How should I use these AI Technologies And Controls practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just AI Technologies And Controls questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the AI Technologies And Controls domain.

AAISM · topic practice

AI Technologies And Controls practice questions

Practise ISACA Advanced in AI Security Management (AAISM) (AAISM) AI Technologies And Controls practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: AI Technologies And Controls

Practice 10 questions Browse domain →

What the exam tests

What to know about AI Technologies And Controls

AI Technologies And Controls questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common AI Technologies And Controls exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

AI Technologies And Controls questions

20 questions · select your answer, then reveal the explanation

Question 1mediummulti select

Read the full AI Technologies And Controls explanation →

Which TWO actions should be taken to enforce Least Privilege access for developers interacting with SageMaker Model Monitor?

Trap 1: Allow all 'iam:PassRole' actions

Allowing all pass-role actions is a severe security risk.

Trap 2: Assign the 'SageMakerFullAccess' managed policy

This violates the principle of least privilege as it is too broad.

Trap 3: Enable root access to the underlying EC2 instance

Model Monitor is a managed service; users do not need root access to infrastructure.

Study all AI Technologies And Controls common traps →

A
Allow all 'iam:PassRole' actions
Why wrong: Allowing all pass-role actions is a severe security risk.
B
Restrict access to the 'sagemaker:CreateModelMonitor' action
Limiting this action prevents unauthorized creation of monitoring jobs.
C
Grant s3:PutObject on the bucket containing baseline data
Baseline data access is required for monitoring jobs.
D
Assign the 'SageMakerFullAccess' managed policy
Why wrong: This violates the principle of least privilege as it is too broad.
E
Enable root access to the underlying EC2 instance
Why wrong: Model Monitor is a managed service; users do not need root access to infrastructure.

AI Technologies And Controls practice questions

What to know about AI Technologies And Controls

Common AI Technologies And Controls exam traps

AI Technologies And Controls questions

Which TWO actions should be taken to enforce Least Privilege access for developers interacting with SageMaker Model Monitor?

You are configuring AWS Bedrock Guardrails to prevent the model from returning PII. Which specific configuration setting should be enabled to ensure PII filtering is applied to both prompt and response?

You are configuring Microsoft Defender for Cloud to monitor your Azure OpenAI service. Which specific resource diagnostic setting must be enabled to ensure that prompt injection attempts are logged in the Log Analytics workspace?

During an adversarial training cycle, you notice the model's accuracy on the validation set drops significantly despite high training accuracy. Which technique should you apply to mitigate potential model poisoning?

When implementing Google Cloud's 'Vertex AI' model guardrails, you need to prevent the leakage of PII in model outputs. Which configuration tool is used to enforce these constraints at the request/response level?

You are configuring Microsoft Defender for Cloud for an Azure OpenAI deployment. To detect prompt injection attempts effectively, which specific setting must be enabled in the 'Microsoft Defender for Cloud Apps' dashboard?

An organization is using Google Cloud Vertex AI and suspects an adversarial poisoning attack on a custom training dataset. Which tool should be used to verify the integrity and provenance of the training artifacts?

You are auditing access controls for a Microsoft Azure OpenAI deployment. Which TWO of the following configurations are required to ensure identity-based access and logging for model inference?

You are managing a PyTorch model and suspect data poisoning during the training phase. Which practice is the most effective technical control to verify training data integrity in an MLOps pipeline?

To prevent unauthorized access to an Amazon Bedrock model, which AWS service is the primary point of control for enforcing 'Least Privilege' at the API layer?

When utilizing the 'Adversarial Robustness Toolbox' (ART) to defend against evasion attacks, which attack type is specifically mitigated by using 'Adversarial Training'?

Which TWO of the following are primary security controls for preventing 'Model Inversion' attacks where an adversary attempts to reconstruct training data from model outputs?

You are reviewing logs for an AI service. You notice a high frequency of '429 Too Many Requests' errors. Which security control is likely being triggered to protect the model from potential automated extraction or DoS?

Which security principle is violated when an AI model is allowed to access external data sources without sufficient authorization checks on the data itself?

Your organization uses Azure OpenAI. You need to ensure that no sensitive data (e.g., credit card numbers) is sent to the model. Which specific service feature should be enabled to intercept and mask this data?

When evaluating AI security, 'Model Drift' refers to performance degradation over time. Which tool would a practitioner use to detect drift in a production environment?

When securing an AI-driven chatbot, which THREE of the following are recommended practices to mitigate 'Prompt Injection' vulnerabilities?

In the context of AI governance, what is the primary role of a 'Model Card'?

You are implementing 'Red Teaming' for a Large Language Model (LLM). What is the main objective of this exercise?

Which technique is best suited to defend against 'Model Extraction' where an adversary queries a public API to build a clone of your proprietary model?

Track your progress over time

Start a AI Technologies And Controls only practice session

Related AAISM topic practice pages

AI Technologies And Controls practice questions

AI Governance And Program Management practice questions

AI Risk Management practice questions

AAISM fundamentals practice questions

AAISM scenario practice questions

AAISM troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid