ISACA AAISM Practice Questions with Explanations

Correct answer: C

Scanning packages and libraries for malware before installation is a critical security practice that directly protects against compromised dependencies. This is a foundational step in securing open-source software supply chains and prevents malicious code from entering the development environment. While maintaining lists, retraining, and updating are relevant practices, they do not address the fundamental integrity threat posed by potentially compromised packages.

Why the other options are wrong:

• A. Maintaining a list ensures consistency but does not verify package integrity or detect malware.
• B. Retraining the model is unrelated to detecting malicious code in package dependencies.
• D. Using the latest versions increases attack surface and does not guarantee security or integrity.

Correct answer: D

The lack of visibility into how an AI model reaches its decisions creates a fundamental explainability problem that directly undermines user trust. In business applications, especially those affecting critical decisions, stakeholders and end users need to understand model behavior to trust and accept the system. Without explainability and transparency, adoption becomes difficult regardless of technical performance, making this the greatest challenge among the options presented.

Why the other options are wrong:

• A. Risk ownership and uptime are operational concerns, not directly related to lack of model visibility.
• B. Security requirements are separate from the explainability challenge described.
• C. Transaction turnaround time is a performance metric unrelated to model interpretability.

Correct answer: C

The right to audit a third-party AI tool is the most important validation consideration because it grants the organization the ability to independently verify the tool's behavior, security, data handling, and compliance with requirements. Without audit rights, an organization has no independent recourse to validate claims or investigate issues. Terms and conditions, testing, and certifications are all valuable but are less critical than maintaining the contractual right to examine the system directly.

Why the other options are wrong:

• A. Terms and conditions are important but secondary to the ability to verify compliance through audit.
• B. Roundtable testing is useful but does not provide the organization with independent verification rights.
• D. Industry analysis and certifications are helpful context but do not provide direct verification capability.

Correct answer: C

If the risk from non-compliance falls within the organization's defined risk appetite, that becomes the justification for a deliberate risk acceptance decision. Organizations can knowingly choose not to comply with certain regulations if they have explicitly accepted the associated risk through governance processes. This is a legitimate risk management decision. The other options do not provide valid justification: industry usage does not override regulations, audits do not excuse compliance, and lack of cost analysis is poor risk management rather than a reason to avoid compliance.

Why the other options are wrong:

• A. Industry usage does not provide legal or regulatory justification for non-compliance.
• B. Regular audits do not eliminate regulatory obligations or provide exemption from compliance.
• D. Failure to determine compliance costs is a gap in risk analysis, not a valid reason to avoid compliance.

Correct answer: C

The skills matrix is the most important consideration when composing an AI red team because the team must have the right mix of expertise across security, AI/ML, domain knowledge, and technical capabilities to effectively identify and test system vulnerabilities. Without appropriate skills, the red team cannot conduct thorough adversarial testing. Resource availability, time-to-market, and use cases are secondary constraints that must work within the foundational requirement of having the right skills.

Why the other options are wrong:

• A. Resource availability is a practical constraint but is secondary to having the necessary expertise.
• B. Time-to-market constraints should not drive composition decisions that affect red team effectiveness.
• D. Understanding use cases is helpful context but does not determine what skills the team needs.

Correct answer: B

Before categorizing AI technologies by risk, the committee must first ensure all technologies are included in a comprehensive asset inventory. A complete inventory is a prerequisite for any risk assessment effort-without knowing what exists and what is documented, the categorization cannot be reliable or comprehensive. This foundational inventory work must precede risk grouping, assessment, or vulnerability identification.

Why the other options are wrong:

• A. Grouping similar products is premature without first establishing a complete inventory.
• C. Risk assessment cannot be accurate without first documenting all assets in the inventory.
• D. Vulnerability identification is a downstream activity that depends on asset inventory completion.

Correct answer: C

Human-in-the-loop controls are the most effective approach to reduce hallucination risks in high-stakes domains like pharmaceutical treatment development. By requiring human review and validation of AI-generated recommendations before they are acted upon, the organization can catch factually incorrect or nonsensical outputs before they cause harm. This is especially critical when real-world data is introduced, as it can trigger unexpected model behaviors. Penetration testing targets security vulnerabilities, data validation improves data quality but not output accuracy, and impact analysis assesses consequences rather than preventing hallucinations.

Why the other options are wrong:

• A. Penetration testing addresses security attacks, not AI hallucinations or factual accuracy.
• B. Data validation improves input quality but does not prevent the model from generating false information.
• D. Impact analysis assesses potential consequences but does not reduce the risk of hallucinations occurring.

Correct answer: D

An accountability model is the primary consideration for managing liabilities from agentic AI systems because it establishes clear responsibility for decisions, actions, and outcomes produced by the system. With autonomous or semi-autonomous AI agents that can take unforeseen actions, organizations need to define who is accountable for those actions- whether the AI vendor, the organization, specific personnel, or some combination. This accountability framework is foundational to managing legal and operational liability. Model dependencies, approved base models, and risk levels are important but secondary to establishing who bears responsibility.

Why the other options are wrong:

• A. Model dependencies relate to technical architecture but do not address accountability for system behavior.
• B. Approved base models help ensure quality but do not establish liability or accountability structures.
• C. Acceptable risk level defines tolerance but does not determine who is accountable when unforeseen behavior occurs.

Correct answer: C

Data classification is the most appropriate answer for addressing CISO security and privacy concerns when procuring training data from multiple sources. It involves categorizing data by sensitivity level, ownership, and regulatory requirements, enabling the organization to understand what data they have, where it came from, and how to handle it appropriately. This foundational step allows the CISO to apply appropriate protections, identify compliance risks, and make informed decisions about data usage.

Why the other options are wrong:

• A. Data minimization reduces data volume but doesn't address the security and privacy concerns of already-procured multi-source data that must be classified and managed.
• B. Data augmentation adds synthetic data to training sets but doesn't address security and privacy concerns about existing procured data.
• D. Data discovery identifies where data exists but doesn't directly address how to handle security and privacy concerns once located.

Correct answer: D

Analyzing the ratio of incorrect predictions to total predictions is the definition of a Key Performance Indicator (KPI)-a measurable value that shows how effectively an AI application is achieving its objectives. This metric directly assesses whether the application continues to deliver acceptable performance and value. While validation involves testing, this question specifically asks about measuring performance for decision- making regarding necessity, which is quintessentially a KPI assessment.

Why the other options are wrong:

• A. Model validation is the process of testing model performance but doesn't specifically describe the ratio of incorrect to total predictions as an ongoing performance metric.
• B. Control self-assessment is an internal audit procedure, not a performance measurement metric for AI predictions.
• C. Explainable decision-making concerns transparency in AI reasoning, not the measurement of prediction accuracy rates.

Correct answer: B

Model drift-the rate at which a model's predictions become less accurate over time due to changes in underlying data patterns-is the most critical KRI for AI systems. Drift indicates that the model is becoming misaligned with current real-world conditions, which can lead to poor decisions, compliance violations, and business harm. Detecting and responding to drift is essential for maintaining AI system reliability and safety, making it more critical than static measures like data volume or accuracy alone.

Why the other options are wrong:

• A. The amount of data in a model is a resource metric, not a risk indicator of system performance degradation.
• C. While accuracy is important, a single point-in-time accuracy rate doesn't indicate ongoing risk; drift does by showing how accuracy changes.
• D. Response time is a performance characteristic but not a key risk indicator for AI system integrity and reliability.

Correct answer: B

Implementing resilient payment approval processes is the best protection against deepfake-based payment diversions. Resilient processes include multi-step verification, secondary authorization channels, callback verification to known numbers, and transaction limits that cannot be overridden by a single communication. These control-based defenses work regardless of how convincing the deepfake is and address the fundamental vulnerability in payment authorization workflows.

Why the other options are wrong:

• A. While training helps awareness, deepfakes are increasingly sophisticated and can fool trained employees; process controls are more reliable.
• C. Restricting payment frequency doesn't prevent fraud, only delays it, and creates operational inefficiency without addressing the root vulnerability.
• D. A policy alone provides no technical or procedural protection against deepfake attacks.

Correct answer: A

Adaptive authentication dynamically adjusts authentication requirements based on risk factors such as unusual access patterns, locations, or behavioral anomalies. When a deepfake attack attempts to impersonate management and authorize sensitive actions, adaptive authentication can detect the anomalous context and require additional verification, effectively mitigating deepfake risks by not relying solely on audio or video identity verification.

Why the other options are wrong:

• B. Standard MFA adds authentication factors but doesn't specifically defend against deepfakes if the attacker can compromise or bypass those factors.
• C. Systematic data tagging organizes information but doesn't prevent or manage deepfake attacks.
• D. While blockchain provides immutability, it does not inherently prevent deepfakes or manage deepfake risk at the authentication or approval layer.

Correct answer: C

In an active crisis where a deepfake targets stock prices, the most critical immediate action is to provide clarifying information through a pre-approved public statement. This stops misinformation spread, protects market confidence, and demonstrates organizational control of the narrative. Speed and clarity are essential to prevent the deepfake from dominating public perception and affecting stock price before correction occurs.

Why the other options are wrong:

• A. Brand monitoring is useful but is a secondary response; immediate clarification prevents damage rather than tracking it.
• B. Detailed forensics is important for long-term response but takes time and delays the critical immediate message needed to contain damage.
• D. Employee training is valuable long-term but doesn't address the immediate public- facing crisis and stock price manipulation risk.

Correct answer: D

Implementing data sanitization techniques directly reduces the risk of sensitive data exposure through LLM outputs by removing, masking, or redacting sensitive information before it reaches the model or before outputs are delivered to users. This prevents the LLM from learning sensitive patterns in the first place and ensures outputs don't contain exploitable sensitive data, making it the most direct defense.

Why the other options are wrong:

• A. Least privilege access controls who can use the system but doesn't prevent the LLM from outputting sensitive data once accessed.
• B. Adversarial testing identifies vulnerabilities but doesn't prevent sensitive data exposure in normal operations.
• C. Encryption in transit and at rest protects data during movement and storage but doesn't prevent the LLM from processing and outputting sensitive information.

Correct answer: A

Enhancing training data to increase variance ensures the facial recognition system encounters diverse facial appearances, lighting conditions, angles, and alterations during training. This makes the model robust against adversarial alterations in facial appearance by teaching it to recognize faces despite variations, similar to how humans recognize friends despite changes in hairstyle, glasses, or makeup.

Why the other options are wrong:

• B. Reducing hallucinations improves general model accuracy but doesn't specifically address vulnerabilities to alterations in facial appearance.
• C. Monitoring for misuse detects attacks after they occur but doesn't prevent the system compromise itself.
• D. A secondary confirmation system adds a layer but doesn't address the fundamental vulnerability of the primary system to facial appearance alterations.

Correct answer: A

Model cards are structured documents that transparently document a machine learning model's intended use, performance characteristics, limitations, and ethical considerations. They directly support responsible AI development by providing stakeholders with critical information about the model's behavior and appropriate usage contexts. While accountability models, security by design, and vendor monitoring are all relevant to responsible AI, model cards specifically address the ethical and transparent communication required for responsible AI product deployment.

Why the other options are wrong:

• B. Security by design focuses on technical security threats rather than ethical and responsible use of AI.
• C. Vendor monitoring addresses third-party risk management, not the internal ethical documentation of the AI product itself.
• D. An accountability model establishes responsibility chains but does not serve as the primary documentation tool for ethical considerations.

Correct answer: D

Recall measures the proportion of actual positive instances that the model correctly identifies, calculated as TP/(TP+FN). It directly answers the question 'of all the true positives, how many did we find?' This metric is essential when the cost of missing positive cases is high. Precision measures accuracy of positive predictions, specificity measures correct negative identification, and F1 score balances precision and recall-none directly measure the ability to identify all true positives.

Why the other options are wrong:

• A. F1 score is a harmonic mean of precision and recall, not specifically focused on identifying all true positive instances.
• B. Specificity measures the ability to correctly identify true negatives, not true positives.
• C. Precision measures the accuracy of positive predictions made, not the proportion of all true positives found.

Correct answer: D

The primary purpose of a Privacy Impact Assessment is to systematically analyze how personal data flows through an AI system, identifying potential privacy risks and how that data is collected, used, stored, and protected. This foundational analysis of data handling practices informs all other privacy considerations. While identifying regulations, building confidence, and data quality are related concerns, the core purpose of a PIA is to thoroughly examine personal data handling to mitigate privacy risks.

Why the other options are wrong:

• A. Identifying applicable regulations is important but is a secondary outcome that follows from understanding how data is handled.
• B. Determining whether data is poisoned relates to data quality and security, not the primary purpose of a PIA.
• C. Building customer confidence is a benefit of conducting a PIA but not its primary purpose.

Correct answer: C

Data bias in machine learning algorithms is fundamentally caused by training data that does not represent the full population or contains skewed distributions. Diversifying the training data to include representative samples from all relevant groups directly addresses the root cause of bias by ensuring the model learns from a balanced and comprehensive dataset. Simplified models may reduce overfitting but not bias, unstructured data does not inherently reduce bias, and data security does not address bias.

Why the other options are wrong:

• A. Using unstructured datasets does not directly address the representativeness or diversity issues that cause bias.
• B. A simplified model may prevent overfitting but does not reduce bias caused by unrepresentative training data.
• D. Securing the training data protects it but does not reduce the bias that originates from its composition and representation.

Correct answer: C

Before developing any acceptable use policy, the organization must first establish what it is trying to accomplish-the scope and intended use of the AI system. This clarity drives all subsequent decisions about appropriate uses, restrictions, and requirements. Only after understanding the scope and intended use can the organization effectively consult with risk management and legal, review regulatory requirements, and align with existing policies, all of which should be tailored to the specific AI use cases in question.

Why the other options are wrong:

• A. Consulting risk management and legal is essential but should follow after establishing the scope and intended uses.
• B. Reviewing regulatory requirements is necessary but should be informed by the specific scope and uses identified first.
• D. Reviewing existing policies is valuable but should align with the newly defined scope and intended uses of the AI system.

Correct answer: C

Data augmentation is a technique that synthetically generates or transforms existing data to create larger, more diverse datasets for testing purposes. This directly and efficiently addresses the need for large datasets while maintaining quality and control over the testing data. Open-source repositories may have licensing and quality concerns, model cards document existing models rather than providing data, and search content introduces copyright and quality risks.

Why the other options are wrong:

• A. Open-source repositories may have licensing restrictions, quality issues, and may not contain the specific types of data needed.
• B. AI model cards document model characteristics, not provide testing datasets.
• D. Incorporating data from search content raises copyright, licensing, and data quality concerns.

Correct answer: A

Red-teaming exercises for generative AI models aim to identify vulnerabilities by crafting adversarial inputs that produce unexpected, undesired, or harmful outputs. This proactive approach reveals failure modes and edge cases before deployment. Stress testing, performance degradation, and random output replacement are either testing approaches focused on different objectives or not legitimate testing goals.

Why the other options are wrong:

• B. Stress testing the decision-making process is a different type of testing focused on capacity and load, not vulnerability discovery.
• C. Deliberately degrading performance is not a legitimate goal of security testing.
• D. Replacing outputs with random content is not a realistic attack goal or meaningful security testing objective.

Correct answer: B

Input sanitization is a preventive security safeguard that stops malicious or problematic inputs from ever reaching the model, preventing attacks at the entry point. This is fundamentally more important than detection and monitoring mechanisms because it prevents issues before they occur. Penetration testing, model output monitoring, and differential privacy are all valuable but are detective/protective measures rather than preventive controls at the input layer.

Why the other options are wrong:

• A. Penetration testing is detective in nature, identifying vulnerabilities rather than preventing them at the input stage.
• C. Model output monitoring is a detective safeguard that identifies problems after the model processes inputs.
• D. Differential privacy protects data but is not specifically focused on preventing malicious input attacks.

Correct answer: C

Regular audits of vendor processes and adherence to AI development guidelines represent the most effective monitoring approach because they provide independent verification of compliance. This combines oversight with accountability, allowing the contracting organization to assess actual practices rather than relying on vendor self- reporting or documentation alone. Audits can identify gaps between stated policies and real implementation, evaluate security controls, and verify ethical standards are being followed in practice.

Why the other options are wrong:

• A. Mandating source code and documentation sharing raises intellectual property concerns and doesn't guarantee compliance with ethical and security standards.
• B. Requiring vendors to self-monitor is insufficient without independent verification and oversight mechanisms.
• D. Self-attestation without third-party validation and benchmark monitoring provides minimal assurance of actual compliance.

Correct answer: B

This situation represents an evasion attack, where an attacker manipulates the model's runtime behavior to produce outputs that serve attacker objectives rather than intended system function. The attack occurs after deployment by crafting inputs or conditions that cause the model to bypass its intended safety guidelines. Evasion attacks focus on fooling the model into producing unintended outputs while the model architecture remains unchanged.

Why the other options are wrong:

• A. Data poisoning occurs during training by corrupting training data; this describes post- deployment manipulation of outputs.
• C. Privilege escalation is a system access control attack, not applicable to LLM output manipulation.
• D. Model inversion is an attack to extract training data from the model, not to manipulate its advice outputs.

Correct answer: C

Determining rightful ownership of AI-generated creations presents the greatest challenge in AI copyright law because traditional copyright frameworks assume human authorship and creative intent. Questions arise about whether copyright vests in the AI developer, the organization deploying the system, the user providing prompts, or exists at all. This ambiguity creates uncertainty across jurisdictions and affects licensing, liability, and monetization rights.

Why the other options are wrong:

• A. Trademark enforcement for AI systems follows established trademark law principles and presents fewer novel legal challenges.
• B. Trade secret protection of AI technologies uses existing trade secret frameworks and is well-established in law.
• D. Licensing frameworks, while complex, can be negotiated between parties and follow contractual principles.

Correct answer: C

Training the system to provide advisory results with final decisions made by human experts should receive highest priority because human oversight is the most effective safeguard against AI bias and unethical outcomes in high-stakes decisions like credit risk assessment. This approach preserves human accountability, allows experts to contextualize results and catch biased recommendations, and prevents fully automated discriminatory decisions. It is the most robust control for ensuring ethical decision-making.

Why the other options are wrong:

• A. Regularly updating with new data can perpetuate or amplify existing biases without addressing root causes.
• B. Restricting to objective metrics alone doesn't eliminate bias, as objective metrics can encode historical discrimination.
• D. Appeal mechanisms are important but reactive; they don't prevent biased decisions from occurring initially.

Correct answer: C

Keeping risk exposure due to bias in AI outputs within an acceptable range directly addresses output integrity by establishing acceptable risk thresholds and monitoring deviation. This framework element ensures that biased or corrupted outputs are detected and controlled within defined tolerances, which is essential for maintaining the integrity and trustworthiness of AI-generated results. It combines measurement, accountability, and risk management specifically for output quality.

Why the other options are wrong:

• A. Disclosure of architecture to stakeholders is a transparency measure but doesn't directly safeguard output integrity.
• B. Ethical standards in awareness programs support culture but don't directly control or verify output integrity.
• D. Defining responsibility for legal actions addresses accountability but doesn't prevent or safeguard against integrity compromises.

Correct answer: B

Differential privacy is the most effective mitigation control for membership inference attacks because it mathematically bounds the difference in model outputs when any single training record is included or excluded. This cryptographic approach fundamentally limits an attacker's ability to determine whether specific data was used in training, directly addressing the attack vector. Differential privacy provides provable guarantees rather than heuristic protections.

Why the other options are wrong:

• A. Threat modeling identifies risks but doesn't directly prevent membership inference attacks.
• C. Red teaming can identify vulnerabilities but provides detection rather than prevention of membership inference.
• D. Model ensembles may provide some robustness but don't directly prevent membership inference attacks.

Correct answer: C

Conducting an AI risk assessment and updating the enterprise risk register is the most important step because it systematically identifies, quantifies, and documents AI-specific risks within the organization's existing risk management framework. This approach ensures that AI risks are integrated into organizational risk governance, enables informed decision-making at enterprise level, and creates accountability for risk ownership and mitigation. Updating the risk register makes risks visible and actionable.

Why the other options are wrong:

• A. Establishing a framework is foundational but incomplete without actual assessment and risk register integration.
• B. Risk analysis methodology is important but is a process component; actual assessment and documentation is the critical step.
• D. Benchmarking against peers provides external reference but doesn't address internal risk assessment and governance.

Correct answer: D

Vendor compliance with AI-related requirements is the most important metric to monitor because it directly measures whether vendors are meeting contractual and regulatory obligations for AI systems. This encompasses adherence to security standards, ethical guidelines, data protection requirements, documentation standards, and audit requirements-all critical to managing vendor risk. Compliance monitoring is the core function of a vendor management program.

Why the other options are wrong:

• A. Training program participation is a support activity but doesn't directly verify vendor AI system compliance.
• B. Research participation indicates industry engagement but doesn't measure compliance with organization-specific AI requirements.
• C. Reviewing external threat reports is a security awareness activity but doesn't verify vendor-specific compliance.

Correct answer: A

When a deployed AI model exhibits output drift outside expected ranges, the best course of action is to return to an earlier phase in the AI life cycle to investigate root causes, retrain, validate, and retest the model before redeployment. This systematic approach ensures the underlying issue is properly identified and resolved rather than applying quick fixes or taking emergency actions without understanding the problem.

Why the other options are wrong:

• B. Taking the model offline is reactive but doesn't solve the problem; it's a temporary measure while investigation occurs.
• C. Adjusting hyperparameters without investigation may worsen the problem or create new issues; the drift likely requires retraining with updated data.
• D. An emergency change request alone doesn't address root cause analysis and proper validation needed to fix model drift.

Correct answer: A

The primary ethical concern with generative AI is information integrity issues, as these systems can generate plausible-sounding but false or misleading information, hallucinate facts, produce inaccurate outputs, and spread misinformation at scale. This undermines data reliability and trust in information sources more fundamentally than other concerns.

Why the other options are wrong:

• B. Generative AI typically makes information more available, not less; this is not a primary ethical concern.
• C. While confidentiality breaches are a security concern, they are not unique to generative AI nor the primary ethical concern.
• D. Though bias is an important concern, information integrity and hallucination represent the more fundamental and primary ethical challenge of generative AI.

Correct answer: C

The most important validation to ensure AI tools uphold ethical principles is confirming that outputs do not perpetuate adverse biases. Bias in AI outputs is a direct violation of fairness and equity principles and can cause measurable harm to affected individuals and groups. This validation is a core ethical requirement that supersedes approval processes or policies.

Why the other options are wrong:

• A. Stakeholder approval of alignment with company values is important but doesn't technically validate that the tool actually performs ethically in practice.
• B. Privacy department evaluation addresses one aspect of ethics but doesn't ensure the broader ethical principle of non-discriminatory outcomes.
• D. A responsible development policy provides a framework but doesn't ensure actual outputs remain free from bias; validation requires testing actual model behavior.

Correct answer: A

The most effective use of AI-enabled tools in a SOC is employing them to reduce false negatives by detecting subtle attack patterns that humans might miss. This enhances human analysts' capabilities by identifying genuine threats with greater sensitivity, improving detection accuracy while keeping humans in the decision-making loop for final analysis and response.

Why the other options are wrong:

• B. Replacing human analysis entirely with automated AI removes critical human judgment and accountability, and AI systems can make errors that require human validation.
• C. While triaging non-critical alerts has value, detecting subtle attack patterns that reduce false negatives is more strategically important to security outcomes.
• D. Using AI exclusively for all incident classification removes human oversight and creates single points of failure; AI should augment, not replace, human analysts.

Correct answer: B

Establishing and monitoring acceptable levels of AI system risk most directly prevents misalignment between corporate risk appetite and tolerance. This approach defines what level of risk the organization is willing to accept and actively monitors whether the AI system operates within those bounds, creating clear governance boundaries aligned with business objectives.

Why the other options are wrong:

• A. An AI risk register documents risks but doesn't establish or monitor acceptable levels; it's a tool supporting the broader governance approach.
• C. An impact assessment evaluates potential consequences but doesn't establish ongoing monitoring of acceptable risk levels during operation.
• D. KPIs measure performance metrics but don't directly address the alignment between risk appetite and tolerance in the way monitoring acceptable risk levels does.

Correct answer: C

Ensuring human oversight is the best control to mitigate inherent limitations of generative AI models. Human oversight catches errors, hallucinations, biases, and other failures that the AI system itself cannot self-correct, providing accountability and intervention points where human judgment can validate or reject AI outputs before they cause harm.

Why the other options are wrong:

• A. Adopting AI-specific regulations provides external compliance framework but doesn't directly mitigate the technical limitations of the models themselves.
• B. Classifying and labeling AI systems aids transparency but doesn't mitigate the inherent technical limitations or prevent model failures.
• D. Reverse engineering models is technically infeasible at scale and doesn't address mitigation; it's not a practical control for deployed systems.

Correct answer: B

Disclosing service provider policies to declare compliance with regulations best mitigates lawsuit risk from generative AI's use of internet data. Clear disclosure of data handling practices, compliance with intellectual property laws, copyright regulations, and data protection standards creates a legal defense and meets regulatory requirements, reducing exposure to litigation.

Why the other options are wrong:

• A. Reviewing log information documents how data was collected but doesn't mitigate risk if collection itself violated intellectual property or privacy rights.
• C. Filtering logic for IP flags may prevent some uses but doesn't address the underlying legal liability if data was collected without proper authorization.
• D. Appointing a data steward improves governance and security but doesn't directly mitigate lawsuit risk; legal compliance disclosure is the primary mitigation.

Correct answer: A

Adversarial testing is most effective at mitigating prompt hacking attacks. Adversarial testing specifically involves attempting to break the model through malicious inputs, prompt injection, jailbreaking attempts, and other adversarial techniques, directly identifying and helping fix vulnerabilities that attackers would exploit.

Why the other options are wrong:

• B. Input testing focuses on validating normal input handling and data quality but doesn't specifically target prompt hacking attack vectors.
• C. Load testing evaluates system performance under stress but has no relevance to prompt hacking vulnerabilities.
• D. Regression testing ensures existing functionality remains intact after changes but doesn't identify new security vulnerabilities from prompt attacks.

Correct answer: A

Testing and validation of the model against known outputs is the most direct way to identify and measure hallucination errors before deployment, allowing the organization to detect when the model generates false or nonsensical information. While fine-tuning and training on large datasets may help reduce hallucinations, they don't guarantee detection, and developer training alone doesn't directly address the technical problem of hallucinations in the deployed system.

Why the other options are wrong:

• B. Developer training improves practices but does not directly mitigate hallucinations already present in the model's outputs.
• C. Fine-tuning may improve performance but does not guarantee hallucination detection or mitigation without validation testing.
• D. Larger training datasets can help but do not directly prevent hallucinations or validate that they won't occur.

Correct answer: B

Risk tolerance is the specific threshold of acceptable risk exposure the organization can sustain; this directly determines how intensive monitoring must be to keep risks within acceptable bounds. Risk appetite is broader preference for risk overall, but tolerance is the more precise metric for determining monitoring frequency and depth. The number of users affects scope but not the fundamental level of monitoring required, and compensating controls are one possible response but not the primary determinant of monitoring intensity.

Why the other options are wrong:

• A. Risk appetite describes general risk orientation but is less precise than tolerance for determining specific monitoring intensity.
• C. Number of users affects scope of monitoring but not the intensity or depth required for a given risk level.
• D. Compensating controls are responses to risk but do not determine the baseline level of monitoring activities needed.

Correct answer: D

Social engineering tactics are most enhanced by AI capabilities-chatbots and deepfakes powered by generative AI can make phishing, pretexting, and impersonation attacks far more convincing and scalable. Employees need updated awareness training on AI-driven social engineering risks. Malicious insider threats, clean desk policy, and authentication controls are not specifically amplified by AI in the way that social engineering attacks are, as AI directly enables more sophisticated impersonation and manipulation.

Why the other options are wrong:

• A. Malicious insider threats are not primarily amplified by AI in a way requiring revised awareness training.
• B. Clean desk policy is not directly related to AI-enabled cyber risks.
• C. Authentication controls are a technical mitigation, not an awareness training topic revised due to AI.

Correct answer: B

Cryptographic controls such as hashing, digital signatures, and checksums provide verifiable proof that data has not been altered or corrupted during storage and transmission, ensuring integrity throughout the data lifecycle. This technical control guarantees that what was recorded is what is being used. Documentation and classification are important but do not technically verify integrity, and limiting data collection does not protect the integrity of data that is retained.

Why the other options are wrong:

• A. Limiting data collection does not ensure integrity of the data that is retained.
• C. Documentation of sources and processing is important for traceability but does not technically verify data has not been altered.
• D. Proper storage classification is important but does not verify or guarantee that data integrity has been maintained.

Correct answer: B

The right to audit gives the organization ongoing contractual authority to verify the vendor's handling, processing, and protection of training data throughout the engagement. This is the most critical protective mechanism because it enables the organization to enforce compliance and detect misuse or breaches. Pseudonymization reduces privacy risk but doesn't give oversight; independent certification provides limited ongoing assurance; and continuous monitoring is the vendor's responsibility, not primarily contractual.

Why the other options are wrong:

• A. Data pseudonymization reduces privacy exposure but does not provide the organization with audit rights or oversight.
• C. Independent certification provides one-time assurance but not ongoing monitoring of the vendor's data handling practices.
• D. Continuous monitoring is a vendor responsibility but lacking audit rights, the organization cannot verify it is occurring properly.

Correct answer: B

Diverse data sourcing ensures that training data represents multiple populations, perspectives, and demographics, which directly counters the root cause of bias-skewed or homogeneous datasets. This is the most effective control for preventing bias from entering the model in the first place. Data reconciliation, access controls, and cryptographic functions do not directly address the data quality and representativeness issues that cause bias.

Why the other options are wrong:

• A. Data reconciliation ensures consistency but does not address the root cause of bias in training data composition.
• C. Access control techniques protect data but do not mitigate bias present in the training dataset.
• D. Cryptographic hashing secures data but has no effect on bias in the model's training or outputs.

Correct answer: A

An automated data cataloging tool that integrates across all repositories provides comprehensive, consistent, and continuously updated visibility into all data assets used in AI projects, scaling across the organization without manual overhead. Automation ensures completeness and accuracy that manual processes cannot achieve at enterprise scale. A centralized team creates bottlenecks and single points of failure, quarterly audits are reactive rather than comprehensive, and manual processes do not scale effectively across all data repositories.

Why the other options are wrong:

• B. A centralized team creates bottlenecks and may not achieve comprehensive coverage across all data sources.
• C. Quarterly audits are reactive and do not ensure continuous comprehensive inventory management.
• D. Manual categorization does not scale effectively and risks inconsistency and gaps across large organizations.

Correct answer: A

Statistical methods such as imputation, mean substitution, or modeling missing data values directly address the root cause-missing data-while also reducing bias that can be introduced by deletion. This approach preserves dataset size and information. Increasing retraining frequency with flawed data will not fix the underlying quality issue; hyperparameter tuning cannot compensate for missing data; and deleting outliers removes potentially valid information and reduces dataset size unnecessarily.

Why the other options are wrong:

• B. Retraining more frequently will not address the fundamental missing data problem.
• C. Hyperparameter tuning optimizes existing data but does not address the missing data issue.
• D. Deleting outliers removes data and loses information rather than properly handling missing values.

Correct answer: B

Risk documentation in an AI governance program serves primarily to demonstrate governance, risk, and compliance (GRC) capabilities to external stakeholders such as regulators, auditors, customers, and business partners. This documentation provides evidence that the organization has a structured approach to identifying, assessing, and managing AI-related risks in accordance with industry standards and regulatory requirements.

Why the other options are wrong:

• A. Technical vulnerability analysis is important but is only one component of risk documentation, not its primary purpose.
• C. While risk documentation may reference risk thresholds, defining acceptable risk levels is a separate governance function, not the primary role of documentation itself.
• D. Historical incident records are valuable for audits but represent reactive documentation rather than the proactive governance and compliance demonstration that risk documentation primarily achieves.

Correct answer: A

Weak controls for access to AI models represent the most easily exploited vulnerability because they provide direct pathways for unauthorized users to gain control of, modify, or misuse the model. Poor access controls are a fundamental security weakness that requires minimal technical sophistication to exploit compared to more complex attack vectors, making them the lowest-hanging fruit for adversaries.

Why the other options are wrong:

• B. DoS attacks require specific knowledge of system architecture and often encounter network-level defenses, making them less easily exploited than simple access control bypasses.
• C. Inaccurate generalizations from new data are a model behavior issue, not a security vulnerability that adversaries can directly exploit.
• D. Inability to detect input modifications is a detection failure, but this requires adversaries to first gain the capability to modify inputs, which is already covered by access control weaknesses.