Isaca AAISM Exam - Topic 2 Question 3 Discussion

Actual exam question for Isaca's AAISM exam

Question #: 3
Topic #: 2

Which of the following is the MOST important course of action prior to placing an in-house developed AI solution into production?

APerform a privacy, security, and compliance gap analysis

BDeploy a prototype of the solution

CObtain senior management sign-off

DPerform testing, evaluation, validation, and verification

Show Suggested Answer

Suggested Answer: D

AAISM lifecycle governance guidance specifies that before any AI solution is moved into production, it must undergo testing, evaluation, validation, and verification to ensure accuracy, resilience, security, and compliance with standards. These steps confirm that the solution performs as expected under varied conditions. Conducting gap analysis is part of compliance checks but comes earlier in design. Management sign-off provides approval but cannot substitute for assurance of technical reliability. Deploying prototypes is a testing method but not the final assurance step. The critical requirement is a complete cycle of testing, validation, and verification.

AAISM Exam Content Outline -- AI Risk Management (Lifecycle Testing and Validation)

AI Security Management Study Guide -- Production Readiness Checks

by Alfred at Oct 04, 2025, 11:50 AM

Limited Time Offer

25%

Off

Get Premium AAISM Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Julianna

22 days ago

C is vital. Without sign-off, nothing moves forward.

upvoted 0 times

...

Kaycee

27 days ago

I lean towards D. Validation is essential for trust.

upvoted 0 times

...

Gary

2 months ago

A and D together make sense. Can't risk security flaws.

upvoted 0 times

...

Alline

2 months ago

I feel like D covers everything. Testing is the foundation.

upvoted 0 times

...

Shonda

2 months ago

C is key too. Senior management needs to be on board.

upvoted 0 times

...

Daron

2 months ago

Definitely A! Compliance can't be overlooked.

upvoted 0 times

...

Filiberto

2 months ago

I agree, but A is also important for privacy issues.

upvoted 0 times

...

Earlean

2 months ago

I think D is crucial. Testing ensures it works as intended.

upvoted 0 times

...

Suzi

3 months ago

Surprised that people overlook compliance, it's so important!

upvoted 0 times

...

Geraldine

3 months ago

I think D is more crucial, testing is key!

upvoted 0 times

...

Cassie

3 months ago

Definitely A, you can't skip on privacy and security!

upvoted 0 times

...

Argelia

3 months ago

I’m leaning towards A because of the privacy concerns we talked about in class, but I can see why D could also be a strong contender.

upvoted 0 times

...

Clay

3 months ago

I feel like getting senior management sign-off (C) is essential, but I also recall discussions about the importance of thorough testing.

upvoted 0 times

...

Adelina

3 months ago

I remember a practice question that emphasized compliance issues, so I feel like A might be the right choice, but I’m torn between that and D.

upvoted 0 times

...

Shawn

4 months ago

Option C is the way to go. Gotta get the big boss to sign off on it.

upvoted 0 times

...

Tora

4 months ago

I think option D is really important because testing and validation are crucial before going live, but I’m not entirely sure if it’s the most important step.

upvoted 0 times

...

Gearldine

4 months ago

Not sure if A is the most important, what about the actual testing?

upvoted 0 times

...

Matthew

4 months ago

C is a must, management needs to be on board!

upvoted 0 times

...

Lai

5 months ago

D for sure. Don't want the AI to go all Skynet on us, right?

upvoted 0 times

...

Pamella

5 months ago

I'd say A is the way to go. Gotta cover your bases on privacy and compliance.

upvoted 0 times

...

Lou

5 months ago

Definitely go with D. Can't have an AI solution that's a hot mess in production.

upvoted 0 times

...

Diego

5 months ago

Option D is the most important. Gotta make sure that thing works before putting it out there!

upvoted 0 times

...

Lajuana

5 months ago

Hmm, I'm leaning towards the privacy, security, and compliance gap analysis. Gotta make sure we're not introducing any major risks or compliance issues before we deploy, right?

upvoted 0 times

...

Tom

6 months ago

I'd say performing the testing, evaluation, validation, and verification is the way to go. Can't just throw an untested AI solution into production, that could be a disaster waiting to happen.

upvoted 0 times

...

Buffy

6 months ago

I'm a little unsure on this one. I know testing and validation are super important, but I'm not sure if that's the most crucial step before production. Maybe getting that senior management sign-off would be the safest bet?

upvoted 0 times

...

Anissa

6 months ago

Okay, let's see. I'm thinking the privacy, security, and compliance gap analysis is probably the most important thing to do first. Gotta make sure we're not putting anything risky out there.

upvoted 0 times

...

Stefania

6 months ago

Hmm, this is a tricky one. I think I'd start by looking at the options and trying to determine the most critical step before deploying an in-house AI solution.

upvoted 0 times