ISACA Advanced in AI Security Management (AAISM) (AAISM) (AAISM) — Questions 151–225

The core risk is undisclosed or unassessed model updates by a third party. Only a contractual requirement for documented model change management, with advance notification and insurer approval for material changes, provides proactive governance over those updates. SOC 2 reports, audit clauses, and firewalls address adjacent concerns but do not give the insurer timely visibility and control over AI model changes that could alter triage outcomes.

The residual risk arises from the vendor's unspecified data-retention and retraining practices. Contractual commitments are necessary but must be validated with technical controls such as zero-retention configurations or tenant isolation. Together, they provide assurance that confidential prompts will not be incorporated into future model versions, which is the specific risk the firm needs to manage.

A regulatory obligation register mapped to each AI system and deployment location is the artifact that connects jurisdictional legal requirements to specific model instances, including local fine-tuned variants. It supports evidence of compliance, gap analysis, and change management as regulations evolve, which model cards, DPAs, and penetration tests cannot provide on their own.

A SOC 2 Type II audit report is the most essential document for third-party AI due diligence because it independently validates the provider's security, availability, and confidentiality controls over time. It provides assurance that the provider meets industry standards. The other options lack the depth and independence required for risk assessment.

Prompt injection attacks manipulate an LLM by embedding malicious instructions in user input or external data, causing the model to execute unintended actions. A secure AI Gateway with input filtering inspects and sanitizes prompts before they reach the model, blocking known injection patterns (e.g., 'ignore previous instructions') and enforcing policy. This is a preventive, architectural control that directly addresses the attack vector, unlike the other options which are either irrelevant or impractical.

Durable AI governance accountability comes from a chartered, cross-functional body with an executive sponsor, documented decision rights, and a reporting cadence to the board. This structure ensures every AI risk domain has an accountable owner and that trade-offs are adjudicated rather than defaulting to one function. Policies and attestations are supporting artifacts, not substitutes for governance infrastructure, and decentralized self-governance fragments accountability.

An AI risk register with periodic reviews and automated fairness metrics creates a continuous feedback loop that detects regional bias as it emerges. It assigns ownership, tracks mitigation, and escalates when thresholds are breached. This lifecycle approach is more effective than one-time assessments or formal attestations, which do not provide ongoing detection or correction of bias in route optimization.

The scenario describes a model exhibiting disparate impact despite removal of sensitive attributes, indicating bias through proxy features. Fairness-aware machine learning techniques like adversarial debiasing or reweighting are designed to mitigate such bias by adjusting the training process. Other options like SHAP values help detect bias but do not mitigate it, while differential privacy and watermarking are unrelated to fairness.

A bias audit's primary objective is to identify disparate impacts on protected populations — that is, to measure whether the model produces systematically different outcomes for groups defined by race, gender, age, or other protected attributes. It uses fairness metrics such as demographic parity, equalized odds, and disparate impact ratio to surface such disparities. This is a fairness and non-discrimination control, not a storage, cost, or performance exercise.

Validating the model hash against the vendor's checksum manifest is correct because it cryptographically verifies that the artifact received matches the artifact the vendor published, detecting tampering or substitution during download and integration. Model poisoning often occurs when an attacker swaps or modifies weights in transit or in the hub; a hash check catches any byte-level change. This is an integrity control applied at the point of ingestion, which is exactly where supply-chain poisoning is introduced.

The governance board's most critical responsibilities are setting the AI risk appetite and ensuring AI risk management is integrated into enterprise risk management. These activities provide strategic direction and embed AI risk oversight into the broader organizational risk framework, which are essential for effective governance. Technical and operational tasks are delegated to management and staff.

The audit gap is the absence of post-deployment risk monitoring. A periodic re-validation and reassessment process, scheduled and event-triggered, ensures that models are continually evaluated against performance, data drift, and regulatory changes. This control provides the necessary oversight to maintain risk management throughout the AI lifecycle and satisfies the auditors' concern about ongoing risk identification.

