Free Preparation Discussions
MENU
Isaca AAISM Exam Questions
- Topic 1: AI Governance and Program Management: This section of the exam measures the abilities of AI Security Governance Professionals and focuses on advising stakeholders in implementing AI security through governance frameworks, policy creation, data lifecycle management, program development, and incident response protocols.
- Topic 2: AI Risk Management: This section of the exam measures the skills of AI Risk Managers and covers assessing enterprise threats, vulnerabilities, and supply chain risk associated with AI adoption, including risk treatment plans and vendor oversight.
- Topic 3: AI Technologies and Controls: This section of the exam measures the expertise of AI Security Architects and assesses knowledge in designing secure AI architecture and controls. It addresses privacy, ethical, and trust concerns, data management controls, monitoring mechanisms, and security control implementation tailored to AI systems.
Free Isaca AAISM Exam Actual Questions
Note: Premium Questions for AAISM were last updated On May. 27, 2026 (see below)
An organization deploying an LLM is concerned input manipulations could compromise security. What is the MOST effective way to determine an acceptable risk threshold?
AAISM instructs that acceptable risk thresholds must be determined using business impact analysis. This aligns with the broader enterprise risk management principle of defining tolerances based on:
* potential harm
* regulatory exposure
* financial impact
* operational disruption
Monitoring (A) detects attacks but does not set thresholds. Blocking special characters (B) is unrealistic and overly restrictive. Static thresholds (D) ignore business context and practicality.
============================================
Which of the following is MOST important to ensure security throughout the AI data life cycle?
AAISM emphasizes data lineage, provenance tracking, and inventory completeness as essential controls to ensure data security and accountability across all AI data life-cycle phases. This enables detection of unauthorized modifications, improper use, and compliance violations.
Periodic reviews (B) are necessary but insufficient without lineage. Restricting third-party use (C) is one control but not comprehensive. Open-source model choice (A) does not secure data.
=============================================
The PRIMARY ethical concern of generative AI is that it may:
AAISM materials emphasize that the primary ethical concern with generative AI is the risk to information integrity. Generative models can create content that appears authentic but is fabricated, misleading, or manipulated. This undermines trust in information ecosystems and can have wide-reaching social, legal, and organizational impacts. While confidentiality breaches and bias are concerns, they are not the central ethical issue inherent to generative models. Availability is less relevant in this context. The most pressing concern is that generative AI may compromise the integrity of information.
AAISM Study Guide -- AI Risk Management (Ethical Risks of Generative AI)
ISACA AI Security Management -- Integrity Concerns in Generative Systems
Which of the following should be included in an AI acceptable use policy?
An AI acceptable use policy (AUP) sets the organizational expectations and boundaries for how AI systems may be used by employees and third parties. AAISM guidance places emphasis on ethical and legal compliance standards as core elements of an AUP to govern responsible behavior, prevent misuse, and align with regulatory and organizational principles. While data requirements, collection/storage processes, and monitoring may be covered in adjacent standards and procedures (e.g., data management policies, SOPs, and operational runbooks), the AUP's essential function is to codify permissible use anchored to ethics, legality, and organizational values.
===========
A financial organization relies on AI-based identity verification and fraud detection services. Which of the following BEST integrates AI security risk into the business continuity plan (BCP)?
AAISM stresses that AI systems and their supporting infrastructure must be explicitly included in disaster recovery and continuity planning, since disruptions to models, feature stores, or pipelines can halt critical business functions.
Explainability (A) and retraining (B) are operational improvements, not continuity mechanisms. Multi-zone redundancy (D) improves availability but does not represent complete BCP integration.
=============================================
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
Barbara Martin
9 days agoAndrew Anderson
24 days agoAmanda Thomas
1 month agoMichelle Bailey
27 days agoDennis Ramirez
26 days agoChristopher Flores
22 days agoChristopher Jones
17 days agoViola
2 months agoFranklyn
2 months agoThad
2 months agoRosio
3 months agoRebbeca
3 months agoJulie
3 months agoCarrol
3 months agoGiovanna
4 months agoKing
4 months agoRebeca
4 months agoDolores
4 months agoNovella
5 months agoRebecka
5 months agoYolando
5 months agoOlene
5 months agoLayla
6 months agoMarylyn
6 months agoElin
6 months agoMaddie
6 months agoDaniel
7 months agoTien
7 months agoLavonna
7 months agoMaynard
7 months agoTerry
8 months agoVirgina
8 months agoCarry
8 months agoStephaine
8 months agoJesus
8 months agoAbraham
8 months agoValene
9 months agoGracie
9 months agoJanine
9 months ago