer

Validate the model hash against the vendor's provided checksum manifest.. Validating the model hash against the vendor's checksum manifest is correct because it cryptographically verifies that the artifact received matches the artifact the vendor published, detecting tampering or substitution during download and integration. Model poisoning often occurs when an attacker swaps or modifies weights in transit or in the hub; a hash check catches any byte-level change. This is an integrity control applied at the point of ingestion, which is exactly where supply-chain poisoning is introduced.

Answer

Implement role-based access control for the training pipeline.

Answer

Run a sensitivity analysis on the model output.

Answer

Enable MFA for the model registry access.

Question 14

A developer is implementing 'Differential Privacy' on a training dataset. What is the primary trade-off they are managing?

Accepted Answer

Privacy budget (epsilon) vs. model utility/accuracy.. Differential privacy works by injecting calibrated noise into computations so that any single individual's data has a bounded influence on the output. The privacy budget, epsilon (ε), controls how much noise is added: smaller epsilon means stronger privacy but lower model utility/accuracy. The developer's primary trade-off is therefore between the privacy budget and model utility (A).

Answer

Model training speed vs. model cost.

Answer

Security of the training pipeline vs. developer productivity.

Answer

Deployment latency vs. model scalability.

Question 15

What is the primary objective of a 'Bias Audit' in an AI risk management program?

Accepted Answer

To identify disparate impacts on protected populations.. A bias audit's primary objective is to identify disparate impacts on protected populations — that is, to measure whether the model produces systematically different outcomes for groups defined by race, gender, age, or other protected attributes. It uses fairness metrics such as demographic parity, equalized odds, and disparate impact ratio to surface such disparities. This is a fairness and non-discrimination control, not a storage, cost, or performance exercise.

Answer

To verify the model meets legal data storage requirements.

Answer

To reduce the cost of model deployment.

Answer

To ensure the model is computationally efficient.

Question 16

Which of the following best describes 'Model Inversion' as a security risk?

Accepted Answer

An attacker probes the model to reconstruct training samples.. Model Inversion is a privacy attack in which an adversary repeatedly queries a deployed model and analyzes the input-output relationship to reverse-engineer sensitive details of the training data, potentially reconstructing representative samples or inferring attributes of individuals in the training set. It exploits the fact that ML models memorize statistical patterns (and sometimes specific records) from their training data, leaking that information through predictions and confidence scores.

Answer

The model is overwritten with malicious logic.

Answer

The model becomes unavailable to users.

Answer

The model predicts the wrong output due to noisy inputs.

Question 17

Which THREE technical controls are recommended to secure an AI model's API endpoint?

Accepted Answer

Enforcing strict schema validation on all inputs.. Option C is correct because enforcing strict schema validation on all inputs rejects malformed or unexpected payloads before they reach the model, mitigating injection attacks, prompt manipulation, and deserialization issues at the API boundary. Option D is correct because rate limiting (e.g., token-bucket or fixed-window limits per API key/IP) throttles abusive request volumes, which directly hinders model scraping, extraction attacks, and denial-of-service attempts against the endpoint. Option E is correct because OIDC or API key-based authentication verifies caller identity and enforces authorization before any inference request is processed, preventing anonymous or unauthorized access to the model API. Option A does not belong because encrypting model weights at rest protects stored artifacts, not the API endpoint's runtime traffic or access. Option B does not belong because removing all logging eliminates audit trails and detection capability; log injection should instead be prevented by sanitizing and encoding log output, not by disabling logging.

Answer

Encrypting the model weights at rest in the cloud.

Answer

Removing all logging to prevent log injection.

Question 18

When conducting a risk assessment for an AI system, which TWO of the following are considered 'AI System' components that require individual threat assessment?

Accepted Answer

The training and inference data pipelines.. Option A is correct because the training and inference data pipelines are core AI System components: they ingest, transform, and serve the data the model learns from and acts on, so threats such as data poisoning, tampering, or pipeline compromise must be assessed individually. Option D is correct because the model artifact and its weights constitute the trained model itself, and threats like model theft, weight tampering, backdoor insertion, or adversarial manipulation require dedicated assessment. Options B, C, and E are not AI System components: physical office building security, developers' personal devices, and internal organizational culture are general environmental, endpoint, or human/organizational factors that may influence overall risk but are not part of the AI system's technical architecture requiring component-level threat assessment.

Answer

The physical office building security.

Answer

The personal devices of the developers.

Answer

The internal organizational culture.

Question 19

You are implementing 'AI Red Teaming'. What is the most effective way to test against prompt injection?

Accepted Answer

Execute a series of iterative adversarial prompt attempts against the production model.. Executing iterative adversarial prompt attempts against the production model is the most effective way to test for prompt injection because it directly exercises the attack surface — the model's input handling — under real conditions. Prompt injection is an input-layer vulnerability, so the only reliable test is to attempt injections and observe whether the model follows injected instructions, leaks system prompts, or bypasses guardrails. Iterative testing (red teaming) allows testers to refine payloads based on model responses.

Answer

Check for compliance with data privacy laws.

Answer

Review the training data logs for errors.

Answer

Scan the code repository for hardcoded secrets.

Question 20

You are managing risks for a federated learning deployment. What is the primary security concern regarding the 'model updates' sent from the edge clients to the aggregator?

Accepted Answer

Gradient leakage leading to privacy loss.. In federated learning, edge clients send model updates (e.g., gradients) to a central aggregator. These updates can inadvertently leak sensitive information about the local training data. Gradient leakage attacks can reconstruct original data from gradients, leading to privacy loss. Thus, the primary security concern is privacy leakage from model updates.

Answer

The aggregator becoming a single point of failure.

Answer

Encryption of the communication channel.

Answer

Slow network speeds at the edge.