Training data source and provenance is the metadata attribute most directly tied to legal and regulatory risk because it determines data rights, consent, licensing, copyright exposure, and privacy obligations. Regulators need to know where data came from, whether it was lawfully obtained, and whether it contains personal or protected information. Without provenance, an organization cannot demonstrate compliance with GDPR, CCPA, or IP law.

Adversarial Training is a defense specifically designed to mitigate evasion attacks by augmenting the training set with adversarial examples so the model learns to classify perturbed inputs correctly. The Adversarial Robustness Toolbox (ART) implements this defense to improve robustness against evasion, where an attacker crafts inputs at inference time to cause misclassification. It does not directly address model inversion, model theft, or supply chain attacks.

A Model Evaluation Report documents how a third-party AI model was tested for accuracy, robustness, bias, fairness, and behavior under edge cases, directly addressing the risk that the model is unsuitable for the intended use case or behaves unexpectedly in production. It provides evidence that the model's performance and limitations are understood before deployment, which is the core purpose of model evaluation in AI risk management.

Runtime guardrails that inspect prompts and completions, combined with strict separation of system instructions from untrusted user content, directly counter instruction-override and context-leakage attempts. The other controls address unrelated concerns such as output randomness, training-data privacy, or user authentication, none of which stop an attacker from manipulating the model's instruction hierarchy during inference.

The first step in managing any AI risk is to identify and analyze it with evidence. Comparing the training data distribution against the target deployment population is the analytical activity that reveals whether and how much the model's inputs will differ, which is the root cause of performance degradation. Only after that quantification can the committee rationally choose among mitigations such as retraining, local validation, or restricting use.

Two characteristics genuinely distinguish AI risk from traditional IT risk: emergent behavior that defies component-level prediction, and continuous change that invalidates point-in-time assessments. Together they justify ongoing monitoring, staged deployment, red-teaming, and version governance. The other characteristics either describe similarities, restate legal misconceptions, or falsely claim determinism, none of which belong in a defensible AI risk taxonomy.

HITL should be applied proportionally to risk, so the policy must mandate human review specifically for high-impact or sensitive decisions such as credit, hiring, medical, or legal outcomes. Requiring HITL for every inference is operationally impossible at scale and defeats the purpose of automation. The correct answer reflects a risk-based governance approach where oversight intensity matches the potential harm of the AI decision.

Human-in-the-Loop (HITL) means a human reviews, approves, or overrides model outputs before they take effect, which is a direct risk control for high-stakes decisions. Requiring human approval for high-risk model outputs ensures accountability and catches errors, bias, or unsafe recommendations before harm occurs. This is a core control in AI risk management frameworks for high-impact use cases.

Model versioning creates an immutable record of each model iteration — weights, hyperparameters, training data snapshot, and code — so that any deployed model can be reproduced exactly and rolled back if it misbehaves. In AI governance, this supports auditability, incident response, and regulatory compliance by providing traceability from prediction back to the exact model artifact. Without versioning, a problematic model cannot be reliably reverted or investigated.

Indirect prompt injection occurs when an LLM-based agent retrieves external content (web pages, documents, emails, tool outputs) that contains hidden instructions, and those instructions are interpreted by the model as if they came from the system or user. The attacker does not need direct access to the prompt — they poison the data the agent will later ingest. This can cause the agent to exfiltrate data, call tools with malicious parameters, or ignore its original system prompt.

The percentage of AI models that have completed formal governance and security certification is the most direct indicator of program maturity because it measures how much of the AI estate has been subjected to structured review. It reflects both coverage (how many models are in scope) and rigor (whether they passed certification). Board-level reporting needs this kind of governance coverage metric, not operational telemetry.

Attacks that place crafted data into the training pipeline to influence what the model learns are poisoning attacks, and the multi-cycle, boundary-shifting nature described here is their signature. Evasion acts only at inference against a fixed model, model inversion extracts information rather than injecting it, and prompt injection applies to instruction-following generative systems, so none matches the described manipulation of training data.

Reproducing a model requires more than the trained artifact: you need the lineage that connects the artifact to the data snapshot, code commit, hyperparameters, and environment used to produce it. A versioning practice that records all of those elements enables retraining or reloading the identical model. Artifact-only storage, access logging, and committing the binary to Git each capture only part of the picture.

Membership inference testing is designed to quantify whether an adversary can infer that a specific record was used in training, which is exactly the memorization risk described. The other techniques address explainability, adversarial robustness, or operational drift, none of which measure privacy leakage from training data.

The EU AI Act classifies certain AI systems as 'High-Risk' (e.g., in critical infrastructure, employment, education, or law enforcement) and imposes mandatory requirements including human oversight, risk management, technical documentation, logging/traceability, and transparency. Human-in-the-loop design combined with logging ensures that a human can interpret outputs, intervene, and that decisions are auditable — directly satisfying the transparency and oversight obligations under Articles 13-14.

The primary focus should be all AI systems across the organization, both internal and third-party, to ensure comprehensive risk management and consistent governance. Narrowing scope to customer-facing, internally developed, or PII-only systems creates blind spots and fails to address the full spectrum of AI risks.

Translating AI risk appetite into practice requires quantified tolerance thresholds tied to use-case tiers with escalation paths, plus a mapping of each risk category to an accountable owner and required control evidence. These two elements make appetite measurable, assignable, and auditable. Uniform review, sentiment surveys, and zero-tolerance declarations do not produce measurable limits or ownership and therefore cannot operationalize an appetite statement.

When ground truth labels are delayed, monitoring input feature distributions and prediction score distributions against a baseline is the most practical way to detect concept drift. Statistical metrics like PSI can signal when the data or model behavior deviates from the training distribution, prompting investigation or retraining. This approach is proactive and does not depend on immediate labels.

A governance committee's essential authorities are approving high-risk use cases against defined criteria and resolving escalated risk issues with documented decisions. These responsibilities ensure accountability, consistency with risk appetite, and auditability. Implementation, daily monitoring, and contract negotiation are execution activities that belong to engineering, operations, and procurement, and assigning them to the committee would undermine its oversight independence.

Data encryption at rest protects AI datasets by rendering stored data unreadable without the correct cryptographic keys, preventing unauthorized parties who gain access to storage media (stolen disks, misconfigured buckets, compromised backups) from reading the data. It is a confidentiality control, not a performance, detection, or patching mechanism.

Amazon SageMaker Model Monitor is purpose-built to detect data drift, model quality drift, bias drift, and feature attribution drift in production endpoints. It captures inference data, compares it against baselines, and emits CloudWatch alarms when drift exceeds thresholds. This directly addresses the need to detect performance degradation over time in a deployed model.

The AI Governance Charter is the foundational document that defines the governance structure for AI, including who owns what — the roles and responsibilities of the AI governance board, model owners, data stewards, security teams, and business units. It establishes accountability, decision rights, and escalation paths. This makes it the authoritative source for 'Roles and Responsibilities' in AI security.

The Corporate AI Policy is the governing document that defines the organization's principles, commitments, and requirements for AI transparency and explainability. It establishes the official stance that all AI systems must be documented, explainable to relevant stakeholders, and subject to disclosure rules. Other documents listed are either operational artifacts or external marketing materials that do not carry governance authority.

Strict egress (outbound) traffic rules control what data can leave the AI environment, directly preventing unauthorized exfiltration of training data or model artifacts. By defaulting to deny and allowing only approved destinations, ports, and protocols, you block covert channels an attacker might use to send stolen data out. This is the highest-priority firewall control for data exfiltration prevention.

Effective human oversight requires that the reviewer has enough information to evaluate the recommendation and that their disagreement produces a usable signal. Presenting rationale and uncertainty supports informed judgment, while capturing override reasons converts clinical disagreement into evidence that feeds model review. Together these choices create an oversight control that is both substantive at the point of care and useful for ongoing risk management, rather than a procedural formality.

