ISACA Advanced in AI Security Management (AAISM) (AAISM) (AAISM) — Questions 226–300

AI governance compliance must cover external legal and regulatory obligations, such as data protection law, sector rules and emerging AI-specific statutes. Addressing this satisfies the stem's requirement that compliance spans both mandatory external requirements and internal policy adherence.

This is correct because risk appetite becomes enforceable only when translated into tiers with specific controls, approvers, and review frequency. The board approves the tolerance levels; management applies the corresponding controls. This structure lets auditors test whether a high-impact AI system received the required approvals and monitoring, converting an abstract appetite statement into operational requirements.

Hosting the LLM on an inference server inside the organization's virtual private cloud keeps all document data within the network boundary. The model processes inputs locally, and no data is sent to external services. This directly satisfies the requirement that confidential documents never leave the organization's network.

Embedding an imperceptible watermark into model outputs lets governance teams trace which model produced given content, satisfying the provenance and accountability requirement. This enables detection of synthetic media and supports audit, misuse investigation and compliance verification across deployed AI systems.

Strict output filtering and instruction separation directly counter prompt leaking by isolating system instructions from user-supplied content, so injected queries cannot extract the underlying prompt. This satisfies the scenario's core constraint: preventing disclosure of confidential system prompts through crafted inputs, rather than merely detecting leakage after exposure.

This is correct because a standard converts high-level principles into mandatory, repeatable criteria that business units can apply when evaluating AI vendors. It specifies what evidence suppliers must provide, such as model documentation, security testing, and data handling terms, and where approvals are required. This bridges the gap between board-level principles and operational procurement decisions without requiring the board to define technical criteria.

Dependency confusion exploits package managers that resolve names from public registries before private ones. An attacker publishes a public package matching an internal dependency name, so the build system fetches the malicious version instead of the intended private package.

Privacy risk hinges on knowing what personal data exists, where it flows, and why it is processed. Mapping data lineage, sensitivity classification, and processing purpose exposes lawful-basis gaps, retention issues, and unauthorised secondary use that other AIA domains cannot surface.

Extraction attacks often involve systematic querying to reconstruct training data. By monitoring for repeated, structured, or high-volume queries that target specific information, security teams can detect and alert on potential extraction attempts. This behavioral analysis is effective because it focuses on the attacker's methodology rather than the content of individual prompts.

Sanitising and filtering training inputs removes adversarial or corrupted samples before they enter the training pipeline, preventing attackers from embedding malicious patterns into the model. This directly addresses model poisoning by ensuring only trusted, validated data shapes the learned parameters.

FactSheets in IBM watsonx.ai is the governance artefact that records model lineage, training data, and audit metadata, providing the traceability the stem requires. It is the primary mechanism for tracking model provenance and supporting auditability across the AI lifecycle.

Rate limiting and query throttling reduce the volume of queries an attacker can make, making it harder to gather enough data to replicate the model. By limiting the number of calls, the attacker cannot efficiently map the model's decision boundaries. This control directly increases the cost and time required for a successful extraction attack.

429 responses are the HTTP status returned when a throttling policy rejects excess calls. API rate limiting caps request volume per client or key, directly constraining the automated query rates that model extraction and denial-of-service attempts depend on.

This reflects ISACA's core principle that risk treatment options must be presented to decision makers with full information. The risk manager's role is to quantify the gap, propose mitigation alternatives, and ensure the decision is documented. A time-bound exception with compensating controls keeps the system operational while remediation proceeds, and board documentation creates accountability.

Diagnostic settings stream inference request and response logs from the Azure OpenAI resource to a Log Analytics workspace, satisfying the logging half of the requirement. Without this routing, audit records of model inference remain unavailable for review, so identity-based access alone cannot be evidenced.

AI incidents demand coordinated escalation between technical responders who understand model behaviour and legal teams assessing liability, disclosure and regulatory duties. Naming both as critical components satisfies the stem's requirement for cross-functional communication channels, since data scientists diagnose model failures while legal teams govern breach notification and compliance obligations.

The Govern function centres on establishing organisational structures, so defining roles, responsibilities and accountability directly satisfies the stem's governance-framework requirement. This assigns ownership of generative AI outcomes, distinguishing Govern from Map, Measure and Manage, which address context, evaluation and treatment rather than oversight structures.

Ultimate accountability for AI governance rests with the board and executive leadership because they set risk appetite, approve strategy, and are answerable to stakeholders and regulators. While operational responsibility is delegated to management, the governing body cannot delegate its accountability. This aligns with ISACA's principle that AI governance is an extension of enterprise governance, requiring top-level ownership.

Model Monitoring continuously tracks live inference data against training baselines, surfacing data drift, concept drift, performance decay and anomalous inputs. This satisfies the stem's risk-management goal by providing early warning of degrading model behaviour, enabling timely retraining, rollback or escalation before business impact accumulates.

Model stealing reconstructs a proprietary model by systematically querying its inference API and training a substitute on the returned outputs, exfiltrating intellectual property without direct access. It is a security incident because it breaches confidentiality of the model and enables further attacks such as evasion.

An enterprise GRC platform with AI capabilities holds an inventory of AI models and use cases with owners and risk ratings, maps controls to frameworks such as the NIST AI RMF, ISO/IEC 42001 and the EU AI Act, stores assessments and test evidence, tracks issues, and reports to management and auditors, all with access control and audit trails. That single system of record is what centralised oversight requires.

Input distribution drift monitoring detects when live patient data diverges from the training distribution, which can degrade model performance and introduce new clinical risks. This provides continuous, ongoing visibility into a key risk driver after deployment, making it a core post-deployment risk management activity for the triage system.

Model drift often occurs when the input data distribution shifts from the training data. Monitoring input data distributions helps detect covariate shift, a common cause of performance degradation. This is a critical element because it provides early warning of drift, allowing the organization to retrain or adjust the model before decisions become unreliable, thereby maintaining supply chain efficiency.

Git-based tracking captures every change to model configuration and training code, giving an auditable revision history. This satisfies the risk-management requirement for traceable, reproducible model versions, enabling rollback and forensic review when a deployed model drifts or misbehaves.

Containment and impact assessment comes first because it limits blast radius and establishes scope before eradication or recovery. Assessing affected models, data and downstream systems lets responders prioritise, preserve forensic evidence and decide whether to roll back or isolate, satisfying the stem's requirement for the initial incident response step.

Ingesting model inference logs into a SIEM satisfies the requirement for continuous detection across cloud AI workloads. Inference logs capture prompts, outputs and anomaly signals, which the SIEM correlates against threat intelligence and behavioural baselines, enabling real-time alerting on prompt injection, data exfiltration or model abuse that standalone model tooling would miss.

Data provenance records the origin, lineage and handling of training data, letting you verify its source and integrity. This exposes tampered, poisoned or unlicensed datasets, which is why provenance is critical before and during model training.

IAM governs authentication and authorisation, binding identities to roles and policies that determine which cloud resources and AI services each principal may access. This directly fulfils the primary function of controlling who can reach what, which is the defining scope of identity and access management.

This directly satisfies the General Counsel's requirement: the charter names the executive body that owns AI outcomes and documents that assignment at board level. Assigning ultimate ownership to a defined executive body is the core of accountability in AI governance and ensures regulatory and legal consequences have a clear owner rather than diffusing across teams.

AWS Security Groups are stateful virtual firewalls attached to ECS tasks, allowing rules that permit traffic only from the specific microservices' security groups. This enforces least-privilege network access, restricting the model to authorised callers rather than the whole VPC.

RAG provides a source of truth for the model to reference.

Input sanitisation strips or escapes characters and instruction-like patterns in user text before it reaches the model, reducing the chance that injected directives are interpreted as system commands. It addresses the prompt injection vector at the entry point, complementing output filtering and least-privilege tool access.

Adding data from a newly acquired subsidiary changed the training data distribution without changing the model code, producing culturally insensitive recommendations. This illustrates how data supply chain changes cause model drift that introduces new ethical and reputational risks, requiring risk management to monitor data provenance and pipeline changes.

Opacus is a library built specifically for PyTorch that implements differentially private stochastic gradient descent, clipping per-sample gradients and adding calibrated noise during training. It integrates directly with PyTorch optimisers, satisfying the requirement without altering the model architecture.

Pre-deployment design and threat modeling identify AI-specific risks such as data poisoning, model inversion and prompt injection before release, when remediation is cheapest. This manages lifecycle risk at the earliest stage, satisfying the stem's requirement for activities spanning the AI lifecycle.

Data quality for AI training is measured across accuracy, completeness and consistency, since these dimensions jointly determine whether training data faithfully represents the target domain. Tracking them detects bias, missing values and conflicting records that would otherwise degrade model reliability and fairness.

Risk tiering should reflect both data sensitivity and the severity of harm if the output is wrong or leaked. Live client portfolio data is confidential, and inaccurate personalized advice can cause financial and regulatory harm even without trade execution. Impact-based classification captures these dimensions, whereas technical capability alone understates the risk.

Adversarial training augments the training set with perturbed inputs labelled with their true classes, so the model learns decision boundaries robust to evasion perturbations. This directly reduces the attacker's ability to craft inputs that flip predictions.

