Online Access Free AAISM Exam Questions

Which of the following would be of GREATEST concern when reporting on controls and risk mitigation efforts for AI systems?

• A.Lack of detailed explanation of AI model training methodologies
• B.Delayed communication regarding AI system rollout timelines and initial risk assessments
• C.Absence of ongoing assessment to confirm that AI control effectiveness is sustainable
• D.Minimal coverage of plans for AI system scalability and expansion

A preliminary risk assessment of a SaaS-based large language model (LLM) business support system has identified prompt injection, data poisoning, and model exfiltration as material threats.
Which of the following is the BEST approach to ensure risks are treated consistently?

• A.Implementing an AI threat control matrix that maps threats to specific controls and assurance activities
• B.Relying on vendor independent audit reports and service level agreements (SLAs) as evidence of AI risk coverage
• C.Focusing resources on post-deployment red teaming and deferring control selection until post go- live feedback is received
• D.Applying control baselines from a recognized industry standard to AI components

An organization develops and implements an AI-based plug-in for users that summarizes their individual emails. Which of the following is the GREATEST risk associated with this application?

• A.Inadequate controls over parameters
• B.Data format incompatibility
• C.Insufficient rate limiting for APIs
• D.Lack of application vulnerability scanning

To ensure AI tools do not jeopardize ethical principles, it is MOST important to validate that:

• A.Stakeholders have approved alignment with company values
• B.Outputs of AI tools do not perpetuate adverse biases
• C.AI tools are evaluated by the privacy department before implementation
• D.The organization has implemented a responsible development policy

After implementing generative AI tools, an organization was notified of new critical compliance requirements aimed at verifying how AI is being used. Which of the following should be done FIRST?

• A.Create a policy for responsible use.
• B.Schedule regular compliance reviews.
• C.Develop a report of control compliance.
• D.Define access control rules.