ISACA Advanced in AI Security Management (AAISM)

The ISACA Advanced in AI Security Management (AAISM) is a specialized certification launched in late 2025. It is the first advanced credential of its kind designed specifically for experienced security leaders to bridge traditional security governance with the unique challenges of artificial intelligence. 

---------- Question 1

Which metric would be most effective for an AI security manager to monitor the effectiveness of a 'threat and vulnerability management' program for AI systems?

1. Number of users with administrative access
2. Mean time to detect model poisoning attempts
3. Total number of GPU hours utilized
4. Percentage of employees who completed basic IT training

---------- Question 2

A security manager is collaborating on an AI governance charter. Which of the following best describes a 'Supporting Task' related to establishing AI-specific policies?

1. Buying new chairs for the data science office to improve ergonomics.
2. Defining clear roles and responsibilities for AI system accountability.
3. Writing the raw CSS code for the AI application's login page.
4. Selecting the brand of coffee for the AI development team's breakroom.

---------- Question 3

An AI security program is being evaluated for maturity. Which element demonstrates a proactive approach to Stakeholder Considerations in Domain 1?

1. Providing quarterly reports on model performance only to the IT team
2. Implementing a transparent communication channel for users to report AI bias
3. Hard-coding all security settings to prevent any user modifications
4. Limiting the AI program documentation to a single, locked physical safe

---------- Question 4

To ensure Business Continuity for an AI-dependent customer service platform, the security manager should prioritize which of the following as part of the disaster recovery strategy?

1. Redundant ISP connections for the main corporate headquarters
2. Version-controlled backups of the model weights and training pipelines
3. Daily physical security audits of the primary data center facility
4. Standardizing all AI development on a single cloud service provider

---------- Question 5

A multinational corporation must comply with the EU AI Act while deploying a high-risk AI system for recruitment. What is the most critical first step for the AI security manager to ensure regulatory alignment within the AI security program?

1. Conducting a fundamental rights impact assessment
2. Increasing the frequency of penetration testing
3. Updating the disaster recovery plan for AI servers
4. Encrypting all training datasets at rest

---------- Question 6

What is the primary function of 'Explainable AI' (XAI) in the context of security and risk management?

1. To provide a user-friendly interface for the model
2. To justify the use of expensive AI hardware to the CFO
3. To enable human oversight and detect logic flaws
4. To automatically patch software vulnerabilities

---------- Question 7

A security manager is collaborating on a charter for AI Governance. What is the primary purpose of defining 'Roles and Responsibilities' in this document?

1. To ensure clear accountability for AI risk ownership and to align security tasks with business objectives.
2. To determine which employee gets to choose the music played in the office during the team meetings.
3. To provide a list of every employee's home address to the human resources department for the annual directory.
4. To limit the number of hours that any single person is allowed to use the company's AI tools each week.

---------- Question 8

Which security control is specifically designed to prevent 'Prompt Injection' attacks from manipulating the behavior of an LLM-based application?

1. Full-disk encryption on the database server
2. Input sanitization and robust guardrail models
3. Changing the administrative password every 90 days
4. Restricting physical access to the server room

---------- Question 9

An organization wants to implement ethical AI controls. Which practice best ensures that an AI system s decisions are explainable to a non-technical stakeholder?

1. Providing the full source code of the neural network to the stakeholder.
2. Using Local Interpretable Model-agnostic Explanations (LIME) to describe model outputs.
3. Requiring the stakeholder to take a three-month course on machine learning.
4. Publishing the raw mathematical formulas used in the model s activation functions.

---------- Question 10

An AI security program includes monitoring for Model Inversion. What evidence would a security analyst look for in the logs to identify a potential membership inference or inversion attempt?

1. A sudden spike in the number of concurrent users accessing the application.
2. A high volume of repeated, slightly varied queries aimed at probing the models decision boundaries.
3. An increase in the latency of API responses due to high server CPU utilization.
4. Unauthorized login attempts to the model training servers administrative console.

---

Are they useful?

Click here to get 540 more questions to pass this certification at the first try! Explanation for each option is included!

Follow the below LINKEDIN channel to stay updated about 89+ exams!

AI Strategy and Engineering Hub