Logging records inputs, outputs, decisions and system events, creating an audit trail that supports incident investigation, forensic reconstruction and accountability. This traceability lets investigators determine what an AI system did, when, and on what basis.

Poisoned training data corrupts the learned parameters themselves, so the model's outputs become unreliable or attacker-influenced. This directly undermines model integrity and reliability, the governance concern the stem asks about, rather than merely exposing data or disrupting availability.

SageMaker Model Monitor data quality monitoring compares live inference feature distributions against a baseline captured from training data and raises violations on statistical drift, even when schema and data types remain valid. That is exactly the silent-shift condition described here, so it detects the problem before degraded claim decisions accumulate.

A federated model with accountable subsidiary owners applies central criteria locally while feeding a single enterprise inventory. This preserves local knowledge and speed, ensures consistent risk assessment standards, and gives the central office visibility across all regions. It directly addresses registration, assessment, and monitoring consistency without centralizing every decision.

Removing personally identifiable information and poisoned or malicious samples from the training corpus directly satisfies the sanitisation objective: it prevents privacy breaches and adversarial manipulation before the model learns. This preprocessing step ensures regulatory compliance and model integrity, distinguishing sanitisation from later controls such as access management in Microsoft Entra ID or runtime filtering.

Poisoned training data corrupts the learned parameters, so the model fails to converge normally, producing erratic loss curves or unstable accuracy across epochs. Inconsistent convergence during training is therefore a recognised indicator that the training set has been manipulated.

Public hub artefacts are opaque binaries, so a poisoned checkpoint or serialised payload can embed a backdoor or execute malicious code when loaded. Without verification of provenance and integrity, that hidden behaviour is inherited by any system deploying the model.

Continuous monitoring with fairness metrics allows the organization to detect bias as it arises in production. A defined mitigation workflow ensures that when bias is detected, corrective actions are taken promptly. This approach addresses the dynamic nature of bias and provides an ongoing control that aligns with the governance team's objective.

An explicit prohibition on entering confidential, personal, or proprietary data into public generative AI tools directly targets the data leakage risk. It sets a clear boundary that employees can follow and that can be enforced through monitoring and disciplinary measures. This policy element is the most direct because it removes the action that causes exposure in the first place.

Insecure output handling occurs when model-generated text is passed downstream without scrutiny, enabling injection or script execution. Enforcing strict output validation and sanitisation treats model output as untrusted input, encoding or rejecting dangerous content before it reaches browsers, shells or databases, directly satisfying that control objective.

Mandatory disclosure that content was generated by AI ensures transparency for consumers and supports accountability obligations under data protection regulations, which require lawful, fair and transparent processing. It also helps prevent deceptive marketing claims about authorship.

Containment isolates the affected AI model, stopping it from producing further harmful outputs or propagating errors while the incident is investigated. This limits blast radius, a core incident response step that preserves evidence and prevents ongoing damage before eradication and recovery begin.

The programme builds workforce competence around AI-specific threats such as prompt injection, data leakage and model misuse, so staff recognise and avoid unsafe behaviour. It satisfies the goal of reducing human-originated AI risk through awareness rather than technical controls.

Model validation and testing reports evidence that a model was independently assessed against defined acceptance criteria before deployment, capturing methodology, datasets, results and sign-off. This satisfies the audit trail's need to demonstrate documented, verifiable oversight of model performance and fitness for purpose, rather than relying on unsubstantiated assertions.

Isolated environments confine each pipeline stage, so a compromised dependency or poisoned artefact cannot laterally reach training data, credentials, or production models. This directly satisfies the stem's supply chain constraint by limiting blast radius across the MLOps workflow, preventing one tainted component from corrupting downstream stages.

Digital signatures verify both integrity and origin by encrypting a hash of the model file with a private key, which recipients validate using the corresponding public key. This satisfies the stem's authenticity requirement, confirming the file genuinely originated from the trusted signer and was not altered while stored in the S3 bucket.

Membership inference exploits a model's confidence differences to decide whether a particular record belonged to its training data. That privacy violation is distinct from reconstructing features or fooling predictions, and underpins regulations such as GDPR.

Attackers performing boundary reconnaissance submit many slightly perturbed inputs and observe confidence changes to map decision boundaries. This produces clustered low-confidence outputs and structured query patterns that differ from normal user traffic. Monitoring for these signals can reveal pre-attack probing before an evasion attempt is launched.

Accountability cannot be delegated to the AI system or its developers; the business unit leader owns the deployed system's outcomes and bears responsibility for its risk decisions. This satisfies the stem's demand for ultimate, non-transferable ownership within the deploying unit.

