ISACA AAISM Certification Certified Official Practice Test AAISM – Nov-2026 [Q249-Q272]

Rate this post

ISACA AAISM Certification Certified Official Practice Test AAISM – Nov-2026

Ace ISACA AAISM Certification with Actual Questions Nov 03, 2026 Updated

ISACA AAISM Exam Syllabus Topics:

Section	Weight	Objectives
AI Technologies and Controls	38%	– AI Assurance and Safety 1. Bias mitigation 2. Ethical AI controls 3. Model validation and testing – AI Security Architecture 1. Secure AI system design 2. Model lifecycle security – Data and Model Controls 1. Monitoring and runtime controls 2. Privacy-preserving techniques 3. Data protection and governance
AI Governance and Program Management	31%	– AI Governance Foundations 1. Stakeholder considerations 2. Organizational structure and governance 3. Roles and responsibilities – Frameworks and Compliance 1. Industry frameworks and standards (e.g., NIST AI RMF, ISO/IEC 42001) 2. Privacy and ethics considerations 3. Regulatory requirements – AI Strategy and Policy 1. Responsible and acceptable use 2. Policies and procedures 3. AI strategy development
AI Risk Management	31%	– AI Threats and Vulnerabilities 1. Supply chain and vendor risks 2. Adversarial AI and ML attacks 3. Data poisoning and model manipulation – AI Risk Assessment 1. Risk thresholds and treatment 2. Risk identification and analysis

Section

Weight

Objectives

AI Technologies and Controls

38%

– AI Assurance and Safety

1. Bias mitigation
2. Ethical AI controls
3. Model validation and testing

– AI Security Architecture

1. Secure AI system design
2. Model lifecycle security

– Data and Model Controls

1. Monitoring and runtime controls
2. Privacy-preserving techniques
3. Data protection and governance

AI Governance and Program Management

31%

– AI Governance Foundations

1. Stakeholder considerations
2. Organizational structure and governance
3. Roles and responsibilities

– Frameworks and Compliance

1. Industry frameworks and standards (e.g., NIST AI RMF, ISO/IEC 42001)
2. Privacy and ethics considerations
3. Regulatory requirements

– AI Strategy and Policy

1. Responsible and acceptable use
2. Policies and procedures
3. AI strategy development

AI Risk Management

31%

– AI Threats and Vulnerabilities

1. Supply chain and vendor risks
2. Adversarial AI and ML attacks
3. Data poisoning and model manipulation

– AI Risk Assessment

1. Risk thresholds and treatment
2. Risk identification and analysis

NO.249 Which of the following strategies BEST ensures generative AI tools do not expose company data?

Conducting an independent AI data audit

Testing AI tools before implementation

Implementing a solution to prohibit the input of sensitive data

Ensuring AI tools are compliant with local regulations

NO.250 Which of the following should be included in an AI acceptable use policy?

AI training data requirements

Data collection and storage processes

Ethical and legal compliance standards

AI monitoring requirements

NO.251 Which of the following is the BEST method to uncover known vulnerabilities in an AI-based web application that has been recently deployed?

Dynamic application security testing (DAST)

Static application security testing (SAST)

Runtime application self-protection (RASP)

Interactive application security testing (IAST)

NO.252 Which of the following is the BEST reason to immediately disable an AI system?

Excessive model drift

Slow model performance

Overly detailed model outputs

Insufficient model training

NO.253 Which of the following would BEST help to prevent the compromise of a facial recognition AI system through the use of alterations in facial appearance?

Enhancing training data to increase variance

Monitoring the system for misuse cases

Fine-tuning the AI model to decrease hallucinations

Implementing a secondary AI system to confirm images

NO.254 A retailer’s AI-driven dynamic pricing system failed after its feature store was corrupted, resulting in all prices being set to zero. The data source has been isolated, and management demands immediate recovery. Which of the following is the MOST appropriate course of action to restore operations while minimizing impact?

Failover to a secondary environment and retrain the model with recent data.

Revert to the previous AI model and validate backup of the feature store.

Keep the system offline and conduct a full forensic investigation.

Require customer service to manually price and approve orders until the AI system is fully restored.

NO.255 Which of the following is the MOST effective action an organization can take to address data security risk when using generative AI features in an application?

Rely on the AI provider’s independent third-party audit reports for assurance

Establish policies and awareness training for acceptable use of AI

Require opt-out provisions for data usage in service agreements

Establish guidelines and best practices with third parties for intellectual property ownership

NO.256 An organization is adopting an agentic AI solution from an external vendor to support internal IT operations. Which of the following provides the MOST reliable and independently verifiable evidence of implemented security controls?

Industry benchmarking peer review

Third-party audit reports

Internal red-team testing reports

General AI security whitepapers

NO.257 An organization recently introduced a generative AI chatbot that can interact with users and answer their queries. Which of the following would BEST mitigate hallucination risk identified by the risk team?

Performing model testing and validation

Training the foundational model on large data sets

Ensuring model developers have been trained in AI risk

Fine-tuning the foundational model

NO.258 Which of the following approaches BEST enables the separation of sensitive and shareable data to prevent an AI chatbot from inadvertently disclosing confidential information?

Zero Trust

Sandboxing

Siloing

Containerization

NO.259 An organization is implementing a large language model (LLM) to answer questions for both employees and customers. The CIO wants the LLM to provide employees with additional internal data that should not be shared with customers. Which of the following is the MOST secure approach?

Retrieval-augmented generation (RAG) with access control lists (ACLs)

Model fine tuning with increased use of function calls

Prompt sanitization

Allow list employee access

NO.260 When creating a charter for an AI governance committee, which clause is MOST critical to ensure long-term alignment between AI initiatives and enterprise strategy?

Requirement for annual executive board review and explicit approval of AI strategy, risk appetite, and major investments

List of approved machine learning (ML) frameworks and cloud platforms for use by the development team

Assignment of responsibility for daily monitoring of model performance metrics to the lead data scientist of each project

Requirement for all AI projects to complete a privacy impact assessment (PIA) before deployment

NO.261 A large language model (LLM) has been manipulated to provide advice that serves an attacker’s objectives. Which of the following attack types does this situation represent?

Privilege escalation

Data poisoning

Model inversion

Evasion attack

NO.262 An organization is reviewing an AI application to determine whether it is still needed. Engineers have been asked to analyze the number of incorrect predictions against the total number of predictions made. Which of the following is this an example of?

Control self-assessment (CSA)

Model validation

Key performance indicator (KPI)

Explainable decision-making

NO.263 Which of the following is the MOST effective use of AI-enabled tools in a security operations center (SOC)?

Employing AI-enabled tools to reduce false negatives by detecting subtle attack patterns

Using AI-enabled tools exclusively to classify all types of security incidents

Replacing human analysis with automated AI decision-making processes

Assigning AI-enabled tools to triage non-critical alerts to preserve SOC resources

NO.264 A school district contracts a third-party provider for AI-based curriculum recommendations. Which of the following is the BEST way to ensure the vendor uses AI responsibly?

Confirming the AI solution supports single sign-on (SSO)

Verifying the vendor has updated terms of service

Requiring the vendor to provide the model card

Ensuring the vendor offers 24/7 technical support

NO.265 Which of the following is the MOST serious consequence of an AI system correctly guessing the personal information of individuals and drawing conclusions based on that information?

The exposure of personal information may result in litigation

The publicly available output of the model may include false or defamatory statements about individuals

The output may reveal information about individuals or groups without their knowledge

The exposure of personal information may lead to a decline in public trust

NO.266 Which of the following BEST describes the role of transparency in AI?

Talking through a decision tree to better understand how the algorithm made each of its choices

Publishing AI mechanisms, data sources, and decision-making processes while making them openly available

Explaining the AI system in an understandable and logical way so reasons for decisions can be given

Persuading someone that the AI tool in use is beneficial and operates as expected

NO.267 A large financial institution is integrating a third-party AI solution into its fraud detection system. Which is the BEST way to reduce AI vendor/supply chain risk?

Conduct annual vulnerability assessments after integration

Establish contractual agreements requiring evidence of secure development practices

Use isolated virtual environments to validate integration

Focus on performance testing

NO.268 An organization has discovered that employees have started regularly utilizing open-source generative AI without formal guidance. Which of the following should be the CISO’s GREATEST concern?

Lack of monitoring

Policy violations

Data leakage

Model hallucinations

NO.269 Which of the following is the MOST likely reason an information security manager would require continuous test, evaluation, verification, and validation (TEVV) for AI systems in a production environment?

Ongoing verification helps meet legal and regulatory compliance requirements.

The underlying data distribution used initially changes over time and can affect system accuracy.

Continuous TEVV helps reduce support, maintenance, and resource requirements.

Continuous TEVV requirements are essential to meet industry benchmarks.

NO.270 An AI application development team has been given access to user information and now must format it to be readable by the AI model. During which phase of the data life cycle would this MOST likely occur?

Data collection

Data normalization

Data minimization

Data preparation

NO.271 Which of the following AI data life cycle phases presents the GREATEST inherent risk?

Training

Maintenance

Monitoring

Preparation

NO.272 An automotive manufacturer uses AI-enabled sensors on machinery to monitor variables such as vibration, temperature, and pressure. Which of the following BEST demonstrates how this approach contributes to operational resilience?

Scheduling repairs for critical equipment based on real-time condition monitoring

Performing regular maintenance based on manufacturer recommendations

Conducting monthly manual reviews of maintenance schedules

Automating equipment repairs without any human intervention