ISACA Advanced in AI Security Management (AAISM) (AAISM) (AAISM) — Questions 76–150

Rollback or containment procedures let responders isolate a misbehaving model, revert to a prior known-good version, or disable its endpoint, limiting blast radius during an active AI incident. Without this technical containment capability, the plan cannot stop ongoing harm while investigation and remediation proceed.

Because the vendor will not permit model-level audits, the enterprise cannot reduce model risk at the source. A mandatory human approval gate is a compensating control that converts an automated decision into an assisted one, so an unverifiable model output cannot directly change a customer's credit limit. This preserves accountability and creates an auditable decision record while the model risk remains unmitigated.

A cross-functional steering committee translates business risk appetite into concrete AI risk tolerance thresholds, giving security controls an authoritative benchmark to align against. This directly satisfies the stem's requirement for alignment between AI security controls and business risk appetite within the NIST AI RMF governance function.

Allowing an AI model to reach external data sources without verifying authorisation on the data itself breaches Broken Access Control, because access decisions are enforced on the requesting identity rather than the resource. This violates the stem's constraint: insufficient authorisation checks on the data, letting the model retrieve content its principal should never reach.

A cross-functional committee spanning legal, privacy, and security ensures AI acceptable use policies reflect regulatory obligations, data-protection requirements, and technical risk controls together. No single function holds all three perspectives, so this composition satisfies the need for balanced, enforceable policy definition.

Quarterly strategic risk and compliance assessments give the board a recurring, structured view of residual AI risk and control effectiveness, matching the cadence at which governance bodies meet. This satisfies board-level oversight without burying directors in operational detail between meetings.

XAI exposes how inputs drive outputs, letting auditors trace decisions to specific features. This satisfies the risk-management need to detect hidden bias and assign accountability, since opaque models otherwise prevent root-cause analysis or regulatory justification of adverse outcomes.

Data provenance and lineage tracking satisfies the integrity constraint by cryptographically recording each dataset's origin, transformation and access history, so tampering or poisoned training inputs are detectable before they influence model weights. It anchors accountability across the supply chain, complementing integrity verification rather than merely restricting access.

An AI SBOM enumerates every model, dataset, library and dependency in the supply chain, giving the bank component-level visibility and provenance. This directly satisfies the demand for robust assurance by exposing tampered or vulnerable artefacts before deployment.

Encryption at rest protects stored training datasets from unauthorised disclosure if underlying storage media or backups are compromised, directly satisfying the stem's protection requirement. It defends against physical theft and snapshot exposure, complementing access controls and data-in-transit encryption.

Escalating to the AI governance committee ensures that the decision is made through the established governance process, balancing urgency with risk. The committee can authorize an expedited assessment or enforce the policy, maintaining accountability. This upholds the program's integrity and provides a defensible rationale, rather than ad hoc exceptions.

Over-reliance means users treat AI outputs as authoritative without verification, so errors propagate unchecked into decisions. This satisfies the stem's focus on the primary risk: automation bias, where confidence in the tool replaces independent judgement, making incorrect or harmful AI-generated information the direct consequence.

Inherent risk is a function of impact severity and likelihood before controls. A triage tool that misorders critically ill patients can cause direct physical harm or death, which places it in the highest risk tier regardless of model architecture or data volume. This impact-centric view aligns with how AI risk frameworks classify systems by the severity of consequences to individuals and society.

The RequestResponse diagnostic log category captures the prompt and completion payloads exchanged with the Azure OpenAI resource. Enabling it streams those interaction records to the Log Analytics workspace, where Defender for Cloud can detect and surface prompt injection attempts, satisfying the logging requirement.

A blind spot attack crafts inputs in low-confidence regions of the model's decision boundary, where predictions are unstable, forcing misclassification without needing gradient access. This matches the stem's definition of exploiting low-confidence regions to force incorrect predictions.

Completed risk assessments give the board a measurable, auditable count of AI systems whose security has been formally evaluated, directly evidencing governance coverage. This satisfies the reporting constraint by quantifying posture as a percentage rather than raw counts or subjective ratings, enabling trend tracking across the AI estate.

A risk register must capture who owns the risk, how likely it is, its potential impact, and what is being done to mitigate it. These elements enable prioritization, tracking, and accountability. Without them, the register is just a list and cannot support effective risk management. This is the core information needed for any risk management framework, including AI-specific risks.

Differential privacy adds calibrated noise to query outputs or gradients, bounding any single record's influence so an attacker cannot infer whether a specific individual was present in the training set. This directly satisfies the stem's constraint: preventing re-identification of individuals within training data, unlike encryption or access controls that protect data at rest.

Performance drift without retraining or pipeline changes usually signals a shift in the relationship between inputs and outcomes, known as concept drift, or a change in input distributions, known as data drift. Comparing current input distributions against the training baseline localizes the cause and informs whether to retrain, recalibrate thresholds, or fix upstream data. This diagnostic step is the correct governance response before altering the model.

