ISACA AAISM Advanced in AI Security Management

An enterprise CISO is establishing accountability for AI security across business units. Which approach BEST aligns with ISO/IEC 42001 (AI Management System) and NIST AI RMF Govern function expectations?

• ADelegate all AI security decisions to data science teams since they understand the models
• BEstablish a documented AI security charter with executive sponsorship, defined roles, and…
• CTreat AI security as part of generic IT operations and reuse existing change management w…
• DWait for a regulatory mandate before formalizing any AI governance structure

Which of the following is the PRIMARY purpose of an AI security policy within an enterprise security program?

• ATo list every AI vendor the organization currently uses
• BTo translate executive risk appetite for AI into mandatory rules, roles, and acceptable-u…
• CTo replace the enterprise information security policy for systems that contain machine le…
• DTo document model hyperparameters used in training

An AI security committee is being formed. Which membership composition BEST supports cross-functional governance of AI risk?

• ACISO and Head of Data Science only
• BCISO, Chief Data/AI Officer, Privacy/DPO, Legal, Risk, and a business sponsor with docume…
• CAll software engineers who train models
• DOnly external auditors to ensure independence

A model card for a deployed customer-service LLM lists training data sources, intended use, and known limitations but omits any security review notes. From an AAISM perspective, what is the MOST significant gap?

• AIt is missing fairness disclosures only
• BIt does not record adversarial-testing results, prompt-injection mitigations, or sensitiv…
• CIt should not exist because model cards are an academic artifact
• DIt should include hyperparameter values for reproducibility

An organization is choosing a baseline AI management framework. Which standard formally defines an AI Management System (AIMS) with certification scheme?

• ANIST AI RMF 1.0
• BISO/IEC 42001
• COWASP Top 10 for LLM Applications
• DMITRE ATLAS

Within the NIST AI RMF 1.0 core, which function is responsible for cultivating a culture of risk management and is intended to apply across all stages of the AI lifecycle?

• AMap
• BMeasure
• CManage
• DGovern

A multinational deploys an HR-screening LLM that processes EU resumes. Which regulatory consideration MUST appear in the AI security program?

• AOnly US state-level AI guidance
• BEU AI Act high-risk obligations plus GDPR lawful-basis, automated-decision, and data-subj…
• CPCI DSS controls for cardholder data
• DFedRAMP boundary documentation

Which document defines the strategic direction, scope, milestones, and resource plan for an enterprise AI security capability over a multi-year horizon?

• AAn AI security roadmap
• BAn AI incident response playbook
• CA model card
• DA red-team report

An AI security manager wants to track program effectiveness with leading rather than lagging indicators. Which is the BEST example of a leading KRI for AI security?

• ANumber of historical AI security incidents last year
• BPercentage of in-scope AI systems with current threat models and pre-deployment red-team…
• CTotal fines paid for past privacy violations
• DNumber of customer complaints last quarter

An enterprise wants to classify training data used for a customer-support LLM. Which classification approach is MOST aligned with AI program governance and privacy expectations?

• ATreat all training data as Public to simplify access
• BApply the existing enterprise data classification scheme to AI training data, with explic…
• CAllow data scientists to set classifications informally per project
• DUse only model-derived classifications produced by the LLM itself

Which principle BEST captures the GDPR and ISO/IEC 42001 expectation that training datasets should contain only what is necessary for the model's stated purpose?

• AData maximization
• BData minimization
• CData democratization
• DData hoarding

An organization keeps inference logs that contain user prompts and model outputs. What is the MOST important governance control to define for these logs?

• ARetain all logs forever for audit defensibility
• BDefine a documented retention period, access control, encryption, and a process to handle…
• CDiscard logs immediately after the response is returned
• DMake the logs publicly available to demonstrate transparency

A US-based fintech offers an AI-driven credit-decision tool to California consumers. Which CCPA/CPRA-aligned obligation is MOST relevant to AI program design?

• ADisclose every model weight publicly
• BProvide consumers with rights to know, delete, correct, and to opt out of automated decis…
• CEliminate all human review
• DRefuse all consumer rights requests if a model is involved

When establishing AI security maturity, which model would BEST describe progression from ad-hoc to optimized capability?

• AA binary pass/fail compliance test
• BA capability maturity model with defined levels (e.g., initial, repeatable, defined, mana…
• CA single annual penetration test report
• DA vendor product roadmap

An IR playbook is being authored specifically for prompt-injection incidents on a customer-facing LLM. Which sequence of actions is MOST appropriate for the initial response phase?

• AImmediately retrain the base model with new data
• BDetect, contain (e.g., enable stricter input/output filters or temporarily disable the af…
• CPublicly disclose the incident before triage
• DReset all user passwords across the enterprise

Which AI security incident type involves an attacker submitting carefully crafted inputs at inference time to cause an LLM to ignore its system instructions and disclose protected content?

• AModel poisoning
• BPrompt injection
• CModel extraction
• DAdversarial training

An enterprise treats its AI governance committee as an information-only forum. According to ISO/IEC 42001 expectations, what is the MOST significant deficiency?

• AIt has too many members
• BIt lacks decision-making authority and documented escalation, so issues cannot be resolve…
• CInformation-only committees are the recommended model
• DIt should publish meeting notes externally

Training data lineage is best understood as which of the following?

• AThe list of GPUs used for training
• BAn auditable record of where training data originated, how it was transformed, who approv…
• CThe number of training epochs
• DA list of fine-tuning hyperparameters

A board asks how the AI security program demonstrates value. Which set of KPIs gives the BEST picture of program effectiveness?

• ANumber of meetings held by the AI committee
• BCoverage of in-scope AI systems with documented risk assessments, mean time to remediate…
• CTotal dollars spent on AI tooling
• DNumber of slides in the latest board deck

What is the PRIMARY governance reason for maintaining an AI system inventory?

• ATo impress auditors
• BTo know which AI systems exist, who owns them, what data they process, their risk classif…
• CTo replace asset management for non-AI systems
• DTo force every AI project through a single vendor

Which of the following BEST describes an AI security program's purpose in relation to enterprise security?

• AReplace enterprise security entirely
• BOperate completely independently with separate policies
• CExtend and integrate enterprise security with AI-specific controls, risk processes, and a…
• DFocus only on model accuracy

A regulator requests the conformity-assessment package for a high-risk AI system under the EU AI Act. Which artifact MUST be in that package?

• ASource code only
• BTechnical documentation including risk-management system, data governance, logging, trans…
• CMarketing brochures
• DInternal Slack messages

From an AAISM perspective, who SHOULD be the accountable owner of an AI security incident affecting a customer-facing LLM?

• AWhoever first detects the alert
• BThe named business/system owner of that AI system, supported by security IR and the AI go…
• CThe data scientist who built the model, regardless of role
• DThe vendor's account manager

Which AI program-management activity MOST directly supports continuous compliance with ISO/IEC 42001's 'continual improvement' clause?

• AOne-off annual audit
• BOngoing monitoring of nonconformities, corrective actions, lessons learned, and managemen…
• CRemoving all controls after certification
• DOutsourcing the program to a vendor

When defining an AI acceptable-use policy for employees, which clause is MOST important to control sensitive-data leakage to public LLMs?

• AAllow any tool as long as it is widely used
• BProhibit submission of confidential, personal, or regulated data to unapproved external A…
• CRequire all employees to be data scientists
• DForbid AI use entirely

Which document is BEST suited to capture residual risk acceptance for a deployed AI system?

• AAn informal email from the data science lead
• BA signed risk acceptance memo by the accountable business owner referencing the risk regi…
• CA model card
• DAn ad copy brief

Which mean-time metric is MOST relevant to evaluating AI vulnerability management performance?

• AMean time to publish a press release
• BMean time to remediate (MTTR) for AI-specific vulnerabilities, segmented by severity and…
• CMean time to file a patent
• DMean time between board meetings

Why is a documented escalation matrix particularly important for AI security incidents involving public-facing generative AI?

• ABecause LLM incidents always involve law enforcement
• BBecause AI incidents can move quickly into legal, privacy, brand, and regulatory territor…
• CBecause incidents are always low impact
• DBecause legal review is never required

A multinational with a single global AI policy is launching an AI service in the EU and California. What governance posture is BEST?

• AEnforce only the lowest common denominator
• BMaintain a global baseline policy with documented jurisdictional addenda for EU AI Act, G…
• CPublish entirely separate, unrelated policies per jurisdiction
• DDo nothing because the global policy already exists

Which AAISM-aligned principle is MOST relevant when evaluating the ethical use of an AI screening tool that influences hiring outcomes?

• AMove fast and break things
• BResponsible AI principles such as fairness, transparency, accountability, and human overs…
• CMaximize speed of deployment over all other concerns
• DTreat ethics as marketing language only

Which decision is BEST handled by the AI governance committee rather than by the engineering team alone?

• ASelecting the Python version for the training environment
• BApproving deployment of a high-risk LLM into a regulated workflow with documented residua…
• CChoosing the IDE used by developers
• DNaming the GPU host

An enterprise is choosing between building an AI threat model from scratch or starting from a published taxonomy. Which knowledge base is PURPOSE-BUILT for adversarial machine learning techniques and is widely referenced in AI risk programs?

• AMITRE ATT&CK Enterprise
• BMITRE ATLAS
• COWASP ASVS
• DPCI DSS

Which OWASP Top 10 for LLM Applications 2025 risk specifically addresses RAG systems where vector database content can be poisoned or leaked?

• ALLM01: Prompt Injection
• BLLM05: Improper Output Handling
• CLLM08: Vector and Embedding Weaknesses
• DLLM10: Unbounded Consumption

Model extraction attacks aim to steal which property of a deployed AI system?

• AThe training datacenter's physical address
• BThe model's behavior or parameters by repeatedly querying the API and observing outputs t…
• CThe vendor's employee directory
• DThe CI/CD secrets only

Membership inference attacks attempt to determine which of the following?

• AWhether a particular data record was part of the model's training set
• BWhich programming language the model was written in
• CWhich CPU runs the inference server
• DWhich cloud provider hosts the model

Which control set BEST mitigates the threat of malicious models uploaded to public model hubs (e.g., open-weight repositories)?

• ATrusting any model with high download counts
• BVetting model provenance, requiring signed artifacts/attestations, scanning weights for u…
• CPulling models directly into production with no review
• DDisabling logging on model loaders

An ML BOM (machine learning bill of materials) primarily helps with which risk-management objective?

• AForecasting GPU prices
• BSupply-chain transparency: enumerating models, datasets, libraries, frameworks, and their…
• CReplacing pen-testing
• DEliminating the need for monitoring

From a risk-treatment perspective, which is the BEST first action when a critical CVE is published for a widely used ML framework version pinned in production?

• AIgnore until the next quarterly patch cycle
• BAssess exposure (which models/services use the affected version), determine compensating…
• CImmediately stop all AI services regardless of risk
• DDisable security monitoring during patching

A vendor offers a closed-weight LLM via API. Which third-party risk consideration is MOST critical for the AAISM program?

• AThe vendor's office decor
• BContractual terms covering data handling, training-on-customer-data opt-outs, model and i…
• CThe CEO's social media activity
• DOffice snack quality

What is the PRIMARY risk introduced by allowing employees to use unapproved public chatbots for work tasks (shadow AI)?

• AImproved productivity only
• BConfidential and personal data may be sent to third-party services without contracts, ret…
• CReduced electricity bills
• DFaster Wi-Fi

When threat-modeling an ML pipeline, which stage is OFTEN OVERLOOKED and a high-impact target for poisoning?

• ACooling system design
• BData ingestion and labeling, where attackers can introduce poisoned samples that survive…
• COffice printer firmware
• DConference-room booking system

Which ATLAS technique describes adversaries crafting inputs designed to cause an ML model to misclassify at inference time?

• AEvasion (adversarial example)
• BPhishing
• CPassword spraying
• DDNS hijack

An organization wants to quantify the residual risk of a generative AI feature. Which combination is MOST defensible?

• AA vendor's marketing claim
• BThreat-likelihood and impact estimates derived from threat modeling and ATLAS techniques,…
• CAn anonymous online poll
• DThe CFO's gut feeling

Which threat is MOST directly addressed by output filtering and DLP for LLM responses?

• AHardware failure
• BSensitive Information Disclosure (OWASP LLM02:2025), in which models reveal personal, reg…
• CPower outage
• DDNS misconfiguration

Which OWASP LLM 2025 risk is MOST directly amplified when an LLM-driven agent is given broad tool/plugin permissions without proper scoping?

• ALLM06: Excessive Agency
• BLLM03: Supply Chain
• CLLM10: Unbounded Consumption
• DLLM09: Misinformation

A vendor's published model card lists training data only as 'large internet corpora' with no licensing detail. From a risk perspective, which concern is MOST salient?

• AColor of the documentation
• BIP and copyright exposure (training-data licensing) plus privacy risk if the corpus conta…
• CLength of the document
• DChoice of font

Which attack scenario BEST illustrates indirect prompt injection?

• AAn attacker types a jailbreak directly into the chat interface
• BAn attacker plants malicious instructions inside a document that the LLM later retrieves…
• CAn attacker physically steals the GPU
• DAn attacker rents adjacent cloud capacity