ISACA Advanced in AI Security Management (AAISM) (AAISM) (AAISM) — Questions 1–75

Adversarial testing and threat modeling are proactive strategies because they identify and mitigate potential risks before they materialize. They involve simulating attacks and analyzing system design to uncover vulnerabilities. This aligns with proactive risk management, which focuses on prevention rather than reaction.

Residual risk in AI systems must be explicitly owned, not left to the operators closest to the output. Because this vendor model exposes no confidence score, override and miss data are the primary signal of degradation, and only an accountable owner with a defined review cadence can convert that signal into documented accept, mitigate, or retire decisions. The other actions either tune or study the model without establishing ownership.

Versioning AI models in production creates an immutable record of each model artifact, its training data lineage, hyperparameters, and evaluation metrics. The primary operational benefit is enabling rapid rollback: if a newly deployed model exhibits degraded performance, harmful outputs, or a security issue, the team can immediately revert to the last known-good version without retraining. This minimizes downtime and blast radius during incidents.

The scenario describes demographic performance drift hidden by stable aggregate accuracy, which only disaggregated, continuous monitoring can detect. Defining thresholds in advance converts detection into action, enabling review, retraining, or rollback. Pre-deployment validation, blanket manual review, and annual revalidation all fail to provide timely, subgroup-level detection and response, which is the core governance requirement for a live high-impact model.

The most defensible action combines formal risk assessment with compensating controls and a bounded pilot. ISACA guidance emphasizes that AI risk cannot always be eliminated but must be identified, evaluated, and managed with documented decisions. Contractual attestations and monitoring create accountability where transparency is limited, and a pilot limits potential harm while generating evidence for a full rollout decision.

Output filtering is the most effective control because it directly inspects and blocks generated content that violates policy or contains sensitive information. It works with any third-party LLM API and can be customized to enforce specific rules. This control provides a consistent enforcement layer independent of the model's training or behavior.

Indirect prompt injection through retrieved documents is best contained by removing the malicious instructions before they reach the model and by ensuring retrieval only returns content the requesting user is entitled to see. Sanitization attacks the vector, while authorization limits the consequence. Sampling parameters and retrieval breadth do not block instruction following, and logging observes rather than prevents the disclosure.

A VPC Interface Endpoint (powered by AWS PrivateLink) creates an elastic network interface with a private IP address in your subnet that serves as an entry point for traffic destined to the AWS service or your own endpoint service. Because the endpoint is reachable only via private IPs inside the VPC, model inference requests are routed over the AWS private backbone and never traverse the public internet. This is the defining characteristic of PrivateLink connectivity.

The scenario describes a distributional shift in input data due to a promotional period, leading to model performance degradation. Drift detection is the AI-specific control that monitors for such changes and enables timely intervention, such as retraining. Other controls like differential privacy, input validation, or adversarial training do not directly address natural data drift and would not prevent the false positive spike.

Model drift is an ongoing operational risk that manifests after deployment, so the most effective control is a contractual one that obligates the vendor to detect and remediate it. Embedding performance thresholds, drift-detection metrics, retraining cadence, and monitoring/reporting duties into the SLA creates enforceable accountability. This shifts drift management from a hope-based posture to a measurable, auditable service commitment.

Under the EU AI Act, the Provider (the entity that develops or places a high-risk AI system on the market) bears the primary obligation to ensure the system undergoes a conformity assessment and complies with the applicable technical standards before market placement. This includes maintaining technical documentation, a quality management system, and a declaration of conformity, and affixing the CE marking. The obligation cannot be shifted to the deployer.

The main objective of red teaming an LLM is to proactively identify safety and security vulnerabilities before adversaries exploit them. Red teaming involves adversarial testing—crafting prompts designed to bypass guardrails, elicit harmful outputs, or extract sensitive information—to uncover weaknesses that can then be remediated. It is a defensive exercise focused on discovery, not on model improvement or cost reduction.