Differential privacy adds calibrated noise during training to ensure that the inclusion or exclusion of any single data point does not significantly affect the model's output. This provides a mathematical guarantee against membership inference and data extraction. In this scenario, it directly addresses the risk of revealing sensitive training data, making it the appropriate technique for the financial institution's requirement.

A RACI matrix assigning AI risk ownership to named roles across the lifecycle creates explicit, auditable accountability for who is responsible, accountable, consulted, and informed at each stage. It ensures that both development and operational risks have identifiable owners, which is precisely what the Chief Risk Officer needs to prevent accountability gaps.

AWS IAM is the primary API-layer control point for Bedrock, using identity-based and resource-based policies plus condition keys to grant least-privilege access to model invocation actions. It enforces authorisation before any Bedrock API request is processed.

This directly addresses the need to demonstrate ongoing monitoring of AI outputs for harmful or biased content. By logging responses and flagging anomalies, the firm creates an auditable trail that regulators can review, proving that the AI is not operating unchecked. This aligns with AI governance requirements for continuous oversight and accountability, ensuring the CISO can evidence compliance.

Output encoding and filtering can detect and block sensitive information from being included in the model's responses. Even if a prompt injection succeeds, this control acts as a second layer to prevent data leakage. It is effective for mitigating the impact of successful injections by ensuring that outputs conform to security policies.

When a model can be reliably fooled by a physical perturbation and retraining is not available, the most direct mitigation is to prevent a single compromised decision from releasing a defective item. A secondary sensor or human sampling provides an independent check that can veto the model's output, containing the impact while longer-term robustness work proceeds.

AI-aware API discovery and CASB solutions inspect sanctioned and unsanctioned traffic, detecting shadow AI use across the enterprise. This satisfies the enterprise-level constraint by providing centralised visibility and policy enforcement, unlike endpoint-only or manual controls that miss cloud and API-based AI services.

A standard is the correct layer in the policy hierarchy to convert principles into mandatory, auditable requirements. It defines controls, assigns roles, and states the evidence needed to demonstrate compliance, and it can be made binding on third parties through contracts. This gives the governance lead an enforceable instrument below the principles statement.

The third line, typically internal audit, provides independent assurance to the board and senior management on whether the AI governance framework is designed and operating effectively. Its independence from both the operation of AI systems and the definition of the framework allows it to objectively assess controls and report findings without conflict of interest.

This is correct because governance requires evidence-based escalation before action. Validating the disparity distinguishes statistical noise or confounding variables from genuine bias. Documenting and escalating through the defined risk process ensures the right stakeholders, including legal, compliance, and clinical leadership, decide on remediation such as retraining, threshold adjustment, or human override rules.

Hashing the model artifact and verifying a cryptographic signature at deployment detects any unauthorized modification between registry and production. If the artifact is altered, the hash or signature check fails and the model is rejected. This directly ensures integrity of the deployed model and is a standard supply-chain control for AI artifacts.

The AI Model Inventory provides a centralised register of every AI asset, capturing purpose, owner, data sources and risk classification. This single source of truth satisfies the oversight constraint by letting governance teams identify, assess and monitor AI risks across the organisation consistently.

Capturing a human judgment before the AI output is revealed prevents the anchoring effect that drives automation bias, because the planner's assessment cannot be unconsciously adjusted to match the model. Comparing the independent forecast to the AI output also generates data on where human and machine disagree, which is useful for evaluating both the model and the effectiveness of the control.

A defined governance structure with clear roles and an accountable executive ensures that someone is responsible for AI outcomes. It provides the authority and decision rights needed to enforce policies across business units. Without this, accountability is diffuse and enforcement becomes inconsistent, making it a foundational component for the program.

Checksum validation within data lineage detects any post-ingestion alteration of training records, directly satisfying the integrity-verification constraint for poisoning during training. Hashing each dataset version and comparing against recorded digests exposes tampering that statistical drift checks would miss.

Side-channel attacks infer secrets from physical implementation characteristics rather than algorithm flaws. Timing and power consumption patterns leak information about internal computations, enabling an adversary to extract model parameters or data without directly accessing the model.

Public pre-trained model weights can be tampered with before publication, embedding hidden backdoors that trigger malicious behaviour on specific inputs. Because the weights appear legitimate and no source validation occurs, the backdoor survives deployment and can bypass conventional input filtering or monitoring controls.

The DPA contractually specifies how the vendor processes, stores, retains and protects personal data, including subprocessors and breach obligations. It therefore gives the clearest evidence of data handling practices for third-party AI risk assessment, unlike marketing or generic security documentation.

