AAISM AI Technologies And Controls Practice Test 8 — 15 Questions

Question 1

A hospital is preparing to fine-tune a clinical summarization model on de-identified patient notes. The AI security manager must select controls that reduce the risk of training-data memorization leaking back through model outputs. (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply differential privacy during fine-tuning with a formally tracked privacy budget.. Memorization leakage is mitigated by constraining how much any single record shapes the model and by verifying empirically that it did not. Differential privacy with a tracked budget provides the preventive, measurable constraint, while membership inference testing provides the detective evidence that the constraint held. Capacity scaling, data co-location, and log suppression either worsen the risk or address unrelated concerns.

Answer

Store the de-identified training corpus in the same object bucket used for model artifacts to simplify lineage tracking.

Answer

Increase the model's parameter count so that training examples are distributed across more weights.

Answer

Disable output logging on the summarization service so that generated text cannot be harvested.

Question 2

A data scientist is preparing to train a model on a dataset that includes personally identifiable information (PII). Before training, they want to reduce the risk of the model memorizing and later leaking PII. Which data preprocessing technique is most appropriate?

Accepted Answer

Data anonymization. Data anonymization directly addresses the privacy risk by removing or altering PII before training, preventing the model from memorizing identifiable information. The other techniques are standard preprocessing steps but do not mitigate privacy concerns.

Answer

Feature scaling

Answer

One-hot encoding

Answer

Data augmentation

Question 3

A security analyst is reviewing controls for an AI system that uses a large language model (LLM) to generate responses based on user prompts. The analyst wants to mitigate the risk of prompt injection attacks that could cause the model to reveal sensitive information or perform unintended actions. Which TWO of the following controls are most effective for this purpose? (Choose two.)

Accepted Answer

Output encoding and filtering. Prompt injection attacks exploit the model's inability to distinguish between instructions and data. Input validation and sanitization can block malicious prompts before they reach the model, while output encoding and filtering can prevent sensitive data from being leaked even if an injection succeeds. These two controls provide defense in depth. Model quantization, temperature adjustments, and context window size do not address the root cause or impact of prompt injection.

Answer

Model quantization

Answer

Using a larger context window

Answer

Increasing the model's temperature

Question 4

An organization is developing an AI system that processes personal health information. To comply with privacy regulations and ISACA's AI governance guidelines, they need to ensure that the model does not memorize individual patient data. Which technique should be applied during training?

Accepted Answer

Differential privacy. Differential privacy is the standard technique to provide formal privacy guarantees during training by ensuring that the model's outputs are not significantly influenced by any single data point. This prevents memorization of individual patient records, which is critical for compliance with health privacy regulations and ISACA's ethical AI principles.

Answer

Federated learning

Answer

Homomorphic encryption

Answer

Data augmentation

Question 5

A healthcare analytics team trains a diagnostic model on patient records and wants to verify that the model does not memorize individual training examples. They need a technique that measures privacy leakage by comparing model behavior on training versus non-training data. Which approach should they use?

Accepted Answer

Membership inference testing to estimate whether specific records were part of the training set.. Membership inference testing is designed to quantify whether an adversary can infer that a specific record was used in training, which is exactly the memorization risk described. The other techniques address explainability, adversarial robustness, or operational drift, none of which measure privacy leakage from training data.

Answer

Data drift monitoring to detect distribution changes between training and production inputs.

Answer

SHAP value analysis to explain which features contributed most to each prediction.

Answer

Adversarial example generation to test the model's robustness to small input perturbations.

Question 6

An organization's AI governance committee is defining how retrieval-augmented generation assistants should handle ingested documents. A security analyst proposes that each retrieved chunk carry metadata identifying its source system, ingestion time, and sensitivity label, and that the assistant's responses cite the chunks used. Which objective does this control primarily serve?

Accepted Answer

Enabling traceability of generated content back to authoritative sources and enforcing sensitivity-aware handling.. Tagging retrieved chunks with source, time, and sensitivity, and surfacing citations, creates an auditable chain from answer back to document. That supports investigating incorrect or harmful outputs, verifying which authoritative source was used, and applying classification-based handling. It is a governance and traceability control, distinct from generation quality, storage optimization, and injection defense.

