AAISM Exam Dumps - Isaca AI-Centric Security Management Questions and Answers

According to AAISM privacy governance guidance, the primary reason for conducting a PIA is to analyze how personal data is collected, processed, shared, and retained by an AI system. This analysis ensures compliance with privacy laws, mitigates risks to individuals, and informs necessary safeguards. Identifying regulations is part of compliance but is secondary to analyzing actual data handling. Building customer confidence is an outcome, not the main purpose. Checking for poisoned data relates to data quality, not privacy assessment. The fundamental purpose of a PIA is therefore to analyze the handling of personal data.

Sustained stakeholder sponsorship hinges on demonstrated, quantified business value communicated in terms they own (KPIs, ROI, cost-to-serve, risk-adjusted outcomes). AAISM frames stakeholder alignment as a value-assurance loop: define value hypotheses, measure realized value, and continuously communicate results to sponsors. While an AI roadmap (C), risk optimization (B), and training (A) are important, they support rather than drive ongoing executive buy-in. Quantified value narratives secure resources and reinforce alignment to strategic goals.

AAISM directs organizations to manage third-party AI risks through contractual and technical controls that explicitly govern data use, retention, training/fine-tuning, isolation, and deletion. The most effective data-security action when consuming generative AI features is to require enforceable opt-out provisions that prohibit the provider from using the organization’s data for training or secondary purposes and that mandate retention limits and secure deletion. Third-party audit reports (A) provide assurance but do not guarantee provider behavior for your specific data; awareness policies (B) are necessary but insufficient to control external processing; IP ownership guidelines (D) address legal rights, not data-security risk.

In AI Security Management, bias evaluation is primarily a data problem before it is a model or performance problem. The official AI Security Management content explains that impact assessments must specifically analyze training data representativeness against the demographics and characteristics of all relevant users and stakeholders. If the data used to train an AI system underrepresents or omits particular groups, the resulting model will systematically disadvantage them, regardless of how fast or “accurate” it is on average. While comparing outputs to historical data (option B) can help, historical data itself may be biased. Performance-related options (C and D) relate to efficiency and scalability, not fairness. Therefore, systematically assessing whether the training data covers all relevant end-user groups is the most direct and effective way to evaluate and mitigate bias.

When preventive input hardening isn’t feasible for LLMs, AAISM prescribes compensating detective and corrective controls—notably human review and annotation of outputs prior to downstream action—to reduce harm from prompt injection. Output-side review gates prevent untrusted instructions from propagating, enable rapid suppression/feedback loops, and provide labeled examples for subsequent model hardening. IAM (B) is necessary but does not mitigate injection in content; reviewing inputs (C) is less effective than auditing what the model is about to act on; fine-tuning for validation (D) is helpful long-term but is not an immediate compensating control when robust input validation is impractical.

AAISM states that HR systems performing candidate evaluation must prioritize training data fairness, representativeness, and bias mitigation because biased HR decisions carry regulatory, ethical, and litigation risks.

Backups (B) and encryption (D) relate to availability and confidentiality, not fairness. Conformity assessments (C) are helpful but secondary.

AAISM identifies training-data diversity and provenance assurance as primary treatments against data poisoning. Sourcing data from multiple, independently governed providers, combined with ingestion validation and anomaly screening, reduces the chance that a single compromised source can skew model behavior and improves cross-source consistency checks. Transparency, break-glass, and awareness are valuable but do not directly reduce poisoning exposure at the training boundary.

The AAISM framework clarifies that compliance decisions must always be tied to an organization’s risk appetite and tolerance. When new regulations emerge, management may choose not to comply if the associated risk remains within the documented and approved risk appetite, provided that accountability is established and governance structures support this decision. Other options such as widespread industry use, third-party audits, or lack of cost assessment do not justify noncompliance under the governance principles. The risk appetite framework is the only recognized justification under AI governance principles.

AAISM classifies learning paradigms by the presence of labeled targets. Creating categories (labels) and training on them is supervised learning, where input features are mapped to known outputs and optimization minimizes prediction error against ground truth. Unsupervised (B) discovers structure without labels; reinforcement (A) optimizes behavior via rewards; “machine learning” (C) is the broad field, not the specific technique.

AAISM defines automation bias as the tendency of individuals to over-rely on AI-generated outputs even when contradictory real-world evidence is available. In this scenario, the driver ignores traffic signs and follows the AI’s instructions, showing blind reliance on automation. Selection bias relates to data sampling, reporting bias refers to misrepresentation of results, and confirmation bias involves interpreting information to fit pre-existing beliefs. The most accurate description is automation bias.