HashiCorp Vault centralises storage of database passwords and API keys with dynamic secret generation, leasing, and audit logging. It keeps credentials out of pipeline code and configuration, directly satisfying the requirement to manage secrets used by AI training workloads securely.

Detecting model extraction depends on observing the pattern of queries an attacker submits, not just blocking a single bad one. Recording the complete feature vectors, outputs, timestamps, and caller identity gives the team the raw material to spot near-duplicate probes, high-volume sampling, or systematic boundary searches, which is exactly what the current payload-discarding endpoint prevents.

A Secrets Manager stores credentials encrypted, enforces access policies and auditing, and supports rotation, so the key never sits in source code, environment files or notebooks. This satisfies the managed AI API scenario's need to protect a long-lived credential that grants billable access to the provider's endpoint.

Independent verification of the vendor's model performance tests outputs against your own benchmarks, confirming accuracy claims rather than trusting vendor-reported metrics. This satisfies the third-party AI vendor risk requirement by validating model behaviour objectively before and during use.

Interpretability refers to the ability to explain how a model arrives at its decisions in human-understandable terms. For loan applications, this is crucial to provide reasons for decisions to applicants and auditors. It directly addresses the need for explainability and regulatory compliance, making it the most important property.

XAI exposes how a model reaches its outputs, letting governance bodies audit decisions, evidence fairness and justify outcomes to regulators. This directly delivers the transparency, trust and regulatory compliance the question asks about, rather than improving raw predictive accuracy.

Bedrock Guardrails apply PII filters per content flow, so enabling the sensitive-information policy for both input and output ensures prompts and completions are each screened. Configuring only one flow would leave the other unfiltered, breaching the requirement.

This approach follows the risk management cycle: identify and measure the harm, document it with accountable ownership, apply appropriate mitigation, and monitor continuously for regression. Fairness assessment across groups surfaces the actual disparity, mitigation techniques like reweighting or post-processing target the mechanism, and ongoing monitoring ensures the treatment remains effective as data and behavior evolve.

Fundamental for governance.

Disclosure of training data sources directly satisfies the provenance constraint, revealing whether data was licensed, scraped or synthetic. This determines bias exposure, intellectual-property liability and regulatory compliance under frameworks such as the EU AI Act. Without it, downstream risk assessments cannot quantify inherited model risk or validate Microsoft Entra ID access governance assumptions.

Poor performance on a protected-class subgroup signals possible underrepresentation or imbalance in the training data. Auditing representation and training balance for that subgroup is the diagnostic step that precedes mitigation, letting you confirm whether the disparity stems from data rather than the model architecture itself.

A PII detection and redaction layer acts as a runtime control that scrubs sensitive identifiers before they enter the model context and before summaries are returned to agents. This directly mitigates the risk of PII appearing in outputs, regardless of whether it originated from the current session or a retrieved document. It complements session isolation by catching residual sensitive data.

An AI Steering Committee provides strategic oversight, prioritisation and risk management, satisfying governance at the executive level. It sets direction, approves AI initiatives and owns enterprise-wide risk decisions, rather than handling day-to-day model operations or technical implementation.

This is correct because internal audit provides independent, objective assurance and reports through a channel separate from the teams building and operating the models. Testing against the governance framework produces evidence rather than assertions, and tracking remediation to closure ensures findings drive change. This gives the board defensible assurance that AI controls are designed and operating effectively across the twelve countries.

Risk acceptance or remediation planning directly addresses unmet security requirements by formally documenting, transferring or mitigating the identified risk. This governance process satisfies the stem's constraint: a failing AI project needs a decision on whether to accept residual risk or initiate remediation, ensuring accountability and auditability under Microsoft Entra ID-aligned controls.

Membership inference attacks determine whether a specific record was part of the training set. Success reveals that an individual's data was used for training, exposing sensitive information about those data subjects and potentially their attributes.

Model stealing is an extraction attack where an adversary queries or accesses a deployed model to reconstruct its parameters or weights, producing a functionally equivalent copy. This enables intellectual property theft and removes the need to train the model.

A black-box evasion attack occurs when the adversary can only interact with the model via queries and observe outputs, without internal access. Here, the attacker uses the public API to craft inputs that cause misclassification. This matches the scenario because the attacker lacks architecture and training data, and must rely on techniques like transferability or query-based optimization to evade the model.

Verifying digital signatures on pre-trained models confirms their origin and detects tampering before deployment, directly addressing supply chain integrity. This satisfies the stem's requirement to manage model supply chain risks by authenticating third-party artefacts, ensuring only trusted, unmodified models enter the environment.

The model's training data no longer reflects the current patient population and treatment environment, so its predictions degrade. This is classic data or concept drift: the statistical relationship between inputs and outcomes has shifted. The clinicians' observation that alerts no longer match judgment is a direct symptom. Addressing it requires monitoring, retraining, or recalibration against current data.

The gap is missing documentation of why each feature is weighted and how the model may be used. Completing the model card and recording feature rationale, intended use, and limitations restores accountability and traceability, which are prerequisites for every other risk treatment. It also makes the model's residual risk visible to the business owner before further security testing or monitoring investments are justified.

Evasion attacks manipulate inference-time inputs so the model misclassifies without altering its weights. Adding adversarial noise to input images perturbs pixel values imperceptibly to humans, causing the model to output a wrong label while the image still appears normal, which is the defining mechanism of evasion.

Attaching source system, ingestion time, and sensitivity labels to each retrieved chunk lets the system trace an answer to the documents that produced it and apply handling rules based on classification. Citations make that lineage visible to reviewers, supporting incident investigation, hallucination detection, and enforcement of access constraints on sensitive material.

The drop in sensitivity is localized, so a targeted response is appropriate. Adjusting decision thresholds at the affected site can restore sensitivity, and enhanced monitoring provides early warning of further degradation. Planning retraining with more representative data addresses the root cause. This approach treats the risk proportionally while maintaining clinical benefit where the model remains safe.

Robust statistical aggregation, such as trimmed means or median-based updates, dilutes or discards malicious contributions before they alter the shared model. This satisfies the stem's collaborative-learning constraint, where many participants submit updates and individual poisoned gradients must be neutralised.

API rate limiting constrains how many queries an attacker can submit, reducing the volume of input-output pairs harvestable for cloning a model. This directly impedes model extraction, which depends on mass querying to approximate the target's decision boundaries.

A risk inventory should capture every system whose outputs can materially affect stakeholders or operations, regardless of whether it is generative or predictive, built in-house or procured. This impact-based scope ensures governance resources are directed where harm is possible and supports regulatory reporting. It also enables dependency and concentration analysis across the AI portfolio, which is a core expectation of AI risk management.

Without a model inventory, the organisation cannot enumerate deployed or shadow AI models, so it cannot assign ownership, assess security risk, or manage them across their lifecycle. That directly satisfies the stem's constraint of identifying the most immediate risk from the missing inventory.

Quantified thresholds on named AI risk metrics can be measured continuously by automated monitoring and compared against board-approved tolerances, producing breach alerts rather than retrospective opinions. Mapping thresholds per use case respects differing criticality, and pipeline-fed dashboards let the committee see appetite utilization in near real time. This converts risk appetite from a static statement into an operational control with defined escalation triggers.

AI model transparency provides stakeholders with documented insight into a model's training data, logic, limitations and performance metrics, enabling informed evaluation of its safety and reliability. This directly satisfies the risk management framework's requirement for accountable oversight, letting decision-makers assess residual risk before deployment rather than accepting opaque outputs on trust.

Data anonymization removes or alters PII so that individuals cannot be identified, directly reducing the risk of the model memorizing and leaking sensitive information. Techniques like pseudonymization, generalization, or suppression are commonly used to prepare data for training while complying with privacy regulations.

Model signing uses cryptographic signatures to verify the integrity and authenticity of a model file. Before loading, the system checks the signature against a trusted public key; if the model was modified, the signature validation fails. This directly detects tampering and ensures only authorized models are loaded, meeting the security team's requirement.

Contractual clauses bind vendors to data privacy and IP protection obligations, giving legal enforceability that technical controls alone cannot provide. This covers the procurement policy's requirement to govern how vendor AI systems handle organisational data and intellectual property throughout the engagement.

The Map function documents context, purpose, dependencies, and affected parties. That context determines which risks are relevant and what metrics, thresholds, and tolerances are meaningful. Without it, measurement produces numbers disconnected from business impact. Sequencing Map before Measure ensures that testing and monitoring address the risks that actually matter to the model's deployment context, which is why the framework treats mapping as the prerequisite for meaningful measurement.

A CAPTCHA challenge distinguishes automated traffic from legitimate users at the request level, throttling the non-human spike while genuine clients continue unaffected. This satisfies the stem's constraint of mitigating abuse without fully blocking the service, since only suspected bots face the challenge rather than an outright deny rule.

Defined AI ethics and safety policies establish the boundaries, accountability and acceptable-use rules that govern AI systems. They satisfy the stem's requirement by providing the normative framework against which AI development, deployment and monitoring are directed and assessed within an AI governance programme.

Unauthorised access to model training weights is an AI security incident because the stolen artefact is the trained model itself, not conventional data. It compromises model confidentiality and enables adversarial misuse, distinguishing it from generic breaches that never touch AI-specific assets.

Embedding a mandatory human approval task in the orchestration layer's business logic forces execution to pause until a person authorises the action, making Human-in-the-Loop unavoidable rather than advisory. This architectural control enforces the governance requirement at runtime, independent of model behaviour or prompt design.