Answer

Preventing prompt injection by sanitizing the content of retrieved documents before embedding.

Answer

Improving the fluency and grammatical quality of generated responses.

Answer

Reducing the vector database storage footprint by deduplicating embeddings.

Question 7

An organization is selecting a control to protect an AI model's integrity after it is deployed to a model registry. They want to ensure that any unauthorized modification to the model artifact is detectable before it is loaded into production. Which control should they implement?

Accepted Answer

Cryptographic hashing of the model artifact with signature verification at deployment time.. Cryptographic hashing with signature verification provides a proactive integrity check that detects any modification to the model artifact before it is loaded into production. The other controls address access management, confidentiality at rest, or post-deployment behavior, none of which verify artifact integrity at deployment time.

Answer

Monitoring inference latency and accuracy metrics after deployment.

Answer

Encrypting the model artifact at rest with a customer-managed key.

Answer

Role-based access control on the model registry to limit who can upload new versions.

Question 8

A security analyst is evaluating an AI-based intrusion detection system (IDS) that uses a machine learning model to classify network traffic. The analyst wants to assess the model's robustness against adversarial attacks. Which two techniques should be used to test the model's resilience? (Choose two.)

Accepted Answer

Projected Gradient Descent (PGD). FGSM and PGD are both adversarial attack techniques used to generate perturbed inputs that can fool a model. They are standard methods for testing a model's robustness, especially in security-sensitive applications like intrusion detection. By applying these attacks, analysts can identify vulnerabilities and improve defenses.

Answer

Membership inference

Answer

Model inversion

Answer

Data poisoning

Question 9

A team is deploying a vision model for automated quality inspection on a factory floor. During red-teaming, they find that placing a small printed patch on a widget causes the model to classify defective items as passing. The team cannot retrain immediately. Which control most directly reduces the operational impact of this finding?

Accepted Answer

Introduce an independent inspection step, such as a secondary sensor or human sampling, that can override the model's pass decision.. A physical adversarial patch defeats the model's decision, and retraining is off the table in the near term. The pragmatic control is to ensure no single model output can release a defective item, which an independent sensor or human sampling accomplishes. Adversarial retraining, threshold tuning, and camera resolution all either take too long or fail to address the perturbation's effect on the classifier.

Answer

Increase the resolution of the inspection camera to capture finer surface detail.

Answer

Lower the model's classification threshold so that more items are flagged as defective.

Answer

Add the patch pattern to the training set as a labeled adversarial example and schedule retraining next quarter.

Question 10

A retail company uses a machine learning model to approve credit applications. Regulators require the company to explain adverse decisions to applicants. The data science team wants a method that provides local, instance-level explanations of feature contributions that are additive and consistent. Which technique should they adopt?

Accepted Answer

SHAP (SHapley Additive exPlanations) values.. SHAP values provide consistent, additive, instance-level attributions that can explain individual credit decisions, meeting both technical and regulatory needs. Global importance, partial dependence, and LIME either lack local specificity or lack the consistency and additivity required for defensible adverse action explanations.

Answer

LIME (Local Interpretable Model-agnostic Explanations).

Answer

Partial dependence plots.

Answer

Global permutation feature importance.

Question 11

An AI platform team must let data scientists run training jobs that access a sensitive feature store. Auditors require that no long-lived credentials exist in notebooks and that every access be attributable to a specific scientist. Which approach best satisfies both requirements?

Accepted Answer

Bind each scientist's workload to a federated identity that exchanges short-lived tokens for scoped access to the feature store.. The two requirements are eliminating long-lived secrets and preserving per-user attribution. Federating each scientist's identity and exchanging it for short-lived scoped tokens satisfies both, because credentials are ephemeral and every access carries the originating individual. Shared service accounts, a single platform key, and node-level roles all obscure or eliminate individual attribution while leaving standing or overly broad access in place.

Answer

Store a single platform API key in a managed secrets vault and inject it into every training job at runtime.

Answer

Grant the training cluster's node role broad read access to the feature store and rely on network segmentation to restrict callers.

Answer

Issue each scientist a shared service account whose password is rotated every 90 days and stored in the notebook environment file.

Question 12

A security operations team wants to detect when an attacker is probing a deployed image classification model to learn its decision boundaries before launching an evasion attack. The model exposes only predicted labels and confidence scores. Which monitoring signal is most indicative of this reconnaissance activity?

Accepted Answer

A high volume of queries with small, structured perturbations and unusually low confidence scores clustering near decision boundaries.. Boundary reconnaissance manifests as many small structured perturbations producing low-confidence, boundary-adjacent outputs, which is a distinctive query pattern. Resolution changes, account consolidation, and infrastructure load are non-specific and can arise from benign activity, so they do not reliably indicate pre-attack probing.

Answer

A sudden increase in the average image resolution of submitted inputs.

Answer

A decrease in the number of distinct user accounts accessing the model.

Answer

An increase in the model's GPU memory utilization during inference.

Question 13

A global bank has deployed a real-time fraud detection model that processes payment card transactions. The model was trained on historical transaction data and is now in production. To detect concept drift, the security team wants to monitor the model's performance without waiting for verified fraud labels, which may take weeks to obtain. Which approach should they use?

Accepted Answer

Monitor the distribution of input features and model prediction scores using statistical distance metrics such as Population Stability Index (PSI) and compare against a baseline.. When ground truth labels are delayed, monitoring input feature distributions and prediction score distributions against a baseline is the most practical way to detect concept drift. Statistical metrics like PSI can signal when the data or model behavior deviates from the training distribution, prompting investigation or retraining. This approach is proactive and does not depend on immediate labels.

Answer

Implement a shadow model that uses the same features and compare its predictions to the production model's predictions in real time.

Answer

Retrain the fraud model daily on the most recent transactions to ensure it always captures the latest fraud patterns.

Answer

Set up alerts based on the model's false positive rate calculated from the previous day's transactions.

Question 14

An insurance company uses a gradient-boosted model to score auto claims. After a vendor update to the feature-engineering pipeline, the model's predictions shift sharply, but no alerts fire because the input schema and types are unchanged. Which control would most directly detect this silent data drift before it affects claim decisions?

Accepted Answer

Deploying Amazon SageMaker Model Monitor with a data quality baseline that tracks feature distribution statistics and emits violations when they deviate beyond configured thresholds.. Silent data drift occurs when live feature distributions move away from the training baseline while schemas and types still validate, so schema checks and latency alarms stay quiet. Statistical baseline monitoring of feature distributions, with thresholds that raise violations, is the control purpose-built to catch that shift early. The other controls address audit logging, operational health, or fairness rather than distributional change.

Answer

Running periodic SageMaker Clarify bias reports against the training dataset to confirm that the protected-class disparity metrics remain within tolerance.

Answer

Configuring an Amazon CloudWatch alarm on the endpoint's ModelLatency and Invocations metrics to trigger when throughput or response time leaves the expected band.

Answer

Enabling AWS CloudTrail data events on the model endpoint to capture every InvokeEndpoint call and its request payload for later forensic review.

Question 15

A bank's fraud team trains a graph neural network on transaction relationships. An attacker who cannot access the model or its weights submits many carefully crafted synthetic accounts and transfers designed to shift the learned decision boundary over several retraining cycles. Which term best describes this attack?

Accepted Answer

Data poisoning. Attacks that place crafted data into the training pipeline to influence what the model learns are poisoning attacks, and the multi-cycle, boundary-shifting nature described here is their signature. Evasion acts only at inference against a fixed model, model inversion extracts information rather than injecting it, and prompt injection applies to instruction-following generative systems, so none matches the described manipulation of training data.

Answer

Prompt injection

Answer

Model inversion

Answer

Model evasion