Advanced in AI Security Management (AAISM)

Last checked October 22, 2026 against the official ISACA exam page.

1. Question 1AI Risk Management

   An AI system will make credit decisions. Which risk assessment approach best identifies the risks before deployment?

   1. AA review of the system's logo and branding to ensure it matches the company's image
   2. BA threat and impact analysis covering data, model behaviour, misuse and affected individuals
   3. CA check of how many features the system will have in its first year of operation only
   4. DA count of the number of servers that the system will need to run in production each day
   Show answer and explanationHide answer

   Correct answer: B

   A threat and impact analysis considers data, model behaviour, misuse and the effect on affected individuals, which is what credit decisions require. Branding, server counts and feature counts do not identify the risks.

2. Question 2AI Governance and Program Management

   An organisation is adopting generative AI across several business units with no common rules. Which governance action should the AI security manager recommend first?

   1. AApprove each business unit's tool purchase individually, as requests arrive from the teams
   2. BEstablish an AI policy and an accountable governance body with clear decision rights
   3. CLet each business unit set its own acceptable-use rules, so that rules fit local needs
   4. DBlock all AI use until the technology matures, so that no governance is needed for now
   Show answer and explanationHide answer

   Correct answer: B

   A common AI policy and an accountable governance body with defined decision rights create consistent rules across the units. Case-by-case purchases, unit-by-unit rules and blanket bans each leave the organisation without a coherent control set.

3. Question 3AI Technologies and Controls

   Which AI-specific risk arises when small, deliberate input changes cause a model to make wrong predictions?

   1. AModel evasion, where small input changes cause the model to produce wrong predictions
   2. BDuplicate records in the database, which inflate counts in the reports the business reads
   3. CSlow dashboards, which delay the reports that the business uses for its daily decisions
   4. DUnpatched printer firmware, which lets an attacker print documents from the office network
   Show answer and explanationHide answer

   Correct answer: A

   Evasion through adversarially altered inputs is a specific AI risk that changes model outputs while looking normal to people. Duplicate records, slow dashboards and printer firmware are general IT issues rather than AI-specific risks.

4. Question 4AI Risk Management

   Which NIST framework provides a structure with functions named Govern, Map, Measure and Manage for managing AI risk?

   1. AThe NIST AI Risk Management Framework, which organises AI risk work into those four functions
   2. BNIST SP 800-171, which sets the security requirements for controlled unclassified information
   3. CNIST CSF 1.1 in its original form, which lists identify, protect, detect, respond and recover
   4. DThe NIST Cybersecurity Framework's privacy add-on, which is focused on consumer data protection
   Show answer and explanationHide answer

   Correct answer: A

   The NIST AI Risk Management Framework organises AI risk management into Govern, Map, Measure and Manage. The other NIST documents cover different topics such as controlled information or general cybersecurity functions.

5. Question 5AI Governance and Program Management

   Which standard is an AI management system standard that an organisation can be certified against?

   1. ANIST SP 800-53, which is a catalogue of security controls for federal systems
   2. BISO/IEC 42001, which specifies requirements for an AI management system
   3. CITIL, which describes practices for managing IT services across their life cycle
   4. DPCI DSS, which sets the requirements for protecting cardholder data in payments
   Show answer and explanationHide answer

   Correct answer: B

   ISO/IEC 42001 specifies requirements for an AI management system and can be certified against. NIST SP 800-53, PCI DSS and ITIL are valuable references but do not provide a certifiable AI management system standard.