The most effective control to mitigate the risk of vulnerable code from an LLM is to implement SAST that scans generated code before it is committed. SAST provides a deterministic, rule-based check that can catch known vulnerabilities, acting as a critical safety net. While fine-tuning, prompt engineering, and curated libraries can help, they are not foolproof and do not provide the same level of assurance as automated scanning.

The bottleneck stems from a single-tier approval model in which all AI pilots, regardless of risk, route through the central committee. Delegating low-risk approvals to trained business-unit champions using pre-approved patterns keeps the central committee as the owner of the risk framework and the approver of high-risk or novel cases, while materially reducing cycle time for routine pilots. This is a governance design change rather than a capacity or oversight removal.

When an organization consumes a third-party model, its risk posture depends on the provider's change management practices. Silent weight updates invalidate prior validation, testing, and regulatory attestations. The most direct control failure is the absence of supply chain transparency: contracts must require advance notice of material model changes, and technical measures such as version pinning or pinned endpoints must ensure the organization can detect and revalidate changes before they affect production.

Model testing and evaluation is the phase where bias metrics (e.g., disparate impact, equal opportunity difference) are computed against validation and test datasets across protected groups. This is where the model's actual behavior is measured and compared to fairness thresholds before deployment. Bias detection requires empirical evaluation of outputs, making testing/evaluation the critical phase.

A Model Validation report provides independent verification that a model performs as intended and that its risks are adequately mitigated. It is produced by a party separate from the model developers (the 'three lines of defense' model places validation in the second line) and covers conceptual soundness, data quality, performance testing, and ongoing monitoring plans. Its purpose is to give governance bodies and regulators assurance that the model is fit for purpose and that identified risks are controlled.

Aligning model risk with enterprise risk management requires expressing exposure in terms of impact, likelihood, and control effectiveness. That structure allows the board to compare model risk against other enterprise risks and to prioritize oversight where potential financial loss is greatest. Inventory and vulnerability counts alone do not convey that exposure.

Vertex AI ML Metadata tracks the lineage, provenance, and integrity of training artifacts, including datasets, models, and pipelines. It records metadata such as artifact versions, parameters, and execution details, enabling verification of whether a dataset was tampered with. This makes it the correct tool for investigating adversarial poisoning.

The primary focus of a Data Governance review in an AI audit is to ensure that the data used for training, validation, and inference is reliable, traceable, and properly protected. Data quality ensures the model's outputs are accurate and unbiased; lineage provides an audit trail from source to model; and access controls enforce security and privacy. These elements are foundational to trustworthy AI systems and are explicitly covered in governance frameworks like the NIST AI RMF and ISO/IEC 42001.

Isolating the model endpoint from the network (C) is the containment step that stops an active incident from spreading, exfiltrating data, or continuing to serve manipulated outputs. In incident response, containment always precedes eradication, recovery, or any retraining activity, because you cannot safely investigate or remediate a system that is still reachable and live. Cutting network access preserves forensic state while halting ongoing harm.

When a vendor will not disclose training data and source code is unavailable, the organization must monitor observable behavior. Scoring outputs for issuer sentiment drift against a frozen baseline creates a measurable, repeatable signal that can be automated and escalated. This satisfies the regulator's expectation of ongoing detection while respecting the vendor's opacity, and it keeps accountability with the firm's own AI risk owner.

The F1 score is the harmonic mean of precision and recall, providing a single metric that balances false positives and false negatives. From a risk management perspective, it helps assess whether a model is over-flagging (low precision) or missing critical cases (low recall), which directly maps to operational and compliance risk.

Adversarial debiasing is designed to reduce bias by training an adversary to predict the protected attribute and penalizing the model if it can. This directly mitigates discrimination. Data augmentation, pruning, and cross-validation do not specifically address fairness concerns.

Data drift means the statistical properties of production inputs have shifted away from the training distribution, so the first risk-assessment step is to quantify that shift. Analyzing the statistical distribution of production data versus training data (B) confirms whether drift is real, identifies which features drifted, and informs whether retraining, feature engineering, or monitoring changes are warranted. Acting before this analysis risks unnecessary or harmful interventions.