An AI governance charter must define who owns AI risk and how material risks escalate to leadership. These two elements establish accountability and decision-making authority, which are prerequisites for effective oversight. Technical inventories and vendor lists, while useful operationally, do not belong in the charter because they do not define governance structure or risk escalation paths.

Homomorphic encryption allows computations to be performed directly on encrypted data without decrypting it first, producing an encrypted result that, when decrypted, matches the result of the same computation on the plaintext. In secure AI, this enables model inference or training on sensitive data while the data remains encrypted end-to-end, protecting privacy even from the compute provider. This is the defining property of homomorphic encryption.

An AI Ethics Board is a governance body whose primary function is to review AI use cases, projects, and deployments against the organization's stated ethical values, principles, and policies. It provides oversight and guidance on fairness, transparency, accountability, and societal impact — not operational execution. This aligns with governance frameworks like the NIST AI RMF 'Govern' function and ISO/IEC 42001.

In a RAG architecture, the retrieval layer pulls documents from external sources (vector stores, wikis, SharePoint, databases) and injects their content into the LLM's context window. The primary governance concern is ensuring that the retrieval mechanism enforces the same document-level access controls (ACLs) that apply in the source system, so a user cannot receive an answer synthesized from documents they are not authorized to read. Without this, RAG becomes a privilege-escalation and data-exfiltration channel that bypasses existing permissions.

The CRO wants third-party foundation model API risk separated from internally developed model risk. A provenance dimension accomplishes this by tagging each AI system with how its model was obtained, allowing risk assessors to apply specific controls for external dependencies such as vendor model updates, contractual data handling, and upstream bias. The other options either distort scores, collapse AI risk into generic vendor risk, or apply uniform treatment.

The AI Ethics Policy sets normative expectations for how AI is developed and used, covering fairness, transparency, privacy, and accountability. Ownership belongs with Compliance/Legal or the Ethics Office (D) because these functions interpret regulatory obligations, manage ethical risk, and have the independence and authority to enforce policy across business units. Placing ownership there ensures the policy is defensible, aligned with law and regulation, and not subordinated to IT operational priorities.

Rapid escalation depends on agreed severity thresholds and pre-built notification paths with target times. Dashboards, audits, and inventories are valuable governance artifacts, but none of them ensures a severe incident reaches executives within hours. Predefined triggers remove ambiguity and delay at the moment of crisis.

SageMaker Model Registry provides versioned model groups with approval statuses (PendingManualApproval, Approved, Rejected), and deployment pipelines can be gated to only deploy models in the Approved state. This creates an auditable, policy-enforced promotion path from training to production.

A sandboxed execution environment for agents is the correct control because prompt injection attacks aim to make an LLM-driven agent execute unintended actions (e.g., calling tools, accessing files, or making network requests). Sandboxing constrains what the agent can actually do even if the prompt is manipulated, enforcing least privilege at the execution layer. This is a defense-in-depth control that limits blast radius rather than trying to perfectly filter malicious prompts.

On-device processing with anonymized feature vectors is the most appropriate control because it minimizes the collection and storage of sensitive biometric data. By processing locally and discarding raw images, the system reduces the risk of unauthorized surveillance and helps comply with privacy regulations that mandate data minimization and purpose limitation.

In a low defect-rate inspection process, the dominant risk is defective parts escaping detection. The false negative rate isolates that failure mode, and converting it into expected escaped defects per shift makes the exposure concrete for plant leadership. This is more actionable than aggregate accuracy or threshold-independent metrics.

Model validation before production verifies that the model meets defined performance, fairness, robustness, and safety benchmarks on representative data, ensuring it behaves as intended in real-world conditions. It is a governance gate that catches degradation, bias, or unsafe behavior before customers or critical processes are affected. Removing users, encrypting weights, and reducing GPU costs are unrelated to validation's purpose.

Data poisoning attacks work by corrupting the data a model learns from, so the training data collection and ingestion stage is where an adversary can inject malicious, mislabeled, or biased samples that the model will internalize. Once poisoned data is ingested, the resulting model weights encode the attacker's influence, making this the earliest and most impactful point of compromise. Later stages like inference or monitoring cannot retroactively undo poisoned training data.

Output perturbation deliberately adds noise or rounds confidence scores returned by the API, degrading the fidelity of the information an adversary can use to train a clone. Model extraction relies on precise output signals, so perturbing them reduces clone accuracy while preserving acceptable utility for legitimate users. This is a direct, low-cost mitigation at the inference boundary.

Governance scope is determined by the organization's use of AI, not by who owns the model. Third-party API models influence decisions, process data, and create regulatory exposure, so they must be inventoried and governed proportionately. Contractual controls, vendor assessment, and output validation are the practical levers available when the organization cannot inspect weights or training data.

When an organization cannot inspect a vendor's data handling or security controls, the practical treatment is to bind the vendor through contractual obligations and verify those obligations through assessment. Prohibiting training on submitted content, requiring breach notification and deletion rights, and validating the commitments provides enforceable protection and creates evidence for the risk register. Relying on certifications alone, assuming the data is harmless, or hastily self-hosting without capability does not address the identified exposure.

Aligning an AI system with evolving risk appetite requires ongoing, measurable oversight, not one-time or static controls. A continuous risk monitoring and reporting program with defined KRIs and periodic model performance reviews directly connects live AI behaviour to governance thresholds, enabling detection of drift and timely escalation. Penetration tests, attestations, and archiving are valuable but do not provide the continuous linkage needed for sustained alignment.

Model drift (specifically concept drift or data drift) is the degradation of a deployed model's predictive performance over time because the statistical distribution of input data or the input-to-output relationship changes relative to the training data. The model itself is unchanged, but the world it was trained on has shifted, so its predictions become stale or wrong. This is why production ML requires monitoring for drift and periodic retraining.

Instruction hierarchy and output filtering are specifically designed to prevent prompt injection attacks that aim to extract system prompts. Instruction hierarchy enforces that system-level directives cannot be overridden by user inputs, while output filtering scans and redacts sensitive content. These controls together provide a robust defense against system prompt disclosure, unlike input sanitization which can be bypassed.

When a vendor withholds training data and architecture details, the committee cannot eliminate provenance risk, but it can bound it with compensating controls: contractual audit rights, independent validation on local patient data, and human-in-the-loop clinical review. Documenting and accepting the residual risk with an accountable owner makes the decision defensible. Rejection, blind acceptance, and liability shifting each fail to establish the layered assurance the scenario requires.

Moving from ad hoc oversight to a repeatable program requires a structured reference model. Adopting a recognized AI governance framework and mapping current practices to its domains lets the organization benchmark maturity, prioritize gaps, and report measurable progress to the board, which is the essence of continuous improvement.

During the Design phase, the team defines architecture, data flows, and trust boundaries, making it the natural point for threat modeling and initial risk assessment. Identifying threats and risks before build avoids costly rework and ensures controls are baked in rather than bolted on. This aligns with secure-by-design and AI risk management frameworks that place risk identification early in the lifecycle.

To explain individual AI decisions, the firm needs case-level insight into which factors drove each prioritization. Model-agnostic techniques like SHAP or LIME generate feature importance that translates model behaviour into understandable terms for regulators and employees. Logging, aggregate metrics, and human review support governance but do not provide the specific reasoning behind a given decision, making them insufficient for this requirement.

A centralized AI risk register integrated into ERM provides the structured, consistent mechanism to identify, assess, and treat AI risks across all business units. It aligns with NIST AI RMF and enables aggregated reporting to the CRO. Other options are either awareness-focused or operational, and do not deliver enterprise-wide risk management consistency.

Differential privacy is the only technique listed that provides a formal guarantee limiting the influence of any single training record on the model. By adding noise during training, it directly prevents reconstruction and membership inference attacks, which is exactly what the team needs to protect sensitive customer data in a fraud detection model.

