Isaca AAISM Exam Dumps

AAISM defines an AI Impact Assessment (AIIA) as a structured evaluation designed to determine whether an AI system can safely and responsibly support business objectives without creating unacceptable risks.

The framework states that alignment to business objectives is the central purpose of AI adoption and therefore must be the starting point in an impact assessment.

Reputation (D) is a consideration, but it is a secondary outcome of failing to meet objectives responsibly. Employee retention (B) and training (C) are not core drivers of an AIIA.

============================================

AAISM prescribes targeted, role-based, scenario-driven training aligned to policy and job tasks as the highest-impact near-term intervention for human-factor AI risks. By mapping concrete ''do/don't'' behaviors (e.g., what data may/may not be pasted into public chatbots, required redaction steps, approved tools, verification of outputs) to specific roles, organizations rapidly reduce incident likelihood and harmful actions.

* A (blocking) is a technical containment option but is not an awareness-initiative control and may cause workarounds; AAISM treats it as complementary, not a substitute for behavior change.

* B generic modules fail to address the specific misuse pattern.

* D signatures provide attestations without ensuring comprehension or changed behavior.

===========

AI/ML threat modeling is the most effective structured method to both identify and address model security risks. It systematically surfaces attack classes (poisoning, evasion, membership inference, model extraction, inversion), maps system-specific attack surfaces (data pipelines, feature stores, training artifacts, inference APIs), and drives prioritized mitigations (ingestion validation, robust training, rate-limiting, watermarking, differential privacy, monitoring, red teaming). Output spot-checking (A) finds errors but not security vulnerabilities; encryption (C) protects confidentiality but does not reveal threats or mitigate inference-time attacks; adding data (D) may improve accuracy but does not target adversarial risk.

===========

AAISM identifies robust data validation and anomaly detection on incoming training data as the primary defense against data poisoning. These controls detect corrupted, manipulated, or adversarial samples before they enter the training pipeline.

Diverse data (A) is helpful but not protective against poisoning. More complexity (B) does not mitigate poisoning and can worsen vulnerability. More features (D) increases attack surface.

============================================

AAISM identifies output review and annotation as the most practical compensating control when robust input validation cannot be applied.

Output moderation detects:

* maliciously influenced responses

* unsafe outputs

* security-policy violations

IAM (B) does not mitigate prompt injection itself. Human review of inputs (C) is unrealistic at scale. Fine-tuning (A) cannot guarantee full prevention.

============================================