For a multi-jurisdiction AI deployment, the most critical vendor risk factor is how the vendor handles data across borders and whether it can comply with the data protection laws of every country where the manufacturer operates. Model transparency provisions ensure the manufacturer can meet its own governance obligations. Together these determine the manufacturer's legal exposure and ability to maintain the AI system in production.

Data privacy focuses on protecting personally identifiable information (PII) throughout collection, processing, and storage, addressing legal and ethical obligations to individuals. Model security, by contrast, focuses on protecting the integrity, availability, and behavior of the AI model itself—against tampering, poisoning, evasion, or theft. The key risk difference is the asset protected: personal data versus the model as a system artifact.

A Model Card is a structured document that discloses a model's intended use, training data, performance metrics, limitations, and ethical considerations, providing transparency to stakeholders. Its primary governance role is to communicate what the model can and cannot do so that consumers, auditors, and risk teams can make informed decisions. This transparency function is the defining purpose of model cards in AI governance frameworks.

Model signing uses cryptographic signatures (typically via PKI or keyless frameworks like Sigstore) to bind a model artifact to a verified identity, providing both integrity — proving the weights were not altered after signing — and non-repudiation, since only the holder of the private key could have produced the signature. This lets downstream consumers verify provenance before deployment, which is essential for supply chain trust in MLOps.

Bias is managed through continuous governance: regular fairness audits detect drift and disparate impact, while dataset balancing (resampling, reweighting, augmentation) addresses representation gaps at the source. Together they form a repeatable, measurable control loop rather than a one-time fix.

The governance team should require a risk assessment tailored to the specific use case and data flows. This ensures that risks unique to the integration—such as data privacy, model bias, and output accuracy—are evaluated and managed. It upholds the governance policy while allowing the business to proceed responsibly, balancing innovation with oversight.

The scenario highlights the need for trust and explainability in a healthcare AI system. Interpretability techniques like LIME and SHAP provide local explanations for predictions, enabling radiologists to understand and validate the model's outputs. Other controls such as encryption, federated learning, or rate limiting address different concerns (security, privacy, availability) and do not fulfill the requirement for explainable predictions.

Human-in-the-loop (HITL) in AI risk management ensures that a human reviews, approves, or overrides critical model decisions, providing oversight and accountability. This is essential for high-stakes domains such as healthcare, finance, and autonomous systems, where erroneous AI outputs can cause harm. HITL mitigates risks like bias, hallucination, and opaque decision-making by inserting human judgment at key decision points.

Board reporting should demonstrate control effectiveness against risk appetite, not just activity volume. Metrics such as impact assessment completion for high-risk systems, aging of high-severity findings, and incident trends by severity reveal whether controls are working and where exposure remains. They allow the board to challenge management, allocate attention, and confirm that AI risk is being managed rather than merely monitored.

Ongoing model risk monitoring should track both input distributions and outcome performance. Feature drift against the training baseline reveals that production conditions have changed, while accuracy and false dispatch rates show whether the model still performs as validated. Code volume, team tenure, and latency are operational or organizational metrics that do not by themselves indicate a material change in model risk.

Adversarial training with perturbed samples directly hardens the model against pixel perturbation (adversarial) attacks by exposing it to the same class of manipulated inputs during training, forcing the model to learn robust decision boundaries. This is the standard defensive technique for evasion attacks against ML models, including facial recognition systems. It addresses the root cause — model sensitivity to small input perturbations — rather than the data pipeline or output.

An AI Firewall or LLM Gateway sits between users/applications and the underlying model, acting as an inline policy enforcement point that inspects, filters, and sometimes transforms prompts and responses. Its core purpose is to intercept traffic to block prompt injection, jailbreaks, data leakage, toxic content, and policy violations before they reach the model or the end user.

Prompt Shield is the Azure AI Content Safety feature specifically designed to detect and block prompt injection and jailbreak attempts, including both user prompt attacks and indirect attacks embedded in documents. Enabling it applies a dedicated detection model that flags adversarial prompts before they reach the underlying LLM. This is the only option that directly addresses jailbreak and prompt injection mitigation.