Differential privacy bounds how much any individual training record can influence the learned parameters, which directly limits verbatim regurgitation of patient text. Tracking the privacy budget quantifies cumulative leakage across training runs, so the hospital can demonstrate that the memorization risk was constrained by design rather than assumed away by de-identification alone.

Epsilon quantifies the privacy budget: lower values add more noise, strengthening indistinguishability but degrading model accuracy. Raising epsilon improves utility while weakening the privacy guarantee. The developer must therefore balance how much privacy loss is acceptable against the predictive performance the model must retain.

Model cards document a model's intended use, training data, performance metrics and known limitations. Reviewing them during vendor assessment verifies the transparency and disclosure the stem demands, exposing bias, provenance and evaluation gaps before procurement, rather than relying solely on the vendor's marketing claims.

Model weights are the exfiltration target, so restricting who can read those files removes the primary attack path. Strict IAM policies on the weight storage enforce least privilege, preventing unauthorised principals from copying or downloading the model artefacts directly.

Data provenance tracking records the source, lineage, and transformations of training data, allowing verification that data has not been tampered with. This helps detect unauthorized modifications or poisoned data before it affects the model. It is a proactive control that provides auditability and traceability, essential for detecting data poisoning attempts in sensitive applications like healthcare.

Governance must begin by defining the organisation's fairness and equity metrics, because bias cannot be measured, monitored or mitigated without agreed criteria. These metrics establish the baseline against which datasets, models and outcomes are assessed for disparate impact.

Classifying by potential impact on safety, privacy and business operations ties governance controls to actual risk exposure, so oversight, testing and documentation scale with the harm a system could cause. This risk-based axis drives proportionate treatment across the AI inventory.

Model documentation capturing features, decision logic, and known limitations provides the traceable basis for explaining why the triage tool produced a recommendation. It supports clinician understanding and regulatory review by making the model's behavior inspectable, which directly satisfies the governance committee's explainability requirement.

Shadow AI covers unsanctioned AI tools used outside governance, so data entered into those services leaves organisational control, creating unmonitored leakage and regulatory compliance exposure. This is the primary risk because no oversight, logging or data-handling controls apply to the unsanctioned usage.

Post-hoc explanation tools, such as SHAP or LIME, provide insights into which features influenced a specific AI decision. This helps clinicians and patients understand the rationale behind recommendations, fostering trust and enabling informed decisions. It directly addresses explainability, a key ethical principle, by making the AI's reasoning transparent without requiring access to the model's internal workings.

Logging model development and decision-making creates an auditable record, which is the mechanism that satisfies Accountability. It assigns and evidences responsibility for the LLM's behaviour, letting the company trace who decided what and why, rather than merely documenting data lineage or performance metrics.

Standardising workflows for human intervention ensures reviewers receive consistent context, escalation paths and response steps, so oversight is repeatable rather than ad hoc. This directly supports Human-in-the-Loop governance by making intervention a defined, auditable process across AI systems.

Adversarial debiasing trains the model to perform the primary task while simultaneously minimizing an adversary's ability to predict the protected attribute from the model's outputs. This directly reduces disparate impact and aligns with ISACA's emphasis on fairness and ethical AI. It is a proactive control applied during model development, addressing bias without simply discarding features.

A defined AI risk appetite statement with quantified thresholds gives the organization an objective basis for deciding when a risk must be escalated to the board. Without agreed tolerances, escalation becomes subjective and inconsistent. It is the foundational element that makes the escalation mechanism meaningful and actionable for governance bodies.

Deploying a base model to a public endpoint requires creating that endpoint, so `aiplatform.endpoints.create` is the permission that directly gates the action. Without it, unauthorised users cannot provision the endpoint at all, satisfying the policy constraint of preventing public deployment. Note that Microsoft Entra ID governs Azure, not Vertex AI.

A governance body with clear decision rights is what turns policy into action: it approves AI use cases, grants exceptions, and oversees adherence. Assigning these rights prevents diffuse ownership and ensures escalations and disputes have a forum empowered to decide, which is essential for consistency across business units.

This directly addresses the failure: the rating was treated as static, so drift and emergent bias went undetected. By defining triggers for re-evaluation and feeding refreshed inherent and residual ratings back into the enterprise register, the committee retains its ranking and budgeting capability while making risk ratings living artifacts rather than one-time deployment snapshots.

Federating the scientist's identity into the training platform and exchanging it for short-lived, scoped tokens removes standing secrets from notebooks and preserves per-user attribution in access logs. Each job carries the originating user's identity, so auditors can trace exactly who read which features, and tokens expire quickly enough to limit the value of any intercepted credential.