ISACA Advanced in AI Security Management (AAISM) Practice Test

These questions are part of the practice quiz. Start practicing

• What does Adversarial Machine Learning refer to in the MAESTRO model?
• In the four-step PIA data inventory, which step determines what information to collect?
• ROI stands for?
• What are the four primary risk categories defined by the EU AI Act?
• Who should be designated as the AI Lead in an organization?
• What is the goal of incident response (IR)?
• What is the first step in the AI Risk Management Life Cycle?
• The impact of AI on the threat landscape is best described as?
• What is AI's role in Security Information and Event Management (SIEM)?
• What is the role of transparency in AI systems?
• What is the role of human oversight in AI deployment?
• Adversarial Attacks are best described as?
• What does the Enterprise Risk Pyramid illustrate?
• How does AI contribute to Network Security?
• Which rationale explains the need to adapt risk management techniques for AI?
• What is the goal of a risk assessment in AI?
• Which contract-level practice helps address IP concerns and lawful data sourcing in AI risk management?
• Explainability in AI refers to what?
• In AI governance, what can make measuring success difficult?
• Which statement best captures the trend in AI governance?
• What is the primary purpose of AI asset identification?
• Which practice aligns with reducing AI vulnerabilities through testing?
• What is COBIT's application to the AI life cycle?
• What organizational response is commonly required when automation displaces workers due to AI?
• What is a Privacy Impact Assessment (PIA)?
• Lack Of Explainability/Transparency In AI hampers ability to do which?
• What is the role of the enterprise's governing body in AI governance?
• What are Model Cards?
• What does 'Fit for Purpose' mean in AI solutions?
• Which of the following are common elements in AI value alignment?
• A common benefit of AI in business is?
• What regulatory compliance issues do AI systems face?
• What is the purpose of implementing stricter access controls in AI systems?
• Insider Threats in AI refer to?
• What is the function of AI in threat intelligence?
• How can organizations address content authenticity issues like deepfakes?
• In AI Threat Modeling, which elements are identified to create an end-to-end risk picture?
• Which of the following is a key element listed for Model Cards?
• What is a Cost-Benefit Analysis (CBA) in the context of AI implementation?
• Which of the following is a stated use of AI in business decision-making?
• Which of the following is NOT one of the Five Vs of Big Data?
• Why is transparency important in AI solutions?
• In the sequence of the NIST AI RMF, which function is performed third?
• What is the impact of AI on the evolving threat landscape?
• Which component describes how the AI solution solves the problem?
• What is the black-box problem in AI?
• What is the significance of adaptive learning algorithms in AI incident response?
• Which practice helps ensure ongoing alignment between AI initiatives and an organization’s strategy?
• Which aspects of AI characteristics contribute to governance complexity?
• What does value alignment mean in the context of AI?
• Risk assessment in AI policy development is intended to identify what?
• What best practice supports effective incident response automation?
• Which activity is part of stakeholder engagement best practices in AI?
• What is the purpose of ongoing oversight for AI vendors?
• What are rogue AI behaviors?
• What is the NIST AI RMF?
• Which option describes how data scarcity can be mitigated?
• Which measure would most effectively reduce the risk of training data leakage?
• Which of the following describes common risks in AI development?
• What is the purpose of business continuity and incident response in AI governance?
• Which of the following is NOT a component of a business case for AI?
• Why is data quality considered paramount in AI systems?
• Which statement best distinguishes Accept and other risk response strategies?
• Which risks are explicitly managed within AI governance?
• Data sensitivity refers to specialized handling required for which types of data?
• What is the challenge in defining an AI incident?
• What are the potential impacts of AI vendor lock-in?
• Which of the following is NOT a guiding principle for AI according to OECD?
• Which groups are identified as internal stakeholders in AI governance?
• Which objective is addressed by auditing AI decisions for fairness and validity?
• Which elements are essential for mitigating data leakage and AI misuse in an AI security program?
• What is the challenge associated with achieving benefits from AI?
• An example of an adversarial attack is?
• Which of the following is NOT a risk category under the EU AI Act?
• What is required for high-risk AI solutions under the EU AI Act?
• Which element in an AI Charter represents formal authorization to proceed?
• What does the AI software supply chain risk entail?
• Which statement best describes the relationship between interdisciplinary collaboration and AI value alignment?
• What does compliance ensure in AI deployments?
• What is a key significance of AI in vulnerability analysis?
• Why is senior management support crucial for an AI security program?
• Who is responsible for establishing risk appetite and tolerance in AI risk management?
• What is a primary objective of post-incident validation before reactivation?
• What should be assessed during the initial onboarding of AI vendors?
• What legal risks are associated with AI?
• Which elements should be included in the purpose and scope statement of an AI AUP?
• What is a Fundamental Rights Impact Assessment (FRIA)?
• What is the final step after an AI incident?
• To develop a common internal standard for data classification, which groups should be involved?
• What should organizations do to foster an inclusive AI ecosystem?
• Significance of scenario planning in AI projects?
• What is the purpose of maintaining traceability in AI governance?
• What is Prompt Injection?
• In AI risk contexts, what does Misinformation refer to?
• Which factor is most influential to the success of an AI policy during drafting?
• Data Privacy and Security risk entails?
• What is the primary goal of moving from reactive to proactive readiness in incident response?
• How does AI enhance traditional incident response?
• What is Shadow AI?
• Which statement best describes a core benefit of AI-powered incident response?
• What is the difference between AI solutions and traditional IT assets?
• What best characterizes AI model catalog maintenance?
• Which role is NOT typically on an AI Steering Committee?
• In the four-step data inventory for a Privacy Impact Assessment, which action is performed during Publish?
• What are the key components of the recovery process after an AI incident?
• Why is model documentation important in incident response?
• Which term best describes hallucination attacks in AI systems?
• What is required for High-Risk AI under the EU AI Act?
• What is the importance of data security in AI?
• Which statement best describes how a Privacy Impact Assessment relates to privacy regulations?
• What is the goal of an Ethical Impact Assessment (EIA)?
• Disaster recovery in AI security is critical because it ensures organizations can do what after a security incident?
• Examples of AI use cases?
• What is the primary role of access control in AI security?
• Which option correctly reflects a stated environmental concern associated with AI deployments?
• What is a mitigation strategy for advanced threats in AI?
• What should be defined in the purpose and scope of an AI AUP?
• What is the purpose of tabletop exercises in AI incident response?
• What is the Competitive risk in AI threats?
• What are Critical Data Elements (CDEs)?
• What capability does AI provide in SIEM to assist security analysts?
• What is the role of anomaly detection in AI incident response?
• What is meant by AI readiness assessment?
• Which risk category involves threats arising from fragmented AI regulations across regions?
• Which outcome does the primary aim of ethical AI development seek?
• What are some challenges faced by AI-powered incident response?
• What are the consequences of failure in AI systems?
• Which item is NOT typically part of a Model Card?
• What is a major challenge when defining metrics for AI governance?
• Before drafting an AI AUP, which understanding is essential?
• What are Key Risk Indicators (KRIs) in AI security?
• What are Fines/Penalties in the context of AI risks?
• What is the significance of ethical AI development?
• Which outcome is commonly associated with bias in AI hiring?
• Which sequence correctly outlines the four steps to creating a data inventory for a Privacy Impact Assessment (PIA)?
• Which term describes vulnerabilities in any component that an AI system relies on, which could compromise the entire stack?
• What is the purpose of an AI Steering Committee?
• Which OECD principle focuses on openness and disclosure of AI system capabilities and limitations?
• Deepfake content contributes to which societal risk?
• What is the significant advantage of AI-powered incident response in terms of response time?
• Who must understand the organization's AI vision and strategies?
• What should the glossary section of an AI policy do?
• What best defines Training Data Leakage?
• Which item is typically included in an AI Charter?
• Data balancing addresses data imbalance by increasing minority class samples; which approach is commonly used?
• What does the term 'Accept' mean in AI Risk Response Strategies?
• Which practice helps ensure regulatory alignment during AI incident response?
• What does unplanned adoption refer to in AI?
• What does the OECD model describe regarding the AI life cycle?
• What type of cybercrime can AI facilitate?
• Which data quality dimension measures how up-to-date data is?
• Which of the following is NOT an essential element of an AI security program?
• How does AI impact Productivity?
• Which group is typically NOT considered a key governance role?
• Which is NOT a dimension of Data Quality?
• Which factor most directly contributes to training data leakage?
• Define AI Deployer.
• What does 'Security by Design' mean in AI cybersecurity programs?
• What is the purpose of a cost-benefit analysis in AI implementation?
• Why is compliance significant in AI deployment?
• Which scenario best illustrates vendor lock-in risk in AI?
• Which statement best describes AI's contribution to network security analytics?
• What does Vendor Lock-in/Dependency refer to?
• What is a key practice for ensuring fairness in AI?
• Which is a clear sign that data is not fit for purpose?
• What are the four key functions of the NIST AI RMF?
• What are key components of a defined AI governance system?
• Which statement correctly reflects factors considered for risk limits in AI governance?
• What is the role of standardization in data classification?
• What consumer concern is associated with AI?
• What vulnerabilities do AI platforms face?
• Overreliance on AI implies what behavior?
• What is the purpose of AI ethics frameworks?
• Why is it important to adapt existing risk management techniques for AI?
• Penalties for noncompliance with the EU AI Act?
• In AI-enabled security analytics, what is a common benefit?
• What is crucial for comprehensive AI policy development?
• What risk can damage reputation due to supplier behavior?
• Which group is primarily responsible for articulating the organization's AI vision and strategies?
• Explainability in AI typically involves which practice?
• What are the responsibilities of IT and Technical Teams in AI?
• What is the importance of explainability in AI?
• What is the purpose of change management in data protocols?
• Which risk category focuses on legal accountability and penalties for privacy violations in AI?
• What is the purpose of a Privacy Impact Assessment (PIA)?
• How do auditing capabilities support accountability in AI systems?
• In the context of AI security, what is a typical consequence of hallucination attacks when deployed publicly?
• What does the term Excessive Agency signify in LLM applications?
• In AI deployment, who is primarily responsible for managing risks in the deployed environment?
• What is a common expectation regarding ROI in the early stages of AI implementation?
• Which statement best describes the primary objective of AI governance in relation to business objectives?
• What is an AI Charter?
• What is the goal of long-term selective retraining in AI?
• Data Poisoning is best defined as?
• What is the difference between AI providers and deployers?
• What best describes the role of the Incident Response Team?
• In the four-step PIA data inventory, which step involves collecting information using various techniques?
• What is a major concern regarding AI bias?
• What is a primary purpose of watermarking, digital signatures, and media forensics in media content?
• Who typically composes an AI Steering Committee?
• What does Adversarial Inference aim to achieve?
• Which statement best describes the What-If Tool's use in model evaluation?
• AI Fairness 360 is best described as what?
• Which statement best distinguishes unstructured data from structured data?
• What metrics are important for AI governance?
• What is the focus of the Assess phase in incident response?
• What does AI hype adoption refer to?
• What are the two main options for AI adoption?
• What should a postmortem review of an AI incident focus on?
• What are some use cases of AI-driven incident response?
• What is the likely outcome if AI governance, compliance, and risk management are neglected?
• Identify the option that is NOT a detection technique for AI attacks.
• What is the focus of 'Securing AI'?
• What is a fundamental principle behind using AI for phishing detection?
• What does the AI policy establish?
• What are the essential elements of an AI security program?
• What are the environmental concerns related to AI?
• Which data-related risk is critical to address to prevent AI security issues?
• Which statement best describes a data dictionary's focus?
• Which of the following is a benefit of an internal hosting strategy for AI?
• Which source is cited as important for staying updated on AI-related threats?
• Which statement best captures the purpose of disclosing AI use in governance?
• Prompt injection prevention is best described by which practice?
• Which statement differentiates AI Provider from AI Deployer?
• What does model drift refer to?
• What are the two orientations of Dataflow Diagrams?
• Which factor is NOT listed as a consideration when establishing acceptable AI risk limits?
• Which organizations provide ethical guidelines used in AI security?
• Which process is required before production use to address privacy in AI?
• What is a key consideration in AI vendor management?
• What is a Dataflow Diagram (DFD)?
• Which combination best supports responsible AI governance during development?
• How can AI be used for security?
• In AI governance, which indicators measure risk related to biased outcomes?
• Which factor is central to ensuring AI fairness and accountability?
• What describes stealing an enterprise's proprietary algorithms and parameters to replicate AI-driven services?
• Which component is used to align data across multiple applications with a shared meaning?
• Which factor enables AI to improve incident response decision-making?
• What steps can be taken to prevent bias in AI systems?
• Why is senior management support essential in AI policy development?
• Why is defining AI acceptable use policies important?
• What is a common challenge in AI vendor management?
• What describes vulnerabilities in any component relied upon by the AI system that can compromise the entire system?
• What is a major IP concern in AI?
• Which of the following are key components of an AI Charter?
• Why is it important to have key stakeholder representation on the Incident Response Team?
• What is the significance of AI integration with legacy systems?
• The MAESTRO model in AI Threat Modeling emphasizes what?
• What does the AI risk assessment framework aim to manage?
• How is human oversight described for AI deployments?
• Importance of risk management in AI initiatives?
• What is the role of surveys in AI inventory gathering?
• Role of data sheets in AI governance?
• What is the purpose of AI procedures and manuals?
• Which practices are commonly used to ensure data quality?
• Tabletop exercises in AI incident response are designed to train on which aspect?
• Which action most improves accountability and trust in AI outputs by users?
• Which outcome is a characteristic of the recovery phase?
• Why is regulatory compliance important in AI governance?
• Following significant regulatory changes, what is the recommended organizational action?
• What are the main elements of a Responsible Use of AI (RAI) program?
• What can lead to reputational risks in AI vendor relationships?
• Unbounded Consumption in AI risk refers to?
• Which of the following is a key attribute for trustworthy AI?
• What does the term 'AI ethics frameworks' refer to?
• What are key principles of responsible AI usage?
• Which of the following statements best reflects the rationale for evaluating vendor reputation in AI sourcing?
• What is the purpose of Model Cards in AI?
• In AI governance, what is the purpose of risk management?
• Which elements are typically included in a Model Card?
• What is the role of AI deployers in risk management?
• What is data lineage?
• What makes data poisoning challenging to detect compared with traditional data loss?
• What does the EU AI Act regulate?
• What does the Transfer/Share strategy in AI Risk Response entail?
• Which practice is central to maintaining safe AI systems over time?
• How does AI affect workforce dynamics?
• Ethical concerns in AI include which issue?
• What is the purpose of a cross-functional team in AI strategy creation?
• Data balancing helps prevent biased results by ensuring the training data adequately represents all classes.
• Which is a limitation of cloud hosting for AI?
• What are the core responsibilities of the governing body regarding AI?
• Which risk is highlighted by the use of AI in facial recognition?
• Which category denotes data that can be shared externally with minimal restrictions?
• Which of the following is least likely to be analyzed in a Privacy Impact Assessment (PIA)?
• The OECD AI Principles are intended to guide AI toward which of the following?
• What is the purpose of AI Threat Modeling?
• What does the AI Acceptable Use Policy dictate?
• Which ISO 27035-1 phase focuses on learning from incidents to improve future responses?
• What is a key insight regarding security considerations in AI?
• The OECD AI life cycle framework includes which of the following stages?
• What is a recommended practice for monitoring AI systems?
• What is the purpose of conducting a risk assessment in AI policy development?
• Which item is not typically included in a business case for AI?
• What is a major concern regarding fairness in AI solutions?
• What is a challenge associated with AI model drift?
• What questions should be considered for AI governance and management?
• How can organizations use AI to create procedures and manuals?
• How does AI contribute to phishing detection and spam filtering?
• Which long-term strategy is described for eradicating data poisoning in AI systems?
• AI Fairness 360 is designed to help with which capability in machine learning?
• Which societal issue arises from inauthenticity and fake media?
• What is the purpose of the What-If Tool?
• What is the ISO/IEC 42001 standard?
• Where should AI risks be integrated into organization-wide governance?
• What are common AI Threat Actors?
• What is AI readiness?
• Which topic best captures the regulatory focus described for AI systems?
• What should organizations do to manage AI-related risks?
• Which outcome is associated with transparency and explainability in AI systems?
• What is a potential mitigation for denial of service attacks in AI?
• What risk is associated with AI systems that function as a black box?
• Which containment techniques for AI incidents include deploying data input/output validation and revoking access to datasets?
• Which challenge is commonly associated with AI-powered incident response?
• An Ethical Impact Assessment primarily evaluates which aspects of AI systems?
• What is the impact of AI on innovation in businesses?
• What is the primary goal of Model Cards?
• Which risk describes the potential loss of market position due to data/model theft or adversarial manipulation?
• Common AI project failure factors?
• What are the OECD AI Principles?
• What are the Response costs related to AI threats?
• What best practices should be followed for stakeholder engagement in AI?
• What is the purpose of a business glossary in AI data management?
• What is required for AI models to remain effective against evolving threats?
• Which are mitigation strategies for data scarcity?
• What is the goal of creating trustworthy AI?
• Which of the following is an expected societal adaptation due to AI?
• What does an AI governance framework aim to align with?
• In AI governance, what does data confidence primarily guarantee?
• What is the first step before creating an AI Acceptable Use Policy?
• Lack of Explainability/Transparency in AI implies?
• Which statement best describes the relationship between an AI security program and organizational objectives?
• What is the primary objective of AI inventory procedures?
• What is a significant challenge in the AI workforce?
• Which combination of AI attributes most likely complicates governance?
• AI policies must align with which of the following?
• What is the impact of data quality issues on AI models?
• What is the role of employees in AI initiatives?
• What type of errors occur when a sample is not representative of the population in AI?
• What is the purpose of AI governance?
• What does Behavioral AI (BAI) focus on?
• A successful model backdoor attack could primarily threaten which aspect of a business?
• What does prompt injection involve in AI security?
• Value alignment in AI refers to ensuring AI behaves in ways consistent with what?
• During the initial onboarding of AI vendors, which of the following is emphasized?
• Which statement best describes the distinction between AI solutions and traditional IT assets?
• What does AI asset and data lifecycle management involve?
• In the context of AI security, what should a postmortem review identify as areas for improvement?
• What should the AI inventory process emphasize?
• What best describes the 'Avoid' option in AI risk response?
• Which combination best represents standard data quality practices?
• What are AI Key Performance Indicators (KPIs)?
• Which statement best describes the Assess phase in incident response?
• What is the significance of Data Classification?
• Which challenges does AI face in incident management?
• What is a potential consequence for organizations that do not adopt AI in competitive environments?
• Which organization provides the Top 10 list tailored to risks in LLM applications?
• What ethical concern arises when AI causes harm?
• What does continuous learning in AI incident response entail?
• Which of the following is a use case of AI-driven incident response?
• What is the focus of external stakeholders in AI?
• What is a major impact of AI on employment?
• What is the significance of internal validation in AI asset identification?
• What does the principle 'Trust but Verify' imply in AI security?
• Key privacy compliance consideration regarding privacy in AI?
• In COTS AI deployments, which factor most directly affects accountability?
• What should organizations assess to inform AI policy clauses?
• What is data poisoning?
• What is the significance of the OECD AI Principles?
• What is the purpose of adversarial testing in AI?
• Which practice enhances the likelihood of AI policy adoption by stakeholders?
• What role does AI play in Security Information and Event Management (SIEM)?
• Which item is commonly tracked as an AI performance KPI?
• What does data poisoning do?
• What is an AI strategy?
• What current trend is observed in AI governance?
• The RAI Maturity Matrix primarily assesses what aspect of an organization's AI program?
• What roles are necessary for effective AI governance?
• What phenomenon occurs when AI models trained on historical data become less accurate over time due to new data?
• What benefit does AI provide in root cause analysis during incident response?
• What is the importance of maintaining an AI model catalog?
• What is the purpose of Acceptable Use Policies (AUPs) in AI security?
• What financial risks are associated with AI?
• What is the role of a cross-functional team in AI strategy creation?
• Which of the following is NOT typically considered a ROI metric for AI projects?
• What must ethically designed AI solutions ensure?
• What outcome is associated with maintaining compliance monitoring for AI policies?
• What is a Model backdoor attack?
• What is the aim of the AI risk assessment framework?
• The four categories of risk classification in the EU AI Act?
• Which statement best captures the purpose of keeping humans in the loop within AI governance?
• Define AI Provider.
• What is the role of AI in supply chain and vendor management?
• What does the COBIT framework help manage in AI security?
• The EU AI Act mandates transparency and human oversight for which type of AI?
• Why is training considered important in AI policy implementation?
• What primary problem do AI solutions aim to solve in businesses?
• Which are unique cost considerations when implementing AI?
• What are the risks associated with biased or incomplete training data in AI?
• Model Inversion involves what?
• Which statement best describes the EU AI Act's risk categorization compared to the NIST RMF?
• What best describes the function of metadata for data assets?
• What risk arises from a speed disparity between automated learning systems and human compliance controls?
• What is a best practice for incident response automation?
• What are the benefits of AI-powered incident response?
• What is a primary capability of GenAI tools in threat intelligence?
• In the context of Commercial Off-The-Shelf AI solutions, what is a key accountability issue?
• Which stakeholder group emphasizes data privacy and transparency regarding AI?
• What is the Reputational risk associated with AI?
• Which item is NOT typically a key element of a Model Card?
• What ethical considerations should be included in an AI security program?
• What is the purpose of AI security controls?
• What is metadata in relation to data assets?
• What is the importance of auditing capabilities in AI tools?
• What is a data catalog?
• Which statement defines Model Evasion?
• Which of the following is a direct containment technique for AI incidents?
• Why is data confidentiality important in AI development?
• Which technologies are cited for standardizing and automating SOP creation in AI policy development?
• The OWASP Top 10 for LLM Applications describes which of the following?
• What is the role of ethical considerations in AI strategies?
• Which function of GenAI is highlighted in vulnerability management?
• What are the limitations of a cloud hosting strategy for AI?
• What risk is associated with overreliance on AI?
• What is the significance of interdisciplinary collaboration in AI value alignment?
• Why is threat intelligence important for AI security?
• What does Avoid mean in the context of AI risk response strategies?
• What is the goal of the European Union Artificial Intelligence Act?
• Which are the phases of the ISO 27035-1 process for handling security incidents?
• In the four-step PIA data inventory, which step collates and publishes the metadata?
• Penalties can reach up to what amount or percentage?
• What is a best practice for managing data lineage in an organization?
• Data Poisoning is defined as?
• What is a key consideration when deciding between building or buying AI solutions?
• In the four-step PIA data inventory, which step defines scope, stakeholders, and resources?
• How does AI-powered incident response differ from traditional incident response in data analysis?
• AI Regulatory Risk describes threats from what?
• In a Responsible Use of AI program, which outcome is prioritized by keeping humans in the loop?
• What should organizations periodically review based on risk?
• Which technique is associated with increasing resilience against adversarial inputs?
• How does AI improve threat detection and prevention?
• Data and Model Poisoning refers to which practice?
• Which option is NOT a main element of a Responsible Use of AI (RAI) program?
• Which item is not typically listed as a key component of an AI Charter?
• Which option is not typically considered part of AI asset and data lifecycle management?
• Which scenario best describes unplanned AI adoption included in products?
• Which attribute in trustworthy AI addresses bias management?
• What does automated incident triage accomplish?
• Which of the following describes conformity assessments in High-Risk AI under the EU AI Act?
• Which activities are included in the identification process for AI risk?
• What is a primary concern when evaluating third-party AI solutions?
• Which activity is most essential for maintaining AI policy compliance over time?
• What is the significance of compliance automation in AI incident response?
• What societal adaptations may organizations need to make due to AI?
• In AI supply chain risk, which consequence is associated with processing large data volumes?
• What is the role of the introduction section in an AI policy?
• Why are transparency and explainability important in AI?
• Why is a clear AI vision important?
• Which group is included among common AI threat actors?
• Which activities are considered detection techniques for common AI attacks?
• What is the role of internal audit in AI governance?
• What can lead to brand reputation damage in AI usage?
• What distinguishes risk classification in the EU AI Act from the NIST AI RMF?
• What is the environmental impact of AI solutions?
• What risks are associated with AI in supply chain solutions?
• What does FRIA stand for?
• What are the consequences of bias and discrimination in AI?
• In the context of incident management, which statement reflects a challenge?
• Why are thorough risk assessments important in vendor management?
• Which combination of actions supports an inclusive AI ecosystem?
• Which categories are included in the STRIDE model?
• What risks are associated with AI bias and errors?
• Which of the following is NOT a common element in AI value alignment?