Free AAISM practice questions

Ten questions from CyberQue's free sample, with full explanations. No sign-up. Updated 16 October 2026.

These are practice questions written for CyberQue against ISACA's published AAISM exam content outline. They are not real exam questions. There are three from AI governance, three from AI risk and four from AI technologies and controls, close to the exam's 31/31/38 split, and each comes from a different sub-domain.

Try each one before you open the answer. The explanation shows the best answer, how to work the question, the rule it tests, and why each of the other options loses. New to the exam? Read the AAISM exam guide first.

AI Governance & Program Management · 1A Charter, roles & responsible AI use

Question 1

A national utility operator has approved deployment of generative AI assistants across customer service, network operations, and procurement. The board has demanded a single accountable owner for AI security and asks the CISO to propose a governance charter. The CISO proposes that the existing IT Steering Committee absorb AI oversight because it already chairs cyber risk and meets quarterly. Which is the MOST significant weakness of this proposal?

Its quarterly cadence trails model behaviour drift, vendor updates, and threat exposure between formal reviews.
Its membership spans IT and security functions, excluding the business owners now deploying assistants in production.
Its documented mandate carries no decision rights or escalation triggers for AI ethics, safety, and trustworthiness concerns.
Its risk register scores confidentiality and availability impacts, but not bias or degraded service quality.

Show the answer and explanation

Best answer: Its documented mandate carries no decision rights or escalation triggers for AI ethics, safety, and trustworthiness concerns.

AI raises questions a cyber risk committee has no authority to settle: ethics, safety, robustness, explainability, wider social impact. Meeting more often or changing the chair does not create that authority. ISO/IEC 42001 Clause 5.3 asks for assigned roles with clear authority, and that is what this charter leaves out.

How to work it: Ask what a new mandate could fix and what it could not. Cadence, membership and risk-register scope are all things this committee could change next quarter without anyone granting it new powers. Authority over AI decisions is the one it cannot grant itself, so that is the deepest weakness.

The rule it tests: A committee governs only what its mandate gives it decision rights over, so check authority before structure.

Why the other options lose

Its quarterly cadence trails model behaviour drift, vendor updates, and threat exposure between formal reviews. Cadence is a genuine constraint and drift between reviews is real, but a faster meeting schedule for a body that still holds no AI decision rights cannot rule on an ethics or safety question.
Its membership spans IT and security functions, excluding the business owners now deploying assistants in production. Composition gaps matter and would need fixing, yet members can be co-opted at any time; absent authority over AI-specific decisions, even the right people around the table cannot act.
Its risk register scores confidentiality and availability impacts, but not bias or degraded service quality. Impact criteria that price only confidentiality and availability are a real defect, but a downstream symptom of a mandate that never claimed ethics and safety in the first place.

Read: ISO/IEC 42001:2023 Cl. 5.3; NIST AI RMF GOVERN-2.1; ISACA AAISM ECO Task 1

AI Governance & Program Management · 1B AI security policies & standards

Question 2

An enterprise has an existing acceptable use policy (AUP) for IT. The AI security manager is asked whether to extend the AUP with an 'AI annex' or to author a standalone AI AUP. The CIO favors the annex approach for simplicity. Which factor MOST strongly supports a standalone AI AUP?

A standalone document is easier to translate, localize, and distribute across jurisdictions with differing AI regulatory expectations.
ISO/IEC 42001 certification requires AI-specific documented information, separately maintained, which an IT policy annex cannot satisfy.
A standalone policy can be approved by the AI governance committee, bypassing the slower enterprise cycle and reaching staff sooner.
AI carries obligations with no IT parallel, such as prompt data limits and mandatory output review, easily buried in an annex.

Show the answer and explanation

Best answer: AI carries obligations with no IT parallel, such as prompt data limits and mandatory output review, easily buried in an annex.

Disclosing AI-generated content, restricting which data classes may be pasted into an external model, and reviewing AI-suggested code have no IT analogue. As an annex they sit behind rules about laptops and passwords and get read as an afterthought. A standalone document keeps them visible and reviewable.

How to work it: Translation logistics, certification wording and a faster approval route are all administrative arguments that would apply to any document. The one that turns on content is that AI carries obligations with no counterpart in an IT policy, which is exactly what an annex buries.

The rule it tests: Give AI its own acceptable use policy when the obligations have no equivalent in the IT policy readers already skim.

Why the other options lose

A standalone document is easier to translate, localize, and distribute across jurisdictions with differing AI regulatory expectations. Localization is a practical benefit and matters for global rollouts involving works councils and translated attestations. It is an operational convenience rather than the substantive reason these obligations need a document of their own.
ISO/IEC 42001 certification requires AI-specific documented information, separately maintained, which an IT policy annex cannot satisfy. 42001 does require documented information covering AI-specific topics, so certification is a fair consideration. The standard does not prescribe document structure, and a well-maintained annex that fully covers the obligations can satisfy it.
A standalone policy can be approved by the AI governance committee, bypassing the slower enterprise cycle and reaching staff sooner. Faster approval through the AI governance committee is genuinely attractive when enterprise policy cycles run slow. Routing around the established approval body weakens the policy's authority and creates a parallel hierarchy auditors will challenge.

Read: ISO/IEC 42001 Annex A.6; NIST AI RMF GOVERN-1.2

AI Governance & Program Management · 1C AI data & asset inventory

Question 3

A regional bank is establishing its AI inventory. The CTO proposes populating it from the model registry, arguing that every model the bank runs is registered there. The AI security manager notes that business units also use AI features embedded in a CRM platform, a contact-centre transcription service and a spreadsheet add-in. What is the PRIMARY consequence of the CTO's proposal?

Registry entries lack data lineage, evaluation records and challenger testing that supervisors expect for model risk management
The inventory drifts as owners change roles, since registry records are updated at registration, not on retraining or redeployment
Registry scope covers models, not use cases, so one model serving several purposes appears as a single entry with one rating
Embedded and third-party AI the bank never trains stays invisible, though deployer obligations and data exposure still apply

Show the answer and explanation

Best answer: Embedded and third-party AI the bank never trains stays invisible, though deployer obligations and data exposure still apply

AI embedded in a CRM, a transcription service or a spreadsheet add-in never appears in an internal registry, yet deployer obligations, data exposure and vendor concentration attach to it just the same. The inventory scope has to be AI capabilities in use, drawn from procurement and discovery as well as the registry.

How to work it: Missing lineage, drifting owners and use-case granularity are all defects of the registry as a source, and each could be fixed while leaving the same blind spot. The primary consequence is categorical: anything the bank bought rather than built never appears at all.

The rule it tests: An inventory built from the model registry only sees what you built, not what you bought.

Why the other options lose

Registry entries lack data lineage, evaluation records and challenger testing that supervisors expect for model risk management Lineage, evaluation records and challenger testing are genuine gaps that banking supervisors probe during model risk reviews. They are metadata deficiencies within registered models; the primary consequence is that entire classes of AI never appear in the inventory at all.
The inventory drifts as owners change roles, since registry records are updated at registration, not on retraining or redeployment Ownership drift is a real maintenance failure, and records refreshed only at registration miss retraining and redeployment entirely. It afflicts inventories regardless of their source, so it is not the consequence specific to deriving scope from the model registry.
Registry scope covers models, not use cases, so one model serving several purposes appears as a single entry with one rating A model-centric view genuinely obscures use cases, and one rating across several purposes understates obligations for the riskiest of them. This is a strong granularity point, but embedded third-party AI is absent from the inventory entirely, not merely under-decomposed.

Read: ISO/IEC 42001 Annex A.4; NIST AI RMF MAP-1.1

AI Risk Management · 2A Risk lifecycle, reassessment & impact assessment

Question 4

A water utility maintains an enterprise risk register in which all AI exposure is captured as one entry: 'AI adoption risk: medium'. The register is reviewed quarterly by the risk committee. The utility runs a demand-forecasting model, a generative assistant for field engineers and an AI-based leak-detection system. What is the PRIMARY problem with this treatment?

Quarterly review is too slow for AI systems whose behaviour drifts, retrains and degrades between committee meetings.
The rating lacks documented impact and likelihood analysis, so 'medium' cannot be traced to any supporting evidence.
Leak detection is safety-relevant, so it belongs in SCADA operational technology governance, not this register.
One entry hides three exposures with different owners and tolerances, preventing assignment or informed acceptance.

Show the answer and explanation

Best answer: One entry hides three exposures with different owners and tolerances, preventing assignment or informed acceptance.

A safety-relevant leak-detection failure, a forecasting error and data leakage from a generative assistant have different owners, treatments, tolerances and escalation paths. Collapsed into a single medium-rated entry, none can be assigned to anyone or accepted on any meaningful basis.

How to work it: Review cadence, missing impact analysis and where leak detection belongs are all fair criticisms of the entry. The primary problem is upstream of all three: three systems with different owners, treatments and tolerances cannot be assigned or accepted through one line.

The rule it tests: One register line covering several AI systems destroys exactly the information the register exists to carry.

Why the other options lose

Quarterly review is too slow for AI systems whose behaviour drifts, retrains and degrades between committee meetings. Quarterly cadence is genuinely slow for systems that drift and retrain between meetings, and review frequency deserves separate attention. Increasing frequency would only surface the same uninformative single line more often, since the entry carries nothing anyone can act upon.
The rating lacks documented impact and likelihood analysis, so 'medium' cannot be traced to any supporting evidence. Absence of documented impact and likelihood analysis is a real methodological defect and makes the rating effectively unauditable. Even a fully evidenced single rating would still be wrong, because three systems with different owners and tolerances cannot share one assessment.
Leak detection is safety-relevant, so it belongs in SCADA operational technology governance, not this register. Routing safety-relevant operational technology exposure to specialist SCADA governance is sensible and reflects how many utilities organise their registers. Where a risk is recorded is secondary here; the defect is that distinct exposures were collapsed into one undifferentiated entry.

Read: ISO/IEC 23894; NIST AI RMF MAP-1.5; ISO 31000

AI Risk Management · 2B Threat landscape & vulnerability testing

Question 5

An AI security manager is preparing assurance for a customer facing generative assistant before launch. Which testing activity gives the MOST direct evidence that the model resists misuse?

Functional testing that checks the assistant answers a catalogue of expected customer questions correctly
Adversarial testing that attempts jailbreaks and harmful output against the deployed configuration
Load testing that measures response time and error rates at expected peak concurrency
Static analysis of the application code that surrounds the model and handles its responses

Show the answer and explanation

Best answer: Adversarial testing that attempts jailbreaks and harmful output against the deployed configuration

Adversarial testing is the activity that produces evidence about misuse resistance, because it attacks the deployed configuration the way an adversary would. Functional and load testing answer different questions, and code analysis covers the application rather than model behaviour.

How to work it: Functional testing checks expected questions get expected answers. Load testing measures the service. Static analysis covers the surrounding code. Only attacking the deployed configuration produces evidence about how it behaves under deliberate misuse.

The rule it tests: Only adversarial testing against the deployed configuration produces evidence about misuse resistance.

Why the other options lose

Functional testing that checks the assistant answers a catalogue of expected customer questions correctly Functional testing is necessary and catches the quality failures customers notice first. Correct answers to expected questions say nothing about behaviour under deliberate pressure.
Load testing that measures response time and error rates at expected peak concurrency Load testing protects availability and often reveals timeouts that degrade safety processing. Performance under volume is a different property from resistance to misuse.
Static analysis of the application code that surrounds the model and handles its responses Static analysis finds real defects in the surrounding application and belongs in the pipeline. Code analysis cannot evaluate how a probabilistic model responds to adversarial input.

Read: NIST AI RMF MEASURE-2.7; ISO/IEC 42001 Clause 8.3

AI Risk Management · 2C Vendor & third-party AI risk

Question 6

A logistics operator accepts that it keeps its own duties over input data and dispatcher oversight, whatever the vendor's contract says about model performance. The vendor's standard terms are silent on AI. Which contractual addition MOST directly equips the operator to discharge those retained duties?

Evaluation results with their stated limitations delivered before each new model version ships
An indemnity covering losses that arise from routes the model proposes incorrectly
An audit right over the vendor's training infrastructure exercisable on notice
A commitment that operator route data is not used to train models serving other customers

Show the answer and explanation

Best answer: Evaluation results with their stated limitations delivered before each new model version ships

A dispatcher can only exercise oversight against a stated envelope, and the operator can only know its validation still holds if it is told when the model changes. Those two terms are what convert a retained duty into something the operator can actually perform.

How to work it: Cross-customer training terms protect the input. An indemnity settles cost afterwards. An audit right reaches infrastructure rather than behaviour, on a cycle no dispatcher can use. What oversight needs is the envelope and a warning when it moves.

The rule it tests: Retained duties need evidence to discharge, so contract for evaluation results and notice before the model changes.

Why the other options lose

An indemnity covering losses that arise from routes the model proposes incorrectly An indemnity concentrates the vendor's attention and covers losses the operator would otherwise absorb. It settles who pays after a bad route is followed, which is not something a dispatcher can use at the moment of deciding.
An audit right over the vendor's training infrastructure exercisable on notice An audit right is what a security team instinctively asks for and does deter carelessness. Training infrastructure says little about how the deployed model behaves, and an annual audit cannot inform a decision taken today.
A commitment that operator route data is not used to train models serving other customers Restricting cross-customer training protects the operator's commercial data and belongs in any AI contract. It governs confidentiality of the input rather than giving the operator anything to oversee the output with.

Read: ISO/IEC 42001 Annex A.10; ISO/IEC 27036; NIST AI RMF GOVERN-6.1

AI Technologies & Controls · 3A AI security architecture

Question 7

An AI security architect is asked to define the trust boundaries for an enterprise LLM integration that uses internal RAG data, agentic tool calls, and user input. Where should the PRIMARY trust boundary be placed?

At the network perimeter between the enterprise and the public internet, where calls to the vendor's model API egress.
Between the user and the LLM, since retrieved documents and tool outputs already originate inside the enterprise.
At the vendor's model API endpoint, the egress point where prompts, context, and enterprise data leave control.
At every input entering the model and every output leaving it, treating the model as an untrusted execution surface.

Show the answer and explanation

Best answer: At every input entering the model and every output leaving it, treating the model as an untrusted execution surface.

The model cannot be relied on to enforce policy, so enforcement has to sit outside it on both sides. Retrieved documents and tool responses are not trusted merely because they came from inside the enterprise; employees upload them and web fetches carry whatever the page contained.

How to work it: Three options place the boundary somewhere on the network: the perimeter, the vendor endpoint, or between user and model. Each treats internal content as trusted, and the stem says retrieval and tools feed the model. The boundary belongs around the model itself, on both sides.

The rule it tests: The model is an untrusted execution surface, so the boundary goes around it: every input in, every output out.

Why the other options lose

At the network perimeter between the enterprise and the public internet, where calls to the vendor's model API egress. The network perimeter matters for confidentiality of the call, but in a RAG or agentic system the attack arrives inside content that has already crossed it legitimately.
Between the user and the LLM, since retrieved documents and tool outputs already originate inside the enterprise. Treating internal sources as trusted is the exact assumption indirect prompt injection exploits, since a document any employee can upload, or a tool result any system returns, is attacker-controllable content.
At the vendor's model API endpoint, the egress point where prompts, context, and enterprise data leave control. The vendor API endpoint is a genuine egress point for prompts and context and belongs in the design, yet it governs where data goes rather than whether the model's inputs and outputs are safe to act on.

Read: NIST AI RMF MAP; OWASP LLM Top 10; Zero Trust principles

AI Technologies & Controls · 3B Secure AI development lifecycle

Question 8

A model produced for fraud detection achieves 92% recall on the held-out test set. The data science team proposes deployment. The AI security manager asks one additional question that materially changes the conclusion. Which question is MOST likely to surface a deployment-blocking issue?

How was the test set sampled, and does its distribution match production base rates, timeframe, and adversarial inputs?
What is the precision at that recall, what daily false-positive volume results, and can fraud investigators actually absorb it?
Was any feature engineering, normalization, or target encoding fitted on the full dataset before the train and test split?
How large was the training set relative to the held-out set, was nested cross-validation used, and how stable were folds?

Show the answer and explanation

Best answer: How was the test set sampled, and does its distribution match production base rates, timeframe, and adversarial inputs?

If the test set came from the same period as training, it misses temporal drift. If it predates the adversary adapting, it misses current fraud. If base rates or demographics differ from production, it misses both. One question about how the set was sampled can turn a launch into a hold.

How to work it: Precision at that recall, leakage from fitting before the split, and fold stability are all good questions, and each assumes the test set represents production. If it was sampled from the wrong period or the wrong base rate, every other number inherits the problem.

The rule it tests: A recall figure is only as good as the sampling behind the test set.

Why the other options lose

What is the precision at that recall, what daily false-positive volume results, and can fraud investigators actually absorb it? Asking for precision alongside recall is exactly right for imbalanced fraud problems, where a headline recall figure conceals alert volume and investigator load. It interrogates the metric reported rather than whether the evaluation set itself supports any production inference at all.
Was any feature engineering, normalization, or target encoding fitted on the full dataset before the train and test split? Leakage from preprocessing or target encoding fitted before the split is a real and frequently missed defect that inflates held-out scores. It is one specific mechanism by which test results mislead; sampling representativeness is the broader question that subsumes several such mechanisms.
How large was the training set relative to the held-out set, was nested cross-validation used, and how stable were folds? Split ratios, cross-validation, and fold stability speak to variance in the estimate and are reasonable diligence for any model review. A well-sized, properly cross-validated estimate of the wrong distribution is still confidently wrong about production behavior.

Read: NIST AI RMF MEASURE; ISO/IEC 23894

AI Technologies & Controls · 3C Data security across the AI lifecycle

Question 9

A utility collected smart-meter consumption data under a privacy notice stating it would be used for billing and outage management. A data science team now proposes to train a model on that data to predict which customers are likely to default on payments. What is the MOST significant data risk?

Consumption data collected for billing lacks the payment history features needed for reliable default prediction at scale.
The new purpose exceeds the basis on which the data was collected, so training this model is not lawful.
Consumption patterns may act as proxies for household composition, producing discriminatory outcomes against protected customer groups.
Meter readings contain estimation and interpolation errors that would propagate into default predictions affecting individual customers.

Show the answer and explanation

Best answer: The new purpose exceeds the basis on which the data was collected, so training this model is not lawful.

Customers were told their consumption data supported billing and outage management. Inferring creditworthiness is a materially different and more consequential purpose that basis does not reach. The routes forward are a fresh lawful basis with transparency, or different data, not proceeding while recording the risk.

How to work it: Feature adequacy is a modelling concern. Proxy discrimination and estimation error are real risks that arise once the model exists. The prior problem is that the customers were told their data supported billing and outages, and creditworthiness is neither.

The rule it tests: Purpose limitation binds later use to the basis the data was collected under, and default prediction is not billing.

Why the other options lose

Consumption data collected for billing lacks the payment history features needed for reliable default prediction at scale. Feature adequacy is a fair modelling challenge, and consumption alone is thin evidence of creditworthiness for most households. Weak predictive power is a quality concern that only becomes relevant once the enterprise may lawfully use the data this way.
Consumption patterns may act as proxies for household composition, producing discriminatory outcomes against protected customer groups. Proxy discrimination is a genuine and serious risk in exactly this scenario and is the closest alternative. Fairness controls apply to processing the enterprