116 free ISACA AAISM practice questions from the CertStash pack of 463, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 116 free here, all 463 in the pack, and each step includes the one before it.
Get all 463 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
An AI research team is developing a natural language processing model that relies on several open-source libraries. Which of the following is the team's BEST course of action to ensure the integrity of the software packages used?
Show answer and explanation
Correct answer: C. Scan the packages and libraries for malware prior to installation.
Scanning packages and libraries for malware before installation is a critical security practice that directly protects against compromised dependencies. This is a foundational step in securing open-source software supply chains and prevents malicious code from entering the development environment. While maintaining lists, retraining, and updating are relevant practices, they do not address the fundamental integrity threat posed by potentially compromised packages.
Why the other options are wrong
- A. Maintaining a list ensures consistency but does not verify package integrity or detect malware.
- B. Retraining the model is unrelated to detecting malicious code in package dependencies.
- D. Using the latest versions increases attack surface and does not guarantee security or integrity.
Question 2
An organization plans to apply an AI system to its business, but developers find it difficult to predict system results due to lack of visibility to the inner workings of the AI model. Which of the following is the GREATEST challenge associated with this situation?
Show answer and explanation
Correct answer: D. Gaining the trust of end users through explainability and transparency
The lack of visibility into how an AI model reaches its decisions creates a fundamental explainability problem that directly undermines user trust. In business applications, especially those affecting critical decisions, stakeholders and end users need to understand model behavior to trust and accept the system. Without explainability and transparency, adoption becomes difficult regardless of technical performance, making this the greatest challenge among the options presented.
Why the other options are wrong
- A. Risk ownership and uptime are operational concerns, not directly related to lack of model visibility.
- B. Security requirements are separate from the explainability challenge described.
- C. Transaction turnaround time is a performance metric unrelated to model interpretability.
Question 3
Which of the following is MOST important to consider when validating a third-party AI tool?
Show answer and explanation
Correct answer: C. Right to audit
The right to audit a third-party AI tool is the most important validation consideration because it grants the organization the ability to independently verify the tool's behavior, security, data handling, and compliance with requirements. Without audit rights, an organization has no independent recourse to validate claims or investigate issues. Terms and conditions, testing, and certifications are all valuable but are less critical than maintaining the contractual right to examine the system directly.
Why the other options are wrong
- A. Terms and conditions are important but secondary to the ability to verify compliance through audit.
- B. Roundtable testing is useful but does not provide the organization with independent verification rights.
- D. Industry analysis and certifications are helpful context but do not provide direct verification capability.
Question 4
After implementing a third-party generative AI tool, an organization learns about new regulations related to how organizations use AI. Which of the following would be the BEST justification for the organization to decide not to comply?
Show answer and explanation
Correct answer: C. The risk is within the organization's risk appetite.
If the risk from non-compliance falls within the organization's defined risk appetite, that becomes the justification for a deliberate risk acceptance decision. Organizations can knowingly choose not to comply with certain regulations if they have explicitly accepted the associated risk through governance processes. This is a legitimate risk management decision. The other options do not provide valid justification: industry usage does not override regulations, audits do not excuse compliance, and lack of cost analysis is poor risk management rather than a reason to avoid compliance.
Why the other options are wrong
- A. Industry usage does not provide legal or regulatory justification for non-compliance.
- B. Regular audits do not eliminate regulatory obligations or provide exemption from compliance.
- D. Failure to determine compliance costs is a gap in risk analysis, not a valid reason to avoid compliance.
Question 5
Which of the following is the MOST important consideration when deciding how to compose an AI red team?
Show answer and explanation
Correct answer: C. Skills matrix
The skills matrix is the most important consideration when composing an AI red team because the team must have the right mix of expertise across security, AI/ML, domain knowledge, and technical capabilities to effectively identify and test system vulnerabilities. Without appropriate skills, the red team cannot conduct thorough adversarial testing. Resource availability, time-to-market, and use cases are secondary constraints that must work within the foundational requirement of having the right skills.
Why the other options are wrong
- A. Resource availability is a practical constraint but is secondary to having the necessary expertise.
- B. Time-to-market constraints should not drive composition decisions that affect red team effectiveness.
- D. Understanding use cases is helpful context but does not determine what skills the team needs.
Question 6
An organization's CIO provided the AI steering committee with a list of AI technologies in use and tasked them with categorizing the technologies by risk. Which of the following should the committee do FIRST?
Show answer and explanation
Correct answer: B. Ensure the AI technologies are included in the asset inventory.
Before categorizing AI technologies by risk, the committee must first ensure all technologies are included in a comprehensive asset inventory. A complete inventory is a prerequisite for any risk assessment effort; without knowing what exists and what is documented, the categorization cannot be reliable or comprehensive. This foundational inventory work must precede risk grouping, assessment, or vulnerability identification.
Why the other options are wrong
- A. Grouping similar products is premature without first establishing a complete inventory.
- C. Risk assessment cannot be accurate without first documenting all assets in the inventory.
- D. Vulnerability identification is a downstream activity that depends on asset inventory completion.
Question 7
A large pharmaceutical company using a new AI solution to develop treatment regimens is concerned about potential hallucinations with the introduction of real-world data. Which of the following is MOST likely to reduce this risk?
Show answer and explanation
Correct answer: C. Human-in-the-loop
Human-in-the-loop controls are the most effective approach to reduce hallucination risks in high-stakes domains like pharmaceutical treatment development. By requiring human review and validation of AI-generated recommendations before they are acted upon, the organization can catch factually incorrect or nonsensical outputs before they cause harm. This is especially critical when real-world data is introduced, as it can trigger unexpected model behaviors. Penetration testing targets security vulnerabilities, data validation improves data quality but not output accuracy, and impact analysis assesses consequences rather than preventing hallucinations.
Why the other options are wrong
- A. Penetration testing addresses security attacks, not AI hallucinations or factual accuracy.
- B. Data validation improves input quality but does not prevent the model from generating false information.
- D. Impact analysis assesses potential consequences but does not reduce the risk of hallucinations occurring.
Question 8
Which of the following should be the PRIMARY consideration for an organization concerned about liabilities associated with unforeseen behavior from agentic AI systems?
Show answer and explanation
Correct answer: D. Accountability model
An accountability model is the primary consideration for managing liabilities from agentic AI systems because it establishes clear responsibility for decisions, actions, and outcomes produced by the system. With autonomous or semi-autonomous AI agents that can take unforeseen actions, organizations need to define who is accountable for those actions, whether the AI vendor, the organization, specific personnel, or some combination. This accountability framework is foundational to managing legal and operational liability. Model dependencies, approved base models, and risk levels are important but secondary to establishing who bears responsibility.
Why the other options are wrong
- A. Model dependencies relate to technical architecture but do not address accountability for system behavior.
- B. Approved base models help ensure quality but do not establish liability or accountability structures.
- C. Acceptable risk level defines tolerance but does not determine who is accountable when unforeseen behavior occurs.
Question 9
During the creation of a new large language model (LLM), an organization procured training data from multiple sources. Which of the following is MOST likely to address the CISO's security and privacy concerns?
Show answer and explanation
Correct answer: C. Data classification
Data classification is the most appropriate answer for addressing CISO security and privacy concerns when procuring training data from multiple sources. It involves categorizing data by sensitivity level, ownership, and regulatory requirements, enabling the organization to understand what data they have, where it came from, and how to handle it appropriately. This foundational step allows the CISO to apply appropriate protections, identify compliance risks, and make informed decisions about data usage.
Why the other options are wrong
- A. Data minimization reduces data volume but doesn't address the security and privacy concerns of already-procured multi-source data that must be classified and managed.
- B. Data augmentation adds synthetic data to training sets but doesn't address security and privacy concerns about existing procured data.
- D. Data discovery identifies where data exists but doesn't directly address how to handle security and privacy concerns once located.
Question 10
An organization is reviewing an AI application to determine whether it is still needed. Engineers have been asked to analyze the number of incorrect predictions against the total number of predictions made. Which of the following is this an example of?
Show answer and explanation
Correct answer: D. Key performance indicator (KPI)
Analyzing the ratio of incorrect predictions to total predictions is the definition of a Key Performance Indicator (KPI), a measurable value that shows how effectively an AI application is achieving its objectives. This metric directly assesses whether the application continues to deliver acceptable performance and value. While validation involves testing, this question specifically asks about measuring performance for decision-making regarding necessity, which is quintessentially a KPI assessment.
Why the other options are wrong
- A. Model validation is the process of testing model performance but doesn't specifically describe the ratio of incorrect to total predictions as an ongoing performance metric.
- B. Control self-assessment is an internal audit procedure, not a performance measurement metric for AI predictions.
- C. Explainable decision-making concerns transparency in AI reasoning, not the measurement of prediction accuracy rates.
What people say about the full AAISM pack 4.8 from 5
Question 11
When robust input controls are not practical on a large language model (LLM) to prevent prompt injection attacks from external threats, which of the following would be the BEST compensating control to address the risk?
Show answer and explanation
Correct answer: D. Review and annotate the AI system's outputs.
When input controls cannot practically prevent prompt injection attacks on LLMs, human review of outputs serves as the critical compensating control. This detective control allows security personnel to identify and remediate malicious outputs before they reach end users or systems, effectively containing the risk of successful injection attacks regardless of input validation gaps.
Why the other options are wrong
- A. Fine-tuning for input validation does not address the stated constraint that robust input controls are not practical.
- B. IAM controls access to the system itself but do not prevent prompt injection attacks from authorized external users.
- C. Reviewing inputs duplicates the already-identified impractical input control approach rather than compensating for its absence.
Question 12
Which of the following should be the MOST important consideration when conducting an AI impact assessment?
Show answer and explanation
Correct answer: A. Achieve business objectives
An AI impact assessment examines the consequences an AI system can have, and from a governance perspective those consequences are weighed against what the organization is trying to achieve with the system. Keeping the assessment anchored to business objectives lets management judge whether the expected benefits justify the potential harms to the organization, individuals and other stakeholders, and decide on treatment. Of the options given, it is the only one that frames the assessment around the purpose and outcomes of the AI system as a whole.
Why the other options are wrong
- B. Employee retention is a narrow human resources effect and does not define the overall scope of an AI impact assessment.
- C. Security awareness training is a control that may be selected to treat risk; it is not the consideration that drives an impact assessment.
- D. Reputational damage is one possible consequence to evaluate, but it is narrower than the system's effect on business objectives.
Question 13
Which of the following would MOST effectively obtain ongoing support from stakeholders to align AI initiatives with business objectives?
Show answer and explanation
Correct answer: A. Quantifying and communicating the value of AI solutions
Quantifying and communicating the value of AI solutions is the most effective way to obtain ongoing stakeholder support. Demonstrating measurable business benefits, ROI, and concrete value propositions directly addresses stakeholder concerns and maintains executive and organizational buy-in for continued AI initiatives and investment.
Why the other options are wrong
- B. Staff training improves implementation capabilities but does not directly convince stakeholders of business value or alignment.
- C. Optimizing risk management is important for governance but does not actively demonstrate or communicate value to maintain stakeholder support.
- D. A strategic roadmap provides direction but without demonstrating value, stakeholders may not remain committed to supporting it.
Question 14
Which of the following technologies can be used to manage deepfake risk?
Show answer and explanation
Correct answer: A. Adaptive authentication
Adaptive authentication dynamically adjusts authentication requirements based on risk factors such as unusual access patterns, locations, or behavioral anomalies. When a deepfake attack attempts to impersonate management and authorize sensitive actions, adaptive authentication can detect the anomalous context and require additional verification, effectively mitigating deepfake risks by not relying solely on audio or video identity verification.
Why the other options are wrong
- B. Standard MFA adds authentication factors but doesn't specifically defend against deepfakes if the attacker can compromise or bypass those factors.
- C. Systematic data tagging organizes information but doesn't prevent or manage deepfake attacks.
- D. While blockchain provides immutability, it does not inherently prevent deepfakes or manage deepfake risk at the authentication or approval layer.
Question 15
Which of the following is the BEST control for preventing deepfakes?
Show answer and explanation
Correct answer: D. Output provenance verification
Output provenance verification is the best control for preventing deepfakes because it establishes the authenticity and origin of media content through cryptographic signatures, metadata verification, and chain-of-custody documentation. This directly addresses the deepfake threat by enabling detection of manipulated or synthetically generated content. While other options support AI security broadly, they do not specifically target deepfake prevention.
Why the other options are wrong
- A. System input validation prevents malformed data but cannot detect deepfakes, which appear as valid media inputs.
- B. Regular AI risk assessment identifies risks but does not prevent deepfakes from being created or distributed.
- C. AI governance policies provide frameworks but lack the technical capability to detect or verify authenticity of generated media.
Question 16
The PRIMARY benefit of implementing moderation controls in generative AI applications is that it can:
Show answer and explanation
Correct answer: A. filter out harmful or inappropriate content.
The primary benefit of implementing moderation controls in generative AI applications is to filter out harmful or inappropriate content. Moderation controls act as guardrails to prevent the model from generating outputs that violate organizational policies, legal requirements, ethical standards, or user safety guidelines. This is the core protective function of moderation. The other options represent secondary benefits or are unrelated to moderation's primary purpose.
Why the other options are wrong
- B. Moderation controls actually constrain creative output to ensure safety; they don't increase diversity and creativity.
- C. While moderation may help with privacy, its primary function is filtering harmful content, not specifically ensuring regulatory compliance.
- D. Moderation controls don't optimize response time; they typically add processing overhead to check outputs before delivery.
Question 17
A military contractor discovered that its large language model (LLM) is at high risk of being targeted by advanced persistent threat (APT) actors seeking to exploit the model in order to access confidential information. Which of the following attacks is the HIGHEST priority to protect against?
Show answer and explanation
Correct answer: A. Model inversion
Model inversion attacks directly threaten the confidentiality objective stated in the scenario by extracting sensitive information that the model was trained on. For a military contractor, APT actors specifically seeking to access confidential information through model exploitation would prioritize model inversion, a technique that reconstructs training data or private information from model outputs. This attack directly enables the threat actor's goal of accessing classified or proprietary information.
Why the other options are wrong
- B. Unauthorized tuning could degrade model performance but does not directly expose the confidential information that adversaries are seeking.
- C. Model distillation creates a smaller replica model but is a lower-priority threat than information disclosure for a military context protecting secrets.
- D. Data poisoning affects future model behavior but does not directly recover existing confidential information already in the current model.
Question 18
Which of the following controls BEST mitigates the risk of bias in AI models?
Show answer and explanation
Correct answer: B. Diverse data sourcing strategies
Diverse data sourcing ensures that training data represents multiple populations, perspectives, and demographics, which directly counters the root cause of bias: skewed or homogeneous datasets. This is the most effective control for preventing bias from entering the model in the first place. Data reconciliation, access controls, and cryptographic functions do not directly address the data quality and representativeness issues that cause bias.
Why the other options are wrong
- A. Data reconciliation ensures consistency but does not address the root cause of bias in training data composition.
- C. Access control techniques protect data but do not mitigate bias present in the training dataset.
- D. Cryptographic hashing secures data but has no effect on bias in the model's training or outputs.
Question 19
Which of the following is the MOST important factor to consider when selecting industry frameworks to align organizational AI governance with business objectives?
Show answer and explanation
Correct answer: B. Risk appetite
Risk appetite is the most important factor when selecting industry frameworks to align AI governance with business objectives. Risk appetite defines the organization's willingness to pursue opportunities and accept varying levels of risk in pursuit of its strategic goals, which directly determines which frameworks and governance approaches are appropriate for the organization's specific context and objectives.
Why the other options are wrong
- A. Risk threshold is a specific quantified limit but is determined after risk appetite is understood, making it secondary.
- C. Risk register is a tool for documenting identified risks, not a framework selection criterion.
- D. Risk tolerance is closely related to but distinct from risk appetite; appetite is the broader organizational willingness to take risks in pursuit of objectives, while tolerance is more about acceptable variation in outcomes.
Question 20
To ensure the ethical and responsible use of AI, which of the following AI usage policy metrics is MOST important for an organization to monitor?
Show answer and explanation
Correct answer: A. Number of reported policy violations
The number of reported policy violations is the most direct metric of whether ethical and responsible AI usage is actually occurring in practice. This outcome metric reveals whether policies are being followed and where enforcement or employee awareness gaps exist, providing actionable evidence of policy effectiveness or failure in protecting against irresponsible AI use.
Why the other options are wrong
- B. Compliance reviews measure process completion but not whether policies are actually being followed day-to-day.
- C. Frequency of consultations indicates engagement with policy but not whether violations are occurring or being prevented.
- D. Frequency of policy updates measures maintenance activity but not whether the current policy prevents unethical AI use.
Question 21
Which of the following should be done FIRST when developing an acceptable use policy for generative AI?
Show answer and explanation
Correct answer: C. Determine the scope and intended use of AI.
Before developing any acceptable use policy, the organization must first establish what it is trying to accomplish: the scope and intended use of the AI system. This clarity drives all subsequent decisions about appropriate uses, restrictions, and requirements. Only after understanding the scope and intended use can the organization effectively consult with risk management and legal, review regulatory requirements, and align with existing policies, all of which should be tailored to the specific AI use cases in question.
Why the other options are wrong
- A. Consulting risk management and legal is essential but should follow after establishing the scope and intended uses.
- B. Reviewing regulatory requirements is necessary but should be informed by the specific scope and uses identified first.
- D. Reviewing existing policies is valuable but should align with the newly defined scope and intended uses of the AI system.
Question 22
An auditor is conducting a third-party review of an AI model used in construction project scheduling. Which documentation would BEST support transparency and regulatory compliance?
Show answer and explanation
Correct answer: A. A model card
A model card is the best documentation for supporting transparency and regulatory compliance in third-party AI audits. Model cards provide comprehensive information about the model's intended use, performance metrics, limitations, bias assessments, training data characteristics, and ethical considerations. This standardized format directly supports audit requirements and regulatory compliance.
Why the other options are wrong
- B. A CI/CD pipeline log documents development processes but doesn't address model characteristics, performance, or compliance requirements.
- C. An organization-wide data dictionary describes data fields but doesn't specifically document the AI model's properties and compliance posture.
- D. A performance tuning log documents optimization activities but lacks the comprehensive transparency documentation needed for regulatory compliance.
Question 23
Which of the following is the MOST important course of action when implementing continuous monitoring and reporting for AI-based systems?
Show answer and explanation
Correct answer: A. Implement real-time monitoring of key risk indicators (KRIs) for AI systems.
Implementing real-time monitoring of key risk indicators (KRIs) for AI systems is the most important course of action because it provides immediate visibility into emerging risks and enables rapid response before problems escalate, which is critical for AI systems with potential for rapid failure modes or drift. This proactive detection capability underpins effective AI governance. While risk dashboards (B) visualize data, reporting templates (C) standardize communication, and alert systems (D) trigger responses, none of these are foundational; KRI monitoring establishes the essential detection capability that makes the others effective.
Why the other options are wrong
- B. Risk dashboards visualize tracked metrics but rely on KRI monitoring being in place to identify what to track.
- C. Standardized reporting templates improve communication but do not establish the monitoring capability itself.
- D. Automated alerts trigger on threshold breaches but depend on KRIs being defined and monitored first.
Question 24
An organization utilizes AI-enabled mapping software to plan routes for delivery drivers. A driver following the AI route drives the wrong way down a one-way street, despite numerous signs. Which of the following biases does this scenario demonstrate?
Show answer and explanation
Correct answer: D. Automation
This scenario demonstrates automation bias, where the driver blindly trusts and follows the AI system's routing decision despite obvious contradictory information (the one-way street signs). The driver over-relies on the automated system and fails to apply critical judgment, even when clear environmental cues indicate an error. This is the definition of automation bias: excessive trust in automation leading to poor decisions and failure to override obviously incorrect outputs.
Why the other options are wrong
- A. Selection bias concerns how data is chosen for analysis, not how users interact with AI outputs.
- B. Reporting bias relates to how information is communicated or recorded, not trusting an automated system blindly.
- C. Confirmation bias involves seeking information that confirms existing beliefs, not blindly following an automated system's decision.
Question 25
Which of the following types of testing can MOST effectively mitigate prompt hacking?
Show answer and explanation
Correct answer: A. Adversarial
Adversarial testing is most effective at mitigating prompt hacking attacks. Adversarial testing specifically involves attempting to break the model through malicious inputs, prompt injection, jailbreaking attempts, and other adversarial techniques, directly identifying and helping fix vulnerabilities that attackers would exploit.
Why the other options are wrong
- B. Input testing focuses on validating normal input handling and data quality but doesn't specifically target prompt hacking attack vectors.
- C. Load testing evaluates system performance under stress but has no relevance to prompt hacking vulnerabilities.
- D. Regression testing ensures existing functionality remains intact after changes but doesn't identify new security vulnerabilities from prompt attacks.
Question 26
A health services organization is developing a proprietary generative AI chatbot to assist patients with medical devices. Which of the following should be the organization's HIGHEST priority?
Show answer and explanation
Correct answer: A. Selecting the appropriate training data
For a medical AI chatbot assisting patients with medical devices, selecting appropriate training data is the highest priority because the quality, relevance, and appropriateness of training data directly determines whether the model will provide safe and accurate medical guidance. Using inappropriate or biased training data cannot be remedied by larger networks, more data, or better tuning. In healthcare contexts, data quality is foundational to safety and efficacy.
Why the other options are wrong
- B. Maximizing neural network size without appropriate data leads to overfitting and does not ensure clinical appropriateness.
- C. More training data cannot compensate for inappropriate or biased data; quantity without quality is counterproductive in healthcare.
- D. Algorithm tuning is secondary to ensuring the underlying training data is suitable for medical applications.
Question 27
To ensure AI tools do not jeopardize ethical principles, it is MOST important to validate that:
Show answer and explanation
Correct answer: C. outputs of AI tools do not perpetuate adverse biases.
The most important validation to ensure AI tools uphold ethical principles is confirming that outputs do not perpetuate adverse biases. Bias in AI outputs is a direct violation of fairness and equity principles and can cause measurable harm to affected individuals and groups. This validation is a core ethical requirement that supersedes approval processes or policies.
Why the other options are wrong
- A. Stakeholder approval of alignment with company values is important but doesn't technically validate that the tool actually performs ethically in practice.
- B. Privacy department evaluation addresses one aspect of ethics but doesn't ensure the broader ethical principle of non-discriminatory outcomes.
- D. A responsible development policy provides a framework but doesn't ensure actual outputs remain free from bias; validation requires testing actual model behavior.
Question 28
An automotive manufacturer uses AI-enabled sensors on machinery to monitor variables such as vibration, temperature, and pressure. Which of the following BEST demonstrates how this approach contributes to operational resilience?
Show answer and explanation
Correct answer: A. Scheduling repairs for critical equipment based on real-time condition monitoring
Real-time condition monitoring using AI-enabled sensors enables proactive, condition-based maintenance scheduling rather than reactive or calendar-based approaches. By analyzing vibration, temperature, and pressure data in real time, the system can predict equipment failure before it occurs and schedule repairs precisely when needed. This approach minimizes unexpected downtime, extends equipment life, and optimizes maintenance resource allocation, all of which are core components of operational resilience.
Why the other options are wrong
- B. Monthly manual reviews are reactive and do not leverage real-time data or AI insights for proactive decision-making.
- C. Manufacturer recommendations are generic; they don't account for the actual operating conditions or state of specific equipment.
- D. Fully automated repairs without human oversight eliminate critical human judgment and create additional risks; the scenario describes monitoring, not autonomous repair.
Question 29
Which of the following is the MOST critical key risk indicator (KRI) for an AI system?
Show answer and explanation
Correct answer: B. The rate of drift in the model
Model drift, the rate at which a model's predictions become less accurate over time due to changes in underlying data patterns, is the most critical KRI for AI systems. Drift indicates that the model is becoming misaligned with current real-world conditions, which can lead to poor decisions, compliance violations, and business harm. Detecting and responding to drift is essential for maintaining AI system reliability and safety, making it more critical than static measures like data volume or accuracy alone.
Why the other options are wrong
- A. The amount of data in a model is a resource metric, not a risk indicator of system performance degradation.
- C. While accuracy is important, a single point-in-time accuracy rate doesn't indicate ongoing risk; drift does by showing how accuracy changes.
- D. Response time is a performance characteristic but not a key risk indicator for AI system integrity and reliability.
Question 30
A newly hired programmer suspects that the organization's AI solution is inferring users' sensitive information and using it to advise future decisions. Which of the following is the programmer's BEST course of action?
Show answer and explanation
Correct answer: A. Inform the governance panel.
When a programmer suspects the AI solution may be inferring and using sensitive patient information improperly (a potential privacy violation with regulatory and ethical implications), the appropriate action is to escalate through the organization's governance framework. The governance panel (or equivalent governing body responsible for AI oversight, privacy, and ethics) is the proper authority to evaluate the concern, conduct formal investigation, determine policy implications, and coordinate remediation. This ensures the concern is handled through established governance channels rather than individual remediation attempts.
Why the other options are wrong
- B. Fine-tuning the AI solution is a technical mitigation that the programmer is not authorized to implement unilaterally and does not address the need for formal governance review.
- C. A code review is a technical audit but does not address the governance, privacy, and ethical questions raised by the concern.
- D. Alerting the CIO elevates to executive leadership, but the governance panel is the more appropriate body specifically responsible for AI governance, policy, and compliance matters.
Question 31
Which of the following is the MOST important consideration when an organization is adopting generative AI for personalized advertising?
Show answer and explanation
Correct answer: D. Regulatory risk
Regulatory risk is the most important consideration for personalized advertising using generative AI because organizations operate in heavily regulated environments (GDPR, CCPA, FTC guidelines, etc.) regarding data collection, profiling, and personalized marketing. Non-compliance can result in substantial fines and legal action. While reputational risk matters, regulatory compliance is the foundational requirement that drives business decisions.
Why the other options are wrong
- A. Fraud risk, while relevant, is less critical than regulatory compliance for advertising applications.
- B. Reputational risk, though important, is secondary to regulatory requirements in most jurisdictions.
- C. Commercial risk is important but regulatory frameworks set the boundaries within which commercial decisions operate.
Question 32
An organization plans to use an external vendor's AI service for customer retention analytics. Management is worried about third-party dependency and the risk of unauthorized access to customer data. Which of the following is the BEST approach to reduce this risk?
Show answer and explanation
Correct answer: A. Add data protection requirements to the vendor contract and regularly monitor compliance.
Adding data protection requirements to the vendor contract and regularly monitoring compliance is the best approach because it establishes enforceable legal obligations and creates ongoing accountability mechanisms. This combines preventive controls (contractual requirements) with detective controls (regular monitoring), directly addressing both unauthorized access concerns and third-party dependency risks. Contract terms enable remediation and legal recourse, while monitoring provides real-time assurance.
Why the other options are wrong
- B. Internal controls and encryption are valuable but cannot address the vendor's internal access controls or insider threats.
- C. Market reputation and EA integration do nothing to reduce actual unauthorized access risk or enforce specific data protections.
- D. Risk assessments are point-in-time activities; they lack the ongoing monitoring necessary to manage vendor risk over time.
Question 33
From a risk perspective, which of the following is the MOST important step when implementing an adoption strategy for AI systems?
Show answer and explanation
Correct answer: C. Conducting an AI risk assessment and updating the enterprise risk register
Conducting an AI risk assessment and updating the enterprise risk register is the most important step because it systematically identifies, quantifies, and documents AI-specific risks within the organization's existing risk management framework. This approach ensures that AI risks are integrated into organizational risk governance, enables informed decision-making at enterprise level, and creates accountability for risk ownership and mitigation. Updating the risk register makes risks visible and actionable.
Why the other options are wrong
- A. Establishing a framework is foundational but incomplete without actual assessment and risk register integration.
- B. Risk analysis methodology is important but is a process component; actual assessment and documentation is the critical step.
- D. Benchmarking against peers provides external reference but doesn't address internal risk assessment and governance.
Question 34
When using third-party pre-trained AI models for customer due diligence in a highly regulated financial industry, which of the following is the PRIMARY security concern?
Show answer and explanation
Correct answer: C. Presence of unvalidated dependencies and typosquatting
When using third-party pre-trained AI models in regulated financial environments, the PRIMARY security concern is the presence of unvalidated dependencies and typosquatting attacks. These represent direct supply chain security risks that could compromise the integrity and trustworthiness of the model before it's even deployed. In financial services with regulatory requirements, unvalidated code dependencies could introduce malicious code or vulnerabilities that violate compliance standards. This is more immediately critical than operational or architectural concerns.
Why the other options are wrong
- A. Energy efficiency is an operational concern, not a security risk for a regulated financial institution.
- B. Model size relates to computational requirements, not security validation of third-party code.
- D. While vendor lock-in is a valid business concern, unvalidated dependencies pose direct security threats that take precedence in regulated environments.
Question 35
An organization is implementing AI agent development across multiple engineering teams. Which of the following is the MOST important focus of AI-specific security training for developers?
Show answer and explanation
Correct answer: A. Prompt injection, agent memory control, and insecure tool execution
Prompt injection, agent memory control, and insecure tool execution represent the most critical security vulnerabilities unique to AI agents. These attack vectors directly compromise agent behavior, can bypass safety measures, and enable unauthorized actions through tool misuse, making them essential for developers to understand and mitigate.
Why the other options are wrong
- B. Dataset bias, explainability, and fairness are important AI ethics and compliance topics but not primary security training concerns.
- C. Output moderation and hallucination handling are important but are typically addressed through system design rather than developer security training.
- D. API abuse and data leakage are general security concerns, not specific to AI agent development.
Question 36
Which of the following key risk indicators (KRIs) is MOST relevant when evaluating the effectiveness of an organization's AI risk management program?
Show answer and explanation
Correct answer: D. Percentage of AI project in compliance
The percentage of AI projects in compliance is the most relevant KRI for evaluating risk management program effectiveness because it directly measures whether the organization's AI initiatives are adhering to established governance policies, regulatory requirements, and risk management standards. This metric provides a clear indication of control effectiveness and organizational capability to manage AI-related risks.
Why the other options are wrong
- A. Percentage of critical systems with AI components is a deployment metric that does not directly measure the effectiveness of risk management activities.
- B. Number of training requests reflects awareness activity but is not a meaningful indicator of whether risks are actually being managed effectively.
- C. Number of models deployed is a volume metric unrelated to the quality of risk management or compliance with governance requirements.
Question 37
Which of the following involves documenting and monitoring the complete journey of data as it flows through an AI system?
Show answer and explanation
Correct answer: B. Lineage
Data lineage specifically refers to tracking and documenting the complete path of data as it flows through an AI system, from source through processing, transformation, storage, and output. This is the established term in data governance and AI explainability. Origin is a component of lineage but not the comprehensive term. Processing and transformation are steps within the lineage but not the documentation of the complete journey itself.
Why the other options are wrong
- A. Origin identifies only the starting point, not the complete journey through the system.
- C. Processing describes one phase of data movement, not the documented tracking of the entire flow.
- D. Transformation describes data modifications, not the comprehensive documentation of data journey across all system stages.
Question 38
Which of the following BEST represents a combination of quantitative and qualitative metrics that can be used to comprehensively evaluate AI transparency?
Show answer and explanation
Correct answer: A. AI explainability reports and bias metrics
AI explainability reports provide qualitative insights into how models make decisions and why, while bias metrics offer quantitative measurements of fairness across different groups. Together, these form a comprehensive evaluation framework that addresses both the interpretability aspect (qualitative) and measurable fairness outcomes (quantitative) essential for assessing true AI transparency.
Why the other options are wrong
- B. Availability and downtime metrics measure system reliability, not transparency or explainability.
- C. While ethical impact is relevant, user feedback alone lacks the quantitative rigor needed for comprehensive transparency evaluation.
- D. Model complexity and accuracy metrics focus on performance, not transparency, and do not adequately address explainability concerns.
Question 39
A global financial organization wants to deploy an AI solution for credit scoring. Which of the following should the organization do FIRST?
Show answer and explanation
Correct answer: B. Verify that the AI solution meets compliance requirements for local laws and regulations.
Before deploying an AI credit scoring solution globally, the organization must verify compliance with local laws and regulations as the foundational step. Different jurisdictions have varying legal requirements for AI, lending, and data usage. Compliance failures could result in legal liability, fines, and operational shutdowns. This prerequisite activity must occur first to ensure the solution can legally be deployed.
Why the other options are wrong
- A. Bias assessment is critical but should follow after confirming the solution can legally be used in the target markets.
- C. TEVV strategy development is important but comes after establishing legal feasibility.
- D. Documentation should be maintained throughout but isn't the first action; it supports other activities.
Question 40
Which of the following BEST ensures AI components are validated as part of disaster recovery testing?
Show answer and explanation
Correct answer: D. Monitoring model performance metrics during failover and recovery to assess system stability
Monitoring model performance metrics during failover and recovery is the best approach to validate AI components in disaster recovery testing. This method directly assesses whether the AI system functions correctly after recovery, maintains accuracy and availability, and provides measurable evidence that the system can resume operations successfully.
Why the other options are wrong
- A. Erasing test records is destructive and does not realistically simulate disaster recovery scenarios or validate the recovery process.
- B. Disconnecting training clusters tests infrastructure failover but does not validate that the AI components themselves function after recovery.
- C. Simulating DoS attacks tests security detection rather than disaster recovery and business continuity capabilities.
Question 41
A financial organization uses AI to detect potential fraudulent activities but is concerned about the impact of potential data poisoning. Which of the following controls would BEST mitigate this risk?
Show answer and explanation
Correct answer: C. Using training data from multiple sources
Using training data from multiple sources is the best mitigation for data poisoning attacks. Diversifying data sources makes it significantly harder for attackers to systematically poison all training data, as they would need to compromise multiple independent sources simultaneously. This reduces the likelihood and impact of coordinated poisoning attacks.
Why the other options are wrong
- A. A break-glass policy addresses incident response procedures but does not actively prevent data poisoning from occurring in the first place.
- B. Transparency with customers about data sources does not technically prevent an attacker from poisoning the data itself.
- D. Security awareness training helps staff recognize threats but does not directly prevent automated data poisoning attacks against training datasets.
Question 42
When implementing a generative AI system, which of the following approaches will BEST prevent misalignment between the corporate risk appetite and tolerance?
Show answer and explanation
Correct answer: B. Establishing and monitoring acceptable levels of AI system risk
Establishing and monitoring acceptable levels of AI system risk most directly prevents misalignment between corporate risk appetite and tolerance. This approach defines what level of risk the organization is willing to accept and actively monitors whether the AI system operates within those bounds, creating clear governance boundaries aligned with business objectives.
Why the other options are wrong
- A. An AI risk register documents risks but doesn't establish or monitor acceptable levels; it's a tool supporting the broader governance approach.
- C. An impact assessment evaluates potential consequences but doesn't establish ongoing monitoring of acceptable risk levels during operation.
- D. KPIs measure performance metrics but don't directly address the alignment between risk appetite and tolerance in the way monitoring acceptable risk levels does.
Question 43
Which of the following controls BEST mitigates the inherent limitations of generative AI models?
Show answer and explanation
Correct answer: C. Ensuring human oversight
Ensuring human oversight is the best control to mitigate inherent limitations of generative AI models. Human oversight catches errors, hallucinations, biases, and other failures that the AI system itself cannot self-correct, providing accountability and intervention points where human judgment can validate or reject AI outputs before they cause harm.
Why the other options are wrong
- A. Adopting AI-specific regulations provides external compliance framework but doesn't directly mitigate the technical limitations of the models themselves.
- B. Classifying and labeling AI systems aids transparency but doesn't mitigate the inherent technical limitations or prevent model failures.
- D. Reverse engineering models is technically infeasible at scale and doesn't address mitigation; it's not a practical control for deployed systems.
Question 44
In a new supply chain management system, AI models used by participating parties are interactively connected to generate advice in support of management decision making. Which of the following is the GREATEST challenge related to this architecture?
Show answer and explanation
Correct answer: D. Determining the aggregate risk of the system
When multiple AI models are interactively connected in a supply chain system, outputs from one model feed into others, creating cascading effects and compounding errors. Determining the aggregate risk of this interconnected architecture, including how errors propagate, compound, and affect overall system reliability, is the greatest challenge because traditional single-model risk assessment does not account for systemic interdependencies.
Why the other options are wrong
- A. Explaining benefits to stakeholders is a communication challenge but not the greatest technical or architectural challenge.
- B. While responsibility attribution is complex, it is a governance question rather than the core technical architectural challenge.
- C. Identifying individual hallucinations is important but is a known challenge within single models, not specific to interconnected architectures.
Question 45
An organization is updating its vendor arrangements to facilitate the safe adoption of AI technologies. Which of the following would be the PRIMARY challenge in delivering this initiative?
Show answer and explanation
Correct answer: A. Failure to adequately assess AI risk
The primary challenge in updating vendor arrangements for safe AI adoption is the failure to adequately assess AI risks. Without comprehensive risk assessment, organizations cannot identify what controls, contractual terms, or vendor requirements are necessary. While vendor unwillingness (B) and legal inexperience (C) are obstacles, they are secondary to the fundamental need to understand what risks must be managed. Shadow AI (D) is a downstream concern that becomes apparent only after initial risk assessment frameworks are in place.
Why the other options are wrong
- B. Vendor unwillingness is a negotiation challenge, not the primary technical or governance obstacle to initiating the initiative.
- C. Legal inexperience can be addressed through external counsel or training; it is not the fundamental barrier to understanding what must be protected.
- D. Shadow AI detection is important but follows after establishing a baseline understanding of organizational AI risks and governance needs.
Question 46
Which of the following is BEST for analyzing true positives, true negatives, false positives, and false negatives produced by an AI model?
Show answer and explanation
Correct answer: C. Confusion matrix
A confusion matrix is the fundamental tool for analyzing all four classification outcomes: true positives, true negatives, false positives, and false negatives. It organizes these outcomes in a grid format that enables comprehensive evaluation of model performance across all classification categories. While precision and recall derive from confusion matrix values, they only capture specific aspects rather than providing the complete analysis.
Why the other options are wrong
- A. Hyperparameter tuning is an optimization technique, not an analysis tool for classification outcomes.
- B. Precision only addresses the relationship between true positives and false positives, not all four outcomes.
- D. Recall only addresses the relationship between true positives and false negatives, not all four outcomes.
Question 47
Which of the following AI-driven systems should have the MOST stringent recovery time objective (RTO)?
Show answer and explanation
Correct answer: D. Industrial control system
Industrial control systems directly manage physical infrastructure, machinery, and production lines. Downtime can cause safety hazards, equipment damage, environmental risks, and significant economic losses. While health support systems are also critical, industrial control systems typically require the most stringent RTO because their failure can immediately threaten worker safety and cause cascading infrastructure damage. The physical consequences of extended outages are more severe and less forgiving than in other domains.
Why the other options are wrong
- A. Health support systems are critical but often have slightly longer acceptable recovery windows than industrial control systems, and can often operate in degraded mode.
- B. Credit risk modeling can typically tolerate longer recovery times as it supports analytical rather than real-time operational functions.
- C. Car navigation systems, while important for user experience, do not have the immediate safety and infrastructure consequences of industrial control systems.
Question 48
As organizations increasingly rely on vendors to develop AI systems, which of the following is the MOST effective way to monitor vendors and ensure compliance with ethical and security standards?
Show answer and explanation
Correct answer: C. Conducting regular audits of vendor processes and adherence to AI development guidelines
Regular audits of vendor processes and adherence to AI development guidelines represent the most effective monitoring approach because they provide independent verification of compliance. This combines oversight with accountability, allowing the contracting organization to assess actual practices rather than relying on vendor self-reporting or documentation alone. Audits can identify gaps between stated policies and real implementation, evaluate security controls, and verify ethical standards are being followed in practice.
Why the other options are wrong
- A. Mandating source code and documentation sharing raises intellectual property concerns and doesn't guarantee compliance with ethical and security standards.
- B. Requiring vendors to self-monitor is insufficient without independent verification and oversight mechanisms.
- D. Self-attestation without third-party validation and benchmark monitoring provides minimal assurance of actual compliance.
Question 49
An organization is considering a Software as a Service (SaaS)-based HR system that uses AI to automate resume vetting and pre-screening of candidates. Which of the following controls is MOST important to review?
Show answer and explanation
Correct answer: A. Inclusion of diverse and representative training data
For an HR resume-vetting system, inclusion of diverse and representative training data is the most critical control to review because AI models trained on biased data will perpetuate and amplify discrimination in hiring decisions. This directly impacts fairness, legal compliance (employment law), and organizational integrity in candidate selection.
Why the other options are wrong
- B. Data backup availability is an operational resilience control unrelated to fairness in hiring decisions.
- C. Vendor conformity assessments are important for compliance but do not specifically address the bias and fairness concerns inherent in resume-vetting algorithms.
- D. Encryption and data isolation are important for data security but do not address the algorithmic fairness issues that directly affect hiring outcomes.
Question 50
When creating a use case for an AI model that provides sensitive decisions affecting end users, which of the following is the GREATEST benefit of using model cards?
Show answer and explanation
Correct answer: A. Ethical considerations of the model are documented.
The greatest benefit of model cards for sensitive decision-making use cases is that ethical considerations of the model are documented. Model cards provide structured documentation of model behavior, performance across different groups, limitations, and ethical implications. This transparency is critical when the model affects end users in sensitive contexts, ensuring that stakeholders understand potential biases, fairness concerns, and appropriate usage boundaries.
Why the other options are wrong
- B. Technical deployment instructions are addressed in deployment documentation, not the primary purpose of model cards.
- C. Model cards do not reduce data collection requirements; they document what the model uses and does.
- D. Model type selection is typically decided before creating model cards and is not their greatest benefit.
Question 51
Which of the following is the MOST effective way to prevent a model inversion attack?
Show answer and explanation
Correct answer: C. Implement differential privacy during model training.
Differential privacy during model training is the most effective technical defense against model inversion attacks because it mathematically limits what an attacker can learn about individual training data by adding controlled noise to the learning process. This prevents attackers from reconstructing sensitive training data even with full model access, which is exactly what model inversion attacks attempt to do.
Why the other options are wrong
- A. Monitoring output patterns detects attacks but doesn't prevent them from succeeding.
- B. Pseudonymization is a data protection measure but doesn't prevent inference of training data.
- D. Data minimization reduces attack surface but doesn't prevent model inversion if training data exists.
Question 52
An incident response team has restored an AI system after a confirmed security incident. Which of the following should be done NEXT?
Show answer and explanation
Correct answer: A. Verify AI system functionality for expected behavior and output quality.
After restoring an AI system following a security incident, the NEXT critical step is to verify that the system functions as expected and produces correct output quality. This validation step ensures the restoration was successful and the system is safe to return to production. Before communicating results externally or gathering evidence, the organization must confirm the system works properly and poses no ongoing risk, which is a fundamental principle of post-incident recovery procedures.
Why the other options are wrong
- B. Communication to stakeholders occurs after internal validation confirms the system is functioning correctly.
- C. Gathering model output data for analysis is part of the investigation phase, which should precede restoration, not follow it.
- D. Isolation should have occurred before restoration; after restoration is validated, isolation is no longer necessary.
Question 53
When using AI as part of incident response, which of the following BEST ensures the automation aligns with regulatory and governance obligations?
Show answer and explanation
Correct answer: D. Implement a tiered automation strategy where severity ratings inform the need for human oversight.
A tiered automation strategy that uses severity ratings to determine when human oversight is required best aligns with regulatory and governance obligations by maintaining human accountability in critical decisions while allowing automation where appropriate. This approach ensures that high-severity incidents requiring human judgment and regulatory compliance considerations receive proper oversight, rather than autonomous decision-making that could violate governance requirements.
Why the other options are wrong
- A. Fully autonomous classification of all incidents removes human oversight and accountability required by most regulatory frameworks.
- B. Mirroring legacy workflows does not ensure alignment with current regulatory obligations or appropriate use of AI capabilities.
- C. Automating all containment based on anomaly detection removes required human judgment for compliance-sensitive decisions.
Question 54
Which of the following BEST describes the role of transparency in AI?
Show answer and explanation
Correct answer: D. Explaining the AI system in an understandable and logical way so reasons for decisions can be given
Transparency in AI is best characterized as explaining the system in an understandable and logical way so that stakeholders can understand and be given reasons for decisions made by the system. This definition encompasses explainability and interpretability. While option A mentions transparency elements, it is overly focused on openness and availability rather than comprehensibility. Option B describes trust-building rather than transparency. Option C describes interpretability but only one dimension of it.
Why the other options are wrong
- A. Publishing mechanisms and data sources addresses openness but not necessarily explaining reasoning in understandable terms.
- B. Persuasion is about building confidence, which is distinct from transparency about actual decision-making processes.
- C. Walking through decision trees is a method of explaining one type of model but does not define the broader role of transparency.
Question 55
A model stealing attack has been launched on an AI system that has been in use for two years. Which of the following would BEST mitigate the impact of the attack?
Show answer and explanation
Correct answer: B. Replacing the AI model with a new model that hides confidence levels
After a model stealing attack has already occurred on a two-year-old model, the attacker likely possesses or can infer much of the model's functionality. The highest-impact mitigation is to replace the compromised model with one that obfuscates confidence levels, which directly degrades the utility and fidelity of any stolen replica. Hiding confidence levels makes the stolen model significantly less useful because attackers cannot gauge prediction reliability, undermining their ability to exploit the stolen model effectively.
Why the other options are wrong
- A. Monitoring for suspicious activities is important for detection but does not mitigate the impact of a theft that has already occurred.
- C. Strict access controls are preventive measures for future attacks but cannot undo or reduce the damage of theft that has already happened.
- D. Updating training data with adversarial examples does not specifically address the already-stolen model or reduce the attacker's ability to use their stolen copy.
Question 56
Which of the following is the BEST approach for minimizing risk when integrating acceptable use policies for AI foundation models into business operations?
Show answer and explanation
Correct answer: C. Establish AI model life cycle policy and procedures.
Establishing AI model life cycle policy and procedures is the best approach because it provides comprehensive governance covering the entire journey of AI systems from acquisition through deployment, monitoring, and retirement. This systematic approach ensures that acceptable use policies are consistently applied, enforced, and adapted throughout the model's operational life, rather than relying on external controls or limiting scenarios.
Why the other options are wrong
- A. Relying solely on the developer's enforcement mechanisms leaves the organization dependent on external controls and does not ensure accountability within the organization.
- B. Training and awareness are important supporting measures but alone do not establish the systematic controls needed to minimize risk across all operations.
- D. Limiting usage to predefined scenarios is overly restrictive and reduces the competitive advantage that AI adoption is meant to provide.
Question 57
An organization plans to use an open-source foundational AI model. Which of the following is MOST important for the AI governance committee to consider when approving the use of the model?
Show answer and explanation
Correct answer: A. Confidential data leakage
Confidential data leakage is the most critical governance concern for open-source foundational models. Open-source models lack vendor-enforced security controls, and there is risk that training on or with sensitive organizational data could expose confidential information through model inversion, extraction attacks, or uncontrolled distribution of model weights. While model accuracy (B), support (C), and privacy rights (D) are important considerations, the security and confidentiality risks posed by using unrestricted open-source models represent the primary governance gate.
Why the other options are wrong
- B. Model accuracy is a performance metric, not a governance priority that would block approval of an open-source model.
- C. Support considerations affect operational continuity but are not the primary security and confidentiality concern.
- D. Employee privacy rights are important but are secondary to the broader confidential data leakage risk inherent in open-source models.
Question 58
Which of the following BEST describes how supervised learning models help reduce false positives in cybersecurity threat detection?
Show answer and explanation
Correct answer: C. They learn from historical labeled data.
Supervised learning models reduce false positives in threat detection by learning from historical labeled data that clearly distinguishes between legitimate activity and actual threats. The model uses these examples to develop decision boundaries and patterns. This training on past labeled examples enables the model to accurately classify new, unseen data with lower false positive rates because it has learned what legitimate and malicious patterns actually look like in context.
Why the other options are wrong
- A. Dynamically generating new labeled datasets is not a core function of supervised learning; it requires pre-labeled training data as input.
- B. While grouping patterns sounds plausible, this describes clustering (unsupervised learning) rather than how supervised models specifically reduce false positives.
- D. Real-time feature engineering and automatic boundary adjustment describe more advanced adaptive learning, not the fundamental mechanism of supervised learning.
Question 59
Which AI model is BEST suited to ensure explainability in an HR department's pre-screening tool for candidate resumes?
Show answer and explanation
Correct answer: C. Decision tree
Decision trees are inherently interpretable and transparent models where the reasoning path from input to output can be easily visualized and explained. This is crucial for HR pre-screening tools where candidates need to understand why they were rejected and the organization needs to justify decisions to avoid discrimination claims. Decision trees provide clear, human-understandable logic without the 'black box' nature of other algorithms.
Why the other options are wrong
- A. Support vector machines are difficult to interpret and don't provide clear reasoning for decisions.
- B. Neural networks are essentially black boxes and cannot easily explain their decision logic.
- D. Gradient boosting machines are complex ensemble methods that lack explainability.
Question 60
An aerospace manufacturing company that prioritizes accuracy and security has decided to use generative AI to enhance operations. Which of the following large language model (LLM) adoption plans BEST aligns with the company's risk appetite?
Show answer and explanation
Correct answer: A. Developing a private LLM to automate non-critical functions
Developing a private LLM to automate non-critical functions best aligns with an aerospace manufacturer's priority for accuracy and security with conservative risk appetite. A private LLM provides control over training data, model behavior, and security, while limiting use to non-critical functions reduces impact if issues arise. This approach balances innovation with the need for high assurance before deploying AI in critical functions.
Why the other options are wrong
- B. Contracting with a third-party provider reduces control over the model and data, which conflicts with prioritizing security.
- C. A public LLM used for critical functions creates significant accuracy and security risks in an industry where failures are costly.
- D. Purchasing open market datasets provides no control over data quality or security, contradicting the company's priorities.
Question 61
A CISO learns that a video showing an unverified safety issue with the organization's key product has gone viral. The individual in the video often appears to be blurry, and the video contains random lower-quality sections throughout. Which type of threat is this MOST likely an example of?
Show answer and explanation
Correct answer: D. Deepfake
This is most likely a deepfake because the video exhibits characteristic artifacts of synthetic media generation: blurriness and random lower-quality sections are typical compression and rendering artifacts present in AI-generated videos. These imperfections occur because deepfake generation technologies struggle with consistent quality maintenance across the entire frame.
Why the other options are wrong
- A. Hallucinations are AI-generated false information in outputs, not visual artifacts in videos.
- B. Model drift refers to performance degradation over time, not visual quality issues in video content.
- C. Data poisoning involves corrupting training data, not creating observable visual artifacts in generated media.
Question 62
An organization is planning to commission a third-party AI system to make decisions using sensitive data. Which of the following metrics is MOST important for the organization to consider?
Show answer and explanation
Correct answer: C. Accuracy thresholds
When using a third-party AI system to make decisions with sensitive data, accuracy thresholds are the most critical metric because poor accuracy directly impacts decision quality and could harm individuals subject to those decisions. Accuracy determines whether the model reliably produces correct outcomes, which is essential for responsible decision-making, especially with sensitive data in contexts like hiring or credit decisions.
Why the other options are wrong
- A. Accessibility rating relates to user interface usability, not decision quality.
- B. Response time is a performance metric but less critical than accuracy for decision-making.
- D. Service availability ensures uptime but doesn't address whether decisions are correct.
Question 63
An organization is deploying an automated AI cybersecurity system. Which of the following would be the MOST effective strategy to minimize human error and improve overall security?
Show answer and explanation
Correct answer: B. Using historical data to train AI detection software
Using historical data to train AI detection software leverages machine learning to identify patterns and anomalies that would reduce reliance on manual human analysis, thereby minimizing human error in threat detection. This approach allows the system to scale detection capabilities and consistently apply learned patterns across large volumes of data.
Why the other options are wrong
- A. Manual monitoring of alerts increases human involvement and does not minimize human error.
- C. Using ML algorithms for responsible use is a governance concern, not a strategy to minimize human error in security detection.
- D. Penetration testing is a validation technique, not a strategy for minimizing human error in ongoing security operations.
Question 64
Which of the following BEST enables an organization to maintain visibility to its AI usage?
Show answer and explanation
Correct answer: B. Maintaining a comprehensive inventory of AI systems and business units that leverage them
Maintaining a comprehensive inventory of AI systems and the business units that leverage them provides direct visibility into all AI deployments across the organization. This inventory-based approach enables tracking, governance, and oversight of AI usage throughout the enterprise and serves as the foundation for all other visibility and management efforts.
Why the other options are wrong
- A. KPI measurements assess impact but do not necessarily provide visibility into which systems exist and where they are deployed.
- C. A monthly vendor dashboard tracks suppliers but does not provide visibility into internal AI usage or systems across business units.
- D. Board approval of policies establishes governance direction but does not create visibility into actual AI system deployments and usage.
Question 65
Which of the following is MOST important to monitor in order to ensure the effectiveness of an organization's AI vendor management program?
Show answer and explanation
Correct answer: D. Vendor compliance with AI-related requirements
Vendor compliance with AI-related requirements is the most important metric to monitor because it directly measures whether vendors are meeting contractual and regulatory obligations for AI systems. This encompasses adherence to security standards, ethical guidelines, data protection requirements, documentation standards, and audit requirements, all of which are critical to managing vendor risk. Compliance monitoring is the core function of a vendor management program.
Why the other options are wrong
- A. Training program participation is a support activity but doesn't directly verify vendor AI system compliance.
- B. Research participation indicates industry engagement but doesn't measure compliance with organization-specific AI requirements.
- C. Reviewing external threat reports is a security awareness activity but doesn't verify vendor-specific compliance.
Question 66
An organization is designing an AI-based credit risk assessment system that will integrate with sensitive financial data sets. Which of the following would BEST support the implementation of security by design principles in the AI system's architecture?
Show answer and explanation
Correct answer: B. Applying threat modeling specific to AI components before deployment
Threat modeling specific to AI components before deployment embodies security by design principles by identifying potential vulnerabilities and attack vectors early in the architectural phase. This allows the organization to build security into the system from inception rather than adding it later, which is essential for protecting sensitive financial data integration.
Why the other options are wrong
- A. Differential privacy is a valuable technique but addresses one specific data leakage concern rather than comprehensively supporting security by design principles.
- C. Container segmentation manages resource constraints and operational isolation but doesn't specifically address security design principles for AI systems.
- D. IP allow lists are network-level access controls that don't address the core architectural security design needed for AI systems processing financial data.
Question 67
When evaluating a third-party AI service provider, which of the following master services agreement provisions is MOST critical for managing security risk?
Show answer and explanation
Correct answer: C. Prohibiting the use of customer data for model training
Prohibiting the use of customer data for model training is the most critical security risk management provision because it prevents the vendor from using sensitive customer information to train or improve their models. This protects against data exfiltration, unauthorized use of proprietary information, and model poisoning risks. This contractual protection is fundamental to maintaining data confidentiality and organizational control.
Why the other options are wrong
- A. Unlimited retraining requests relate to service capacity, not security risk management.
- B. Real-time log sharing is useful for monitoring but is less critical than preventing unauthorized data use.
- D. Query volume thresholds address availability and performance, not the fundamental security risk of data misuse.
Question 68
An organization is deploying a large language model (LLM) and is concerned that input manipulations may compromise its security. Which of the following is the MOST effective way to determine an acceptable risk threshold?
Show answer and explanation
Correct answer: C. Assess the business impact of known threats.
Determining an acceptable risk threshold must be grounded in business context. Assessing the business impact of known threats provides the organization with measurable consequences (financial loss, reputation damage, operational disruption) that can be used to set appropriate risk tolerance levels aligned with organizational priorities and capabilities.
Why the other options are wrong
- A. Logging and monitoring are detection and response controls, not methods for determining risk thresholds.
- B. Restricting special characters is an overly broad technical control that doesn't address threshold determination.
- D. Implementing a static threshold without understanding business impact is arbitrary and fails to account for organizational risk tolerance.
Question 69
Which of the following security framework elements BEST helps to safeguard the integrity of outputs generated by AI algorithms?
Show answer and explanation
Correct answer: C. Risk exposure due to bias in AI outputs is kept within an acceptable range.
Keeping risk exposure due to bias in AI outputs within an acceptable range directly addresses output integrity by establishing acceptable risk thresholds and monitoring deviation. This framework element ensures that biased or corrupted outputs are detected and controlled within defined tolerances, which is essential for maintaining the integrity and trustworthiness of AI-generated results. It combines measurement, accountability, and risk management specifically for output quality.
Why the other options are wrong
- A. Disclosure of architecture to stakeholders is a transparency measure but doesn't directly safeguard output integrity.
- B. Ethical standards in awareness programs support culture but don't directly control or verify output integrity.
- D. Defining responsibility for legal actions addresses accountability but doesn't prevent or safeguard against integrity compromises.
Question 70
Within an incident handling process, which of the following would BEST help restore end user trust with an AI system?
Show answer and explanation
Correct answer: B. The AI model's outputs are validated by team members.
Validating AI model outputs by team members directly restores end user trust by demonstrating human oversight and quality assurance of the system's decisions. This shows that outputs are being checked for accuracy and appropriateness before affecting users, rebuilding confidence in the system. While remediation addresses the root cause and improves the system, validation of outputs provides immediate assurance that the system is being monitored and controlled, which is what directly rebuilds user trust post-incident.
Why the other options are wrong
- A. Remediation fixes the underlying problem but does not directly demonstrate to end users that the system is now trustworthy.
- C. Using AI to monitor incidents does not address the trust issue caused by the original incident.
- D. Prioritizing incidents by business impact is a process improvement but does not restore user trust in the AI system itself.
Question 71
Which of the following types of attacks would a malicious actor MOST likely use to target an AI model's training data and compromise the accuracy of the model's outputs?
Show answer and explanation
Correct answer: D. Data poisoning
Data poisoning directly compromises training data integrity, causing the model to learn incorrect patterns and produce inaccurate outputs. This attack specifically targets the data used to train the model, resulting in systematic degradation of output accuracy. Inference attacks extract information about training data but do not modify it; data exfiltration steals data without altering model behavior; DoS attacks interrupt availability but do not compromise accuracy. Only data poisoning fundamentally corrupts the learning process itself.
Why the other options are wrong
- A. Inference attacks extract information about training data but do not compromise the accuracy of model outputs.
- B. Data exfiltration steals sensitive information but does not alter the model's learning or output accuracy.
- C. Denial of service attacks reduce availability but do not modify training data or degrade the accuracy of outputs the model produces when operational.
Question 72
Which of the following is the PRIMARY purpose of a dedicated AI management system policy?
Show answer and explanation
Correct answer: D. Providing a framework to set AI objectives
A dedicated AI management system policy's primary purpose is to establish a comprehensive framework for setting AI objectives and governance. While compliance, accuracy optimization, and environmental impact are all important considerations, the foundational purpose is to provide the overarching structure that guides all other AI initiatives and ensures alignment with organizational goals.
Why the other options are wrong
- A. Minimizing environmental impact is a specific concern within AI governance, not the primary purpose of the policy itself.
- B. Optimizing model accuracy is an operational goal achieved through implementation, not the primary purpose of establishing a management policy.
- C. Compliance with external regulations is one outcome of a well-designed policy, but not its primary purpose.
Question 73
Which of the following would be of GREATEST concern to an information security manager when a small, startup organization is proposing the use of a pre-trained open-source AI solution?
Show answer and explanation
Correct answer: B. There may be a lack of support if the project is abandoned.
For a small startup considering open-source AI adoption, the lack of vendor support is the highest information security concern. If the open-source project is abandoned or poorly maintained, the organization loses access to security patches, bug fixes, and technical guidance when vulnerabilities are discovered. This creates prolonged exposure to exploitable flaws with no recourse for remediation, making it a critical risk in a resource-constrained environment.
Why the other options are wrong
- A. Limited visibility into data usage is a concern but is typically addressed through code review and architectural design choices rather than being insurmountable.
- C. Compatibility with enterprise architecture can be evaluated and resolved through integration planning and is not a security risk.
- D. While a hidden backdoor is a serious risk, the scenario specifies pre-trained open-source solutions which can be inspected and audited for known backdoors; this is lower probability than abandonment.
Question 74
A model producing contradictory outputs based on highly similar inputs MOST likely indicates the presence of:
Show answer and explanation
Correct answer: A. evasion attacks.
Contradictory outputs from highly similar inputs most likely indicates evasion attacks, where adversaries craft specific inputs designed to fool the model into making incorrect predictions while bypassing its defenses. This behavior demonstrates the adversary's ability to find input patterns that exploit model vulnerabilities through deliberate manipulation. Poisoning attacks (B) corrupt training data, membership inference (C) extracts training data information, and exfiltration (D) steals models themselves, none of which produce this specific pattern of inconsistent outputs on similar inputs.
Why the other options are wrong
- B. Poisoning attacks occur during training and affect overall model behavior, not specific input-output contradictions.
- C. Membership inference determines whether data was in training set, not causing contradictory outputs on similar inputs.
- D. Model exfiltration steals the model itself, not causing contradictory behavior on specific inputs.
Question 75
Which of the following would BEST protect an AI system against an evasion attack?
Show answer and explanation
Correct answer: D. Adversarial training
Adversarial training is the BEST mechanism to protect an AI system against evasion attacks. Adversarial training involves deliberately exposing the model to adversarial examples (inputs designed to fool the model) during training, allowing the model to learn robustness against such manipulations. This approach strengthens the model's decision boundaries and makes it resistant to carefully crafted inputs intended to cause misclassification. This is a fundamental defense-in-depth technique specific to evasion attack mitigation.
Why the other options are wrong
- A. Access controls protect against unauthorized system access but do not defend against adversarial inputs from authorized users.
- B. Validating training datasets ensures data quality but does not address evasion attempts with crafted inputs at inference time.
- C. Context awareness training helps with general robustness but is not specifically designed to counter adversarial evasion techniques.
Question 76
An organization is implementing an AI-based credit assessment engine using internal and third-party customer data. Which of the following BEST aligns with data management controls for the AI life cycle?
Show answer and explanation
Correct answer: A. Documented procedures for data sourcing, lineage tracking, and quality validation
Comprehensive data management controls across the AI lifecycle require documented procedures covering three critical elements: data sourcing (where data comes from), lineage tracking (how data moves through systems), and quality validation (ensuring accuracy and integrity). These documented procedures form the foundation of governance, enabling organizations to understand, control, and audit data at every stage from ingestion through model training and deployment. This holistic approach directly supports compliance and risk management for AI systems handling sensitive customer data.
Why the other options are wrong
- B. Hashing identifiers is a technical de-identification technique that addresses privacy in specific contexts but does not constitute comprehensive data management controls across the entire AI lifecycle.
- C. Encryption and access controls are important security measures but represent only tactical implementations rather than the documented governance procedures needed for lifecycle data management.
- D. Limiting training to structured data from vetted sources is an input restriction that reduces risk but does not address the core requirement for documented procedures covering sourcing, lineage, and validation.
Question 77
Which of the following reviews MUST be conducted as part of an AI impact assessment?
Show answer and explanation
Correct answer: A. Identification of environmental and societal consequences
Identification of environmental and societal consequences is a core MUST-conduct element of AI impact assessment frameworks (as defined by leading standards and regulatory guidance). This evaluation identifies broader effects of AI deployment on society, the environment, and stakeholder communities beyond technical performance. While testing and verification are important, they are evaluation activities rather than impact assessment scope. Model reproducibility is a technical concern. Security control self-assessment is a control validation activity, not an impact assessment component.
Why the other options are wrong
- B. Testing, evaluation, validation, and verification are technical quality assurance activities rather than impact assessment components.
- C. Model reproducibility is a technical and scientific concern; it is not a mandatory element of impact assessment.
- D. Security control self-assessment (CSA) is a control evaluation activity; it is not part of AI impact assessment scope.
Question 78
A large corporation has received an influx of sophisticated credential phishing emails and would like to leverage an AI solution to detect and quarantine these messages before they reach employees. Which of the following blue team AI features is BEST suited to this task?
Show answer and explanation
Correct answer: C. Natural language processing (NLP)
Natural Language Processing (NLP) is best suited for detecting phishing emails because it can analyze text content, identify linguistic patterns, detect anomalies in language structure, recognize suspicious phishing indicators, and classify emails based on semantic content. NLP excels at understanding and analyzing language to identify malicious intent within email messages.
Why the other options are wrong
- A. Large Language Models are generalists designed for conversation and content generation, not specialized threat detection.
- B. Retrieval-Augmented Generation is designed to fetch and enhance responses with external data, not suitable for email classification.
- D. Natural Language Generation creates new text rather than analyzing existing email content for threats.
Question 79
A large language model (LLM) has been manipulated to provide advice that serves an attacker's objectives. Which of the following attack types does this situation represent?
Show answer and explanation
Correct answer: B. Evasion attack
This situation represents an evasion attack, where an attacker manipulates the model's runtime behavior to produce outputs that serve attacker objectives rather than intended system function. The attack occurs after deployment by crafting inputs or conditions that cause the model to bypass its intended safety guidelines. Evasion attacks focus on fooling the model into producing unintended outputs while the model architecture remains unchanged.
Why the other options are wrong
- A. Data poisoning occurs during training by corrupting training data; this describes post-deployment manipulation of outputs.
- C. Privilege escalation is a system access control attack, not applicable to LLM output manipulation.
- D. Model inversion is an attack to extract training data from the model, not to manipulate its advice outputs.
Question 80
An organization is adopting an agentic AI solution from an external vendor to support its internal IT operations. To evaluate the security posture of this system, which of the following provides the MOST reliable and independently verifiable evidence of implemented security controls?
Show answer and explanation
Correct answer: B. Third-party audit reports
Third-party audit reports provide the most reliable and independently verifiable evidence of implemented security controls. These reports are conducted by external, credentialed auditors using standardized methodologies (such as SOC 2, ISO 27001, or custom security assessments) and are subject to professional liability. Peer review (A) lacks independent verification standards. Internal red team reports (C) are not independent and do not verify vendor controls. Whitepapers (D) are vendor-authored marketing materials without third-party verification.
Why the other options are wrong
- A. Peer review by other customers is anecdotal and lacks the rigor and independence of formal audit documentation.
- C. Internal red team testing verifies externally accessible attack surface but not the vendor's internal security controls and practices.
- D. Whitepapers are vendor-authored and lack independent verification or accountability to standards.
Question 81
An information security manager suspects a model inversion attack is in progress after detecting high volumes of queries with unusually specific and structured inputs being sent to an image generation AI. The results are similar to images from the proprietary training dataset. Which of the following is the MOST effective long-term remediation?
Show answer and explanation
Correct answer: D. Reduce the level of detail in the model's output parameters.
Reducing the level of detail in model output parameters limits what attackers can extract through repeated queries. Model inversion attacks succeed by collecting high-confidence outputs that, when aggregated, reconstruct training data. By constraining output precision (confidence scores, detail level, specificity), the organization fundamentally reduces the information available for reconstruction. This long-term solution addresses the attack mechanism itself rather than treating symptoms, whereas blocking specific patterns or deleting individual examples provides only temporary relief against adaptive attackers.
Why the other options are wrong
- A. Blocking known patterns is temporary; sophisticated attackers will adapt their queries to bypass pattern-based detection.
- B. Deleting accessed examples does not prevent future inversion attacks using different training data, and may harm model utility.
- C. Restricting the attacker's domain only blocks one source; attackers can use proxies, botnets, or other IP sources to circumvent domain-based restrictions.
Question 82
Which of the following would BEST ensure a proper business continuity plan (BCP) is in place for an AI solution?
Show answer and explanation
Correct answer: B. Testing the AI infrastructure failover mechanisms
Testing failover mechanisms directly validates that the BCP will function when needed. A BCP is only effective if its critical components, particularly infrastructure failover, are demonstrated to work under realistic conditions. Testing ensures the organization can actually recover AI services when failures occur, which is the fundamental requirement of any BCP.
Why the other options are wrong
- A. Monitoring and detection are important operational controls but do not ensure the BCP itself is in place or functional.
- C. Access controls protect the system from unauthorized use but do not address business continuity or recovery capabilities.
- D. Backup and restoration detail is one element of a BCP, but testing failover mechanisms provides greater assurance that recovery will succeed.
Question 83
Which of the following is the MOST important course of action prior to placing an in-house developed AI solution into production?
Show answer and explanation
Correct answer: D. Perform testing, evaluation, validation, and verification.
Testing, evaluation, validation, and verification (TEVV) is the most critical foundational activity before production deployment. This comprehensive assessment ensures the AI solution actually works as intended, meets security and compliance requirements, performs reliably, and doesn't introduce unintended consequences. While senior management sign-off and gap analysis are important, they depend on the results of rigorous TEVV. A prototype is insufficient for production readiness. TEVV provides the evidence necessary to justify management approval and identify gaps.
Why the other options are wrong
- A. A prototype helps with development but is not sufficient validation for production deployment; production requires full TEVV.
- B. Gap analysis is valuable but is typically performed as part of the comprehensive TEVV process and isn't the most important foundational step.
- C. Management sign-off should be obtained after TEVV demonstrates the solution meets requirements; approval without testing is premature and irresponsible.
Question 84
An organization is facing a deepfake attack intended to manipulate stock prices. The organization's crisis communication plan has been activated. Which of the following is MOST important to include in the initial response?
Show answer and explanation
Correct answer: C. Provide clarifying information in a pre-approved public statement.
In an active crisis where a deepfake targets stock prices, the most critical immediate action is to provide clarifying information through a pre-approved public statement. This stops misinformation spread, protects market confidence, and demonstrates organizational control of the narrative. Speed and clarity are essential to prevent the deepfake from dominating public perception and affecting stock price before correction occurs.
Why the other options are wrong
- A. Brand monitoring is useful but is a secondary response; immediate clarification prevents damage rather than tracking it.
- B. Detailed forensics is important for long-term response but takes time and delays the critical immediate message needed to contain damage.
- D. Employee training is valuable long-term but doesn't address the immediate public-facing crisis and stock price manipulation risk.
Question 85
An audit reveals that a third-party AI vendor of a financial organization does not provide documentation on model training and testing. Which of the following is the MOST critical risk for the organization?
Show answer and explanation
Correct answer: A. Lack of model explainability and potential regulatory noncompliance
Lack of model explainability and potential regulatory noncompliance is the most critical risk because financial organizations operate under strict regulatory frameworks (SEC, prudential regulations, fair lending laws) that increasingly require AI explainability and model validation documentation. Without training and testing documentation, the organization cannot demonstrate model fairness, validate risk controls, or prove regulatory compliance, creating direct legal and operational risk in a highly regulated industry.
Why the other options are wrong
- B. Data confidentiality during training is important but less critical than regulatory compliance risk in financial services.
- C. Customer onboarding and administration are operational issues, not critical risks.
- D. Infrastructure costs and model complexity are financial concerns, not regulatory or compliance risks.
Question 86
An insurance organization's AI system flags claims from one region for fraud more often due to undetected bias. According to responsible AI principles, which of the following is the MOST appropriate initial response from the AI governance body?
Show answer and explanation
Correct answer: C. Suspend regional fraud detection and initiate a root cause analysis.
According to responsible AI principles, when undetected bias is discovered in an AI system's output, the MOST appropriate initial response is to suspend the biased process and initiate a thorough root cause analysis. This follows the principle of precaution: when a system exhibits discriminatory behavior, it must be immediately taken out of service to prevent further harm to affected populations. Only after understanding the root causes can appropriate remediation be designed. Proceeding with reassurances, retraining, or threshold adjustments without investigating the underlying cause risks perpetuating or masking the bias.
Why the other options are wrong
- A. Issuing reassurances without investigating the root cause is irresponsible and does not address the actual problem.
- B. Retraining without root cause analysis may not address the actual bias source and could perpetuate the problem.
- D. Simply adjusting thresholds is a technical workaround that masks bias rather than addressing its root cause.
Question 87
During which phase of the AI life cycle are models assessed for security and determined to be free of malicious manipulations?
Show answer and explanation
Correct answer: A. Verification
Verification is the phase where models are assessed against specifications and security requirements, including checks for malicious manipulations, backdoors, and poisoning. This phase focuses on confirming the model meets defined security criteria before deployment. Validation assesses whether the model solves the intended problem, testing and evaluation measure performance and accuracy, but verification specifically encompasses the security assessment for freedom from malicious manipulations.
Why the other options are wrong
- B. Validation determines if the model meets business requirements but does not specifically assess for security threats and malicious manipulations.
- C. Evaluation measures model performance and accuracy but is not the phase designated for security threat assessment.
- D. Testing checks functionality but is typically a component of verification rather than the distinct phase where security from malicious manipulation is confirmed.
Question 88
An organization recently introduced a generative AI chatbot that can interact with users and answer their queries. Which of the following would BEST mitigate hallucination risk identified by the risk team?
Show answer and explanation
Correct answer: A. Performing model testing and validation
Testing and validation of the model against known outputs is the most direct way to identify and measure hallucination errors before deployment, allowing the organization to detect when the model generates false or nonsensical information. While fine-tuning and training on large datasets may help reduce hallucinations, they don't guarantee detection, and developer training alone doesn't directly address the technical problem of hallucinations in the deployed system.
Why the other options are wrong
- B. Developer training improves practices but does not directly mitigate hallucinations already present in the model's outputs.
- C. Fine-tuning may improve performance but does not guarantee hallucination detection or mitigation without validation testing.
- D. Larger training datasets can help but do not directly prevent hallucinations or validate that they won't occur.
Question 89
Which of the following mitigation control strategies would BEST reduce the risk of introducing hidden backdoors during model fine-tuning via third party components?
Show answer and explanation
Correct answer: B. Performing threat modeling and integrity checks
Threat modeling and integrity checks directly address the risk of hidden backdoors in third-party components by identifying vulnerabilities in the fine-tuning process and verifying the authenticity and safety of components before integration. This proactive security approach is specifically designed to detect and prevent malicious code injection during model development.
Why the other options are wrong
- A. Open-source models can still contain vulnerabilities or backdoors and doesn't specifically address integrity verification.
- C. Disabling runtime logs actually reduces visibility into potential attacks and is counterproductive to security.
- D. Unsupervised learning methods are unrelated to preventing backdoors from third-party components.
Question 90
Secure aggregation enhances the security of federated learning systems by:
Show answer and explanation
Correct answer: C. ensuring individual client contributions remain confidential even if the server is compromised.
Secure aggregation ensures individual client contributions remain confidential even if the server is compromised by using cryptographic techniques that allow aggregation of updates without revealing individual participant data. This design means that even a compromised central server cannot reconstruct or access individual model updates, protecting participant privacy at the architectural level.
Why the other options are wrong
- A. Encryption during transmission protects data in transit but does not prevent a compromised server from accessing aggregated or plaintext data at rest.
- B. Differential privacy masks sensitive information but operates at a different layer and does not address server compromise scenarios.
- D. Processing in isolation on clients reduces exposure but does not provide the same cryptographic guarantees against server compromise.
Question 91
A retail organization implements an AI-driven recommendation system that utilizes customer purchase history. Which of the following is the BEST way for the organization to ensure privacy and comply with regulatory standards?
Show answer and explanation
Correct answer: C. Maintaining a register of legal and regulatory requirements for privacy
Maintaining a register of legal and regulatory requirements for privacy provides the foundational governance structure needed to ensure compliance with applicable standards like GDPR, CCPA, or industry-specific regulations. This proactive inventory approach ensures the organization systematically identifies and addresses all relevant privacy obligations for its AI recommendation system.
Why the other options are wrong
- A. While a governance committee is valuable, a regulatory requirements register is the more concrete mechanism for ensuring compliance.
- B. Storing data indefinitely violates privacy principles and most regulatory frameworks that mandate data minimization and retention limits.
- D. Quarterly retraining focuses on model accuracy rather than addressing privacy compliance and regulatory requirements.
Question 92
An organization implementing a large language model (LLM) application notices significant and unexpected cost increases due to excessive computational resource usage. Which vulnerability is MOST likely in need of mitigation?
Show answer and explanation
Correct answer: C. Unbounded consumption
Unbounded consumption is the vulnerability describing excessive computational resource usage and unexpected cost increases in LLM applications. This occurs when there are no limits on API calls, token consumption, or model inference, allowing costs to spiral unexpectedly. This is distinct from other AI vulnerabilities and directly matches the symptom of significant cost increases due to excessive computational resources.
Why the other options are wrong
- A. Excessive agency refers to an AI system taking unintended autonomous actions, not related to computational resource usage or costs.
- B. Sensitive information disclosure is about data leaks or privacy breaches, not about computational cost overruns.
- D. System prompt leakage involves exposing the model's instructions, not driving computational resource consumption and costs.
Question 93
Which of the following BEST enables an organization to strengthen information security controls around the use of generative AI applications?
Show answer and explanation
Correct answer: B. Monitoring AI outputs against policy
Monitoring AI outputs against policy is the most direct and practical control for strengthening information security around generative AI. This enables real-time detection of policy violations, inappropriate content, or security risks in AI-generated output. While exceeding benchmarks sounds rigorous and validating training data matters, monitoring outputs provides continuous oversight that catches actual security incidents. A kill switch is too reactive and doesn't prevent misuse proactively.
Why the other options are wrong
- A. Exceeding benchmarks doesn't guarantee controls are effective for the specific organization's risk profile and AI use cases.
- C. A kill switch is a reactive emergency measure, not a proactive control that strengthens security posture.
- D. Validating training data is important but occurs pre-deployment; monitoring outputs provides ongoing security assurance.
Question 94
Which of the following information is MOST important to include in a centralized AI inventory?
Show answer and explanation
Correct answer: A. Ownership and accountability of AI systems
Ownership and accountability of AI systems is the most important information to include in a centralized AI inventory because it establishes clear responsibility for each system's governance, risk management, performance, and compliance. Without clear ownership, there is no mechanism to ensure accountability for the system's behavior, risks, and adherence to organizational policies.
Why the other options are wrong
- B. Foundation model and package registry information is technical documentation that is secondary to establishing organizational accountability and control.
- C. Use cases are important context but do not establish the governance and accountability structure that ownership provides.
- D. Training data sets are important for model transparency but are less critical than establishing clear ownership for managing the overall system.
Question 95
Which of the following actions would BEST help an organization be prepared for a deepfake attack?
Show answer and explanation
Correct answer: C. Training employees on AI-specific incident response
Training employees on AI-specific incident response is the best preparation for deepfake attacks because it ensures the organization can detect, validate, and respond to deepfake content when it appears. Employees need to understand verification techniques, escalation procedures, and communication protocols specific to synthetic media incidents. This directly prepares the organization to handle deepfakes when they occur, whereas the other options address indirect concerns or unrelated technical controls.
Why the other options are wrong
- A. Regulatory compliance does not directly prepare for or mitigate deepfake attacks.
- B. General AI policies are insufficient without specific deepfake incident response procedures and training.
- D. Code obfuscation is irrelevant to defending against external deepfake attacks.
Question 96
Which of the following is the MOST serious consequence of an AI system correctly guessing the personal information of individuals and drawing conclusions based on that information?
Show answer and explanation
Correct answer: D. The output may reveal information about individuals or groups without their knowledge.
The most serious consequence is that the output may reveal information about individuals or groups without their knowledge or consent, which violates fundamental privacy rights and data protection principles. This is the core harm: unauthorized disclosure of personal information regardless of accuracy. While litigation (A) and trust decline (B) are consequences, and false statements (C) are problems, the fundamental violation is the unauthorized revelation of private information itself, which enables downstream harms and violates individual autonomy.
Why the other options are wrong
- A. Litigation is a potential consequence but not the most serious primary harm.
- B. Trust decline is an important consequence but secondary to the actual privacy violation.
- C. False or defamatory statements are harmful but less fundamental than the core issue of unauthorized information disclosure.
Question 97
An organization plans to implement a new AI system. Which of the following is the MOST important factor in determining the level of risk monitoring activities required?
Show answer and explanation
Correct answer: B. The organization's risk tolerance
Risk tolerance is the specific threshold of acceptable risk exposure the organization can sustain; this directly determines how intensive monitoring must be to keep risks within acceptable bounds. Risk appetite is broader preference for risk overall, but tolerance is the more precise metric for determining monitoring frequency and depth. The number of users affects scope but not the fundamental level of monitoring required, and compensating controls are one possible response but not the primary determinant of monitoring intensity.
Why the other options are wrong
- A. Risk appetite describes general risk orientation but is less precise than tolerance for determining specific monitoring intensity.
- C. Number of users affects scope of monitoring but not the intensity or depth required for a given risk level.
- D. Compensating controls are responses to risk but do not determine the baseline level of monitoring activities needed.
Question 98
An attacker crafts inputs to a large language model (LLM) to exploit output integrity controls. Which of the following types of attacks is this an example of?
Show answer and explanation
Correct answer: D. Prompt injection
Crafting inputs to exploit output integrity controls in an LLM is prompt injection, where attackers manipulate the input prompts to make the model violate its intended constraints and safety guidelines. This is distinct from evasion (A), which applies to model predictions rather than language generation, jailbreaking (B), which is a broader category, and remote code execution (C), which involves actual system-level exploitation rather than prompt manipulation.
Why the other options are wrong
- A. Evasion typically refers to bypassing classification or prediction models, not specifically manipulating LLM output through crafted prompts.
- B. Jailbreaking is a broader term encompassing various methods to bypass safety controls, while prompt injection is the specific technique of manipulating inputs.
- C. Remote code execution involves exploiting system vulnerabilities to execute arbitrary code, unrelated to prompt manipulation.
Question 99
Which of the following BEST describes the role of model cards in AI solutions?
Show answer and explanation
Correct answer: B. They provide a standardized way to document the training data and AI model use cases.
Model cards are standardized documentation artifacts that provide transparent information about AI model development, including training data sources, intended use cases, performance metrics, limitations, and potential biases. They serve as a record of the model's provenance and applicability, enabling stakeholders to understand what the model was designed for and its characteristics.
Why the other options are wrong
- A. While model cards may include performance visualizations, their primary role is documentation, not visualization.
- C. Model cards document existing models; they do not generate synthetic data or train models.
- D. Model cards are static documentation; they do not automatically fine-tune models based on user feedback.
Question 100
Which of the following is the GREATEST risk inherent to implementing generative AI?
Show answer and explanation
Correct answer: C. Potential intellectual property violations
Potential intellectual property violations represent the greatest risk inherent to generative AI because these systems are trained on large datasets that may contain copyrighted material, proprietary information, or data without proper licensing, creating legal liability, regulatory penalties, and operational disruption. This risk is foundational and difficult to mitigate retroactively. Inadequate ROI (A) is a business concern, insufficient training (B) is addressable through education, and asset vulnerabilities (D) are discoverable through assessment, but IP violations stem from the core nature of how generative AI systems operate.
Why the other options are wrong
- A. Inadequate ROI is a financial concern that can be managed through proper planning and pilot programs.
- B. Lack of employee training is a capability gap that can be addressed through educational initiatives.
- D. Unidentified asset vulnerabilities can be discovered and addressed through security assessments and scanning.
Question 101
Which of the following is the MOST effective way to mitigate the risk of deepfake attacks?
Show answer and explanation
Correct answer: B. Validating the provenance of the data source
Validating the provenance of data sources is the most effective foundational defense against deepfakes because it establishes authenticity and chain-of-custody before content is processed or distributed. This preventive approach stops manipulated content at the source rather than attempting detection after creation, making it the most robust mitigation strategy.
Why the other options are wrong
- A. Limiting employee access to AI tools does not address the core problem of deepfake detection and validation.
- C. Relying solely on human judgment is unreliable given deepfake sophistication and the volume of content requiring review.
- D. General-purpose LLMs are not specialized fraud detection systems and cannot reliably identify manipulated media without additional validation mechanisms.
Question 102
Which of the following is the MOST critical success factor for an AI implementation project?
Show answer and explanation
Correct answer: B. Obtaining senior management buy-in
Senior management buy-in is the most critical success factor for AI implementation projects because without executive support, projects lack adequate funding, resource allocation, organizational priority, and the change management necessary to drive adoption. While other factors like risk management and model documentation are important, they cannot succeed without the foundational support and commitment from senior leadership.
Why the other options are wrong
- A. Data mapping is important for data management but not the primary success factor.
- C. Risk capture in risk registers is a control mechanism, not a primary success driver.
- D. Model cards improve transparency and accountability but are not the most critical factor for implementation success.
Question 103
A financial institution plans to deploy an AI system to provide credit risk assessments for loan applications. Which of the following should be given the HIGHEST priority in the system's design to ensure ethical decision making and prevent bias?
Show answer and explanation
Correct answer: C. Train the system to provide advisory results with final decisions made by human experts.
Training the system to provide advisory results with final decisions made by human experts should receive highest priority because human oversight is the most effective safeguard against AI bias and unethical outcomes in high-stakes decisions like credit risk assessment. This approach preserves human accountability, allows experts to contextualize results and catch biased recommendations, and prevents fully automated discriminatory decisions. It is the most robust control for ensuring ethical decision-making.
Why the other options are wrong
- A. Regularly updating with new data can perpetuate or amplify existing biases without addressing root causes.
- B. Restricting to objective metrics alone doesn't eliminate bias, as objective metrics can encode historical discrimination.
- D. Appeal mechanisms are important but reactive; they don't prevent biased decisions from occurring initially.
Question 104
A field service organization wants to adopt an AI solution from an external vendor. Management feels pressure to implement AI quickly to take advantage of the latest technology. Which of the following is the MOST important course of action before engaging with a vendor?
Show answer and explanation
Correct answer: B. Define the organization's business needs, regulatory requirements, and risk tolerance to select the most appropriate solution.
Before selecting an AI vendor, an organization must establish a clear understanding of its own business needs, regulatory requirements, and risk tolerance. This foundational assessment ensures the chosen solution aligns with organizational objectives rather than being driven by vendor marketing or market trends. Option B represents prudent governance by defining internal requirements first, which should then guide vendor evaluation rather than allowing vendor recommendations to dictate strategy.
Why the other options are wrong
- A. Choosing based on market share alone ignores the organization's specific needs and regulatory context, and blindly following vendor advice abdicates responsibility for strategic alignment.
- C. Bundling and speed of deployment are operational concerns that should follow, not precede, establishing clear business requirements and risk parameters.
- D. Testing tools across departments without first defining needs is inefficient and may lead to fragmented, non-compliant implementations.
Question 105
Which of the following is the GREATEST benefit of implementing an AI tool to safeguard sensitive data and prevent unauthorized access?
Show answer and explanation
Correct answer: A. Timely initiation of incident response
The greatest benefit of implementing AI to safeguard sensitive data is timely initiation of incident response. AI can detect unauthorized access patterns in real-time and immediately trigger response procedures, minimizing dwell time and limiting damage. Early incident response is the most critical factor in preventing data compromise. While reducing false positives and analyzing endpoint activities are valuable, they are secondary to the ability to respond quickly when actual threats are detected.
Why the other options are wrong
- B. Reduced false positives is beneficial for efficiency but doesn't directly address the primary goal of preventing unauthorized access.
- C. Timely analysis of endpoint activities supports detection but is less valuable than the ability to respond immediately to threats.
- D. AI doesn't eliminate the need for data classification; proper classification is a prerequisite for effective AI-based protection.
Question 106
Which of the following strategies is the MOST effective way to protect against AI data poisoning?
Show answer and explanation
Correct answer: C. Using robust data validation techniques and anomaly detection
Robust data validation techniques and anomaly detection directly identify and prevent poisoned or corrupted data from entering the model. This defensive approach detects anomalies, outliers, and suspicious patterns that indicate compromised data before they influence model training. Using diverse data sources does not inherently detect poisoning. Increasing model complexity and adding more features without validation actually makes systems more vulnerable to poisoned data by expanding the attack surface.
Why the other options are wrong
- A. Diverse data sources alone do not prevent poisoning; malicious actors can inject poisoned data across multiple sources.
- B. Increased complexity makes systems harder to understand and more vulnerable to subtle poisoning attacks without detection mechanisms.
- D. Adding more features and data without validation exacerbates poisoning risks by expanding the potential for corrupted inputs.
Question 107
When deriving statistical information generated by AI systems, which of the following sources of risk is MOST important to address?
Show answer and explanation
Correct answer: D. Systemic bias in data sets
Systemic bias in datasets is the most critical risk when deriving statistical information from AI systems because it fundamentally undermines the validity and fairness of outputs across populations. Biased training data propagates throughout the model's decisions, affecting all downstream statistical conclusions. While hallucinations (A) and incomplete outputs (B) are quality issues, and data normalization (C) is a technical preprocessing concern, systemic bias poses the largest governance and ethical risk to the reliability of statistical insights.
Why the other options are wrong
- A. Hallucinations are factual errors but do not systematically distort statistical inference across demographic groups.
- B. Incomplete outputs reduce coverage but are not inherently sources of statistical bias or invalidity.
- C. Data normalization is a technical preprocessing step; lack thereof affects performance but not systemic fairness of statistics.
Question 108
Which of the following testing techniques is BEST for determining how an AI model makes decisions?
Show answer and explanation
Correct answer: C. White box
White box testing is the technique specifically designed to examine the internal workings and decision-making processes of a system. In the context of AI models, white box testing allows analysis of the model's structure, weights, algorithms, and decision pathways to understand how conclusions are reached. This direct visibility into the model's internals makes it the best choice for determining how an AI model makes decisions.
Why the other options are wrong
- A. Red team testing focuses on adversarial attacks and finding vulnerabilities, not understanding decision-making.
- B. Black box testing treats the system as opaque and only observes inputs and outputs without examining internal mechanisms.
- D. Blue team testing is defensive in nature and focuses on response and mitigation, not model decision analysis.
Question 109
An organization needs large data sets to perform application testing. Which of the following would BEST fulfill this need?
Show answer and explanation
Correct answer: C. Performing AI data augmentation
Data augmentation is a technique that synthetically generates or transforms existing data to create larger, more diverse datasets for testing purposes. This directly and efficiently addresses the need for large datasets while maintaining quality and control over the testing data. Open-source repositories may have licensing and quality concerns, model cards document existing models rather than providing data, and search content introduces copyright and quality risks.
Why the other options are wrong
- A. Open-source repositories may have licensing restrictions, quality issues, and may not contain the specific types of data needed.
- B. AI model cards document model characteristics, not provide testing datasets.
- D. Incorporating data from search content raises copyright, licensing, and data quality concerns.
Question 110
A preliminary risk assessment of a software as a service (SaaS)-based large language model (LLM) powered business support system has identified prompt injection, data poisoning, and model exfiltration as material threats. Which of the following is the BEST approach to ensure risks are treated consistently?
Show answer and explanation
Correct answer: B. Implementing an AI threat control matrix that maps threats to specific controls and assurance activities
An AI threat control matrix that explicitly maps identified threats (prompt injection, data poisoning, model exfiltration) to specific controls and assurance activities provides the most comprehensive and consistent approach to risk treatment. This structured methodology ensures all material threats are addressed systematically, with clear linkage between threats and controls, enabling consistent evaluation and monitoring across the deployment.
Why the other options are wrong
- A. While industry baselines are valuable, they may not specifically address the identified AI-specific threats to this particular SaaS-LLM system.
- C. Deferring control selection until post-deployment is contrary to sound risk management and leaves material risks unmitigated during go-live.
- D. Vendor audits and SLAs provide evidence but do not ensure that the specific identified threats are treated with organizational controls and assurance activities.
Question 111
A large financial services organization is integrating a third-party AI solution into its critical fraud detection system. Which of the following is the BEST way for the organization to reduce risk associated with AI vendor and supply chain dependencies?
Show answer and explanation
Correct answer: B. Establishing contractual agreements requiring vendors to provide evidence of secure development practices
Establishing contractual agreements requiring vendors to provide evidence of secure development practices directly addresses supply chain and vendor dependency risks. This ensures vendors maintain security standards, provides accountability mechanisms, and creates visibility into the security posture of third-party solutions. Contractual agreements enable due diligence on upstream security controls and practices. Vulnerability assessments are periodic snapshots. Virtual environment testing validates integration but not vendor security practices. Performance testing is operational, not risk-focused.
Why the other options are wrong
- A. Annual vulnerability assessments are periodic and reactive; they don't provide ongoing visibility into vendor security practices or development processes.
- C. Integration testing in isolated environments validates functionality but does not evaluate vendor security practices, development controls, or supply chain risk.
- D. Performance testing is operational validation; it does not address vendor security practices, development controls, or supply chain dependencies.
Question 112
Which area of intellectual property law presents the GREATEST challenge in determining copyright protection for AI-generated content?
Show answer and explanation
Correct answer: C. Determining the rightful ownership of AI-generated creations
Determining rightful ownership of AI-generated creations presents the greatest challenge in AI copyright law because traditional copyright frameworks assume human authorship and creative intent. Questions arise about whether copyright vests in the AI developer, the organization deploying the system, the user providing prompts, or exists at all. This ambiguity creates uncertainty across jurisdictions and affects licensing, liability, and monetization rights.
Why the other options are wrong
- A. Trademark enforcement for AI systems follows established trademark law principles and presents fewer novel legal challenges.
- B. Trade secret protection of AI technologies uses existing trade secret frameworks and is well-established in law.
- D. Licensing frameworks, while complex, can be negotiated between parties and follow contractual principles.
Question 113
An organization decides to use an anomaly-based intrusion detection system (IDS) integrated with a generative adversarial network enabled AI tool. The integrated tool would MOST effectively detect intrusions by leveraging:
Show answer and explanation
Correct answer: D. synthetic intrusion data to train the tool's components.
Synthetic intrusion data is the most effective approach for training a GAN-enabled anomaly detection IDS because GANs excel at generating realistic synthetic data that represents attack patterns without exposing actual sensitive incident details. This allows comprehensive training on diverse intrusion scenarios, including rare or novel attack types that may not be well-represented in limited real-world datasets, while maintaining data privacy and security. GANs generate synthetic data through adversarial learning, making this their natural and most effective application in this context.
Why the other options are wrong
- A. Validation datasets are for testing model performance, not for training the components of an intrusion detection system.
- B. While labeled real data is useful, it is limited to known attacks and does not leverage the GAN's ability to generate novel scenarios.
- C. Automated rule creation is a traditional IDS approach, not a GAN-specific advantage, and does not leverage the generative capabilities of the tool.
Question 114
A post-incident investigation finds that an AI-powered anti-money laundering system inadvertently allowed suspicious transactions because certain risk signals were disabled to reduce false positives. Which of the following governance failures does this BEST demonstrate?
Show answer and explanation
Correct answer: D. Insufficient model validation and change control processes
The scenario describes a critical risk signal being disabled without proper oversight, which directly indicates insufficient model validation and change control processes. This governance failure allowed an unauthorized configuration change that compromised the system's core function. Proper change control would have prevented such modifications, and model validation would have caught this regression. The incident reflects process and governance failures rather than resource constraints, consultant reliance, or dashboard visibility.
Why the other options are wrong
- A. Computing resources are unrelated to the decision to disable risk signals or the governance processes around configuration changes.
- B. Reliance on external consultants is not demonstrated; the issue is the change control process itself, not who designed the model.
- C. Dashboard and metrics visibility wouldn't prevent an intentional configuration change; governance and approval processes are the root issue.
Question 115
Which of the following controls BEST mitigates the risk of data poisoning?
Show answer and explanation
Correct answer: A. Data validation
Data validation is the most direct and effective control against data poisoning attacks. It involves verifying the integrity, accuracy, and legitimacy of training data before it enters the model pipeline. Data validation includes checking for anomalies, unexpected patterns, malicious modifications, and inconsistencies that would indicate poisoned samples. This preventive approach stops corrupted data from ever reaching the model, making it the best mitigation.
Why the other options are wrong
- B. Intrusion detection is designed to detect network-based attacks, not malicious modifications to training datasets themselves.
- C. Digital watermarking protects model ownership and integrity but does not prevent poisoned training data from being used.
- D. Dataset restoration is a recovery measure after poisoning is discovered, not a preventive control that mitigates the initial risk.
Question 116
Which of the following is the GREATEST risk for an organization that has adopted AI-powered chatbots for its customer service platform?
Show answer and explanation
Correct answer: B. Prompt injection
Prompt injection is the greatest risk for AI-powered chatbots because users can craft malicious inputs designed to manipulate the chatbot's behavior, bypass safety guidelines, extract sensitive information, or perform unintended actions. This attack is practical, easy to execute, and directly exploits the chatbot's interaction model with user inputs.
Why the other options are wrong
- A. Model distillation is a legitimate technique for creating smaller models and isn't typically a security threat to customer service platforms.
- C. Model inversion attacks are theoretical and complex; they're not practical threats to deployed chatbot systems.
- D. Data poisoning requires access to training data during training; it's not a direct risk from customer interactions with a deployed chatbot.
That was 116 of 463.
The full ISACA AAISM pack has all 463 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 231 free as one PDF by email. Get the Half Pack →