Differential privacy is the only technique listed that provides a formal, mathematical guarantee that an individual's data cannot be re-identified from the model. It works by injecting noise into the training process, ensuring that the model's behavior is statistically similar whether or not any single record is included. Other techniques like data masking, homomorphic encryption, and secure multi-party computation address different aspects of privacy but do not offer this guarantee.

Overfitting occurs when a model learns the training data too precisely, including its noise and idiosyncrasies, so it performs excellently on training data but poorly on new, unseen data. The primary risk is therefore a lack of generalization, meaning the model's predictions do not hold up in production where inputs differ from the training set.

A right-to-explanation law requires that rejected candidates receive understandable reasons for decisions. Implementing post-hoc explanation techniques and a governance process to translate model outputs into candidate-friendly reasons addresses this directly while preserving the model. Monitoring explanation fidelity ensures the explanations remain valid as the model evolves, which is essential for sustained legal compliance.

Bias that persists despite the absence of explicit protected attributes is often embedded in the model's learned representations through proxy variables. Adversarial debiasing actively removes this encoded bias during training by preventing the model from retaining information about protected groups. Simply removing attributes or adding data does not correct the learned bias, and post-processing may introduce other issues.

The Fast Gradient Sign Method (FGSM) is a well-known evasion attack that generates adversarial examples by adding small perturbations to input data to fool a classifier. It is specifically designed to test a model's vulnerability to evasion, where the attacker manipulates inputs at inference time to cause misclassification. Therefore, simulating FGSM with ART is the correct choice for assessing evasion vulnerabilities.

Model inversion attacks exploit the model's tendency to memorize training data, often using confidence scores to reconstruct sensitive information. Limiting API output to top-1 class removes the granular data attackers need, while differential privacy mathematically bounds the influence of any single training record, directly preventing memorization. These two controls together provide strong defense, whereas rate limiting, encryption, and smaller models do not adequately address the core risk.

In ISO/IEC 42001, Clause 4 'Context of the Organization' establishes why the AI management system exists and what it must cover. It requires the organization to determine external and internal issues, identify interested parties and their requirements, and define the scope and boundaries of the AIMS aligned with strategic direction. Option A captures this purpose: defining boundaries and strategic intent so all subsequent clauses (leadership, planning, support, operation, evaluation, improvement) operate within a coherent frame.

Differential privacy is the technique that bounds how much any single individual's data can influence a query result, which is exactly the guarantee needed when analysts may run many queries against a model trained on sensitive records. Encryption, authenticated access, and identifier hashing all protect the data at rest or at the gate but leave the information content of legitimate outputs unconstrained, so they do not prevent reconstruction.

The core risk is that a third-party provider can change the model without the organization's knowledge, causing unexpected behavior. The most effective first step is to gain control over model versions through contractual terms and version pinning, which directly prevents silent updates from affecting production. Detection, red teaming, and replacement are either reactive or disproportionate as an initial response.

The requirement is that adversely affected claimants can understand and contest outcomes. A plain-language explanation plus a documented human review route delivers both transparency and contestability. Threshold tuning, audit logging, and retraining improve performance or oversight but do not provide the affected individual with an explanation or a remedy.

The requirement is a documented process for handling harmful outputs after deployment, which is precisely what an AI-specific incident response process provides: detection channels, triage criteria, containment options, and post-incident review. Vendor filters, terms of service, and periodic meetings each address adjacent concerns but none establishes the timely, structured response capability the risk team is asking for.

To quantify output sensitivity across a population, the analyst needs a global method that attributes output variance to inputs over the whole distribution. Variance-based sensitivity analysis such as Sobol indices does precisely this, revealing which features, and which interactions, cause unstable decision boundaries. This evidence supports risk decisions such as constraining input precision, retraining, or adding human review for affected applicants.

Expectations for responsible AI behavior are established through a published acceptable use policy that enumerates permitted, restricted, and prohibited uses. Training, monitoring, and bounty programs support the policy, but the policy itself is the instrument that defines expectations and provides the basis for consistent enforcement across the workforce.

The NIST AI RMF MEASURE function is about analyzing and assessing AI risks using metrics, methods, and tools. Applying fairness metrics and robustness testing quantifies discriminatory and adversarial risk, which is a direct MEASURE activity. Documenting context belongs to MAP, prioritizing resources belongs to MANAGE, and defining tolerance is a governance precursor.

The governance committee must close the gap that allowed an unannounced vendor model change to affect hiring. A contractual requirement for advance notification and review creates a repeatable control, ensuring the organization can evaluate risks and performance before changes go live. This approach balances operational continuity with oversight, directly addressing the third-party change management deficiency without overreacting or neglecting the root cause.

Statistical outlier detection on training feature sets is the most effective technique because poisoning attacks introduce anomalous data points that deviate from the expected distribution of legitimate training data. By applying statistical methods (e.g., z-score, IQR, isolation forests) to feature distributions, contaminated samples can be flagged and removed before they influence model weights. This directly targets the integrity of the training pipeline at the data ingestion stage.

Continuous monitoring provides real-time (or near-real-time) visibility into system performance, threats, and compliance posture, enabling immediate detection and response to anomalies. In contrast, point-in-time auditing captures a snapshot of controls and compliance at a specific moment, which can miss threats that emerge between audits. Continuous monitoring is a core principle of frameworks like NIST SP 800-137 and is essential for dynamic AI and cloud environments.

The attack exploits memorization of rare training sequences, so the effective control must act during training to limit how much any single record shapes the weights. Differential privacy via DP-SGD clips per-example gradients and adds calibrated noise, mathematically bounding individual record influence. Inference-time filters, watermarking, and longer training do not remove the memorized data and therefore cannot reliably stop extraction.

AI Red Teaming is the practice of proactively and adversarially probing an AI system to uncover weaknesses such as prompt injection, jailbreaks, bias, data leakage, and unsafe outputs before malicious actors exploit them. It mirrors traditional security red teaming but targets model behavior, guardrails, and the surrounding application stack. The goal is to find and remediate vulnerabilities through structured adversarial testing.

SageMaker Model Monitor is designed to continuously monitor deployed models for data quality, model quality, bias drift, and feature attribution drift. It can detect statistical deviations in ground truth data by comparing live data to a baseline and trigger CloudWatch alarms. This directly addresses the requirement to monitor and alert on drift.

Auditability of AI decision-making requires a traceable record of what inputs were provided, which model version was used, and what outputs were produced. Maintaining immutable logs of these elements ensures that decisions can be reviewed, reproduced, and audited for compliance, bias, or errors. This is the foundational mechanism for AI auditability.

FGSM and PGD are both adversarial attack techniques used to generate perturbed inputs that can fool a model. They are standard methods for testing a model's robustness, especially in security-sensitive applications like intrusion detection. By applying these attacks, analysts can identify vulnerabilities and improve defenses.

A documented human-in-the-loop requirement in the AI acceptable use policy is the only option that creates a preventive, auditable governance control mandating human validation before AI-generated content is published or used in decisions. DLP, training, and audits are supporting measures but do not enforce the specific review gate the CISO requires.

An adversarial example attack occurs when an attacker intentionally modifies input data at inference time to cause the model to produce incorrect outputs. Here, the attacker alters camera feed pixels to make defective products appear non-defective. This is a direct example of an adversarial example attack, which is a key concern in AI security and requires defenses like input validation and robust model training.

The AI governance policy and risk appetite statement are the foundational internal documents that express the organization's approved risk tolerance and control expectations. Reviewing them first ensures the sentiment analysis tool's data handling aligns with enterprise requirements before any technical or contractual evaluation. This reflects ISACA's principle that governance artifacts drive AI risk decisions.

Before signing with a third-party AI vendor, the risk manager should perform structured due diligence on governance, data handling, model lifecycle, and incident response. This establishes a defensible risk picture and informs contractual and monitoring requirements. Replication, premature pilots, and reliance on a single generic attestation each fail to deliver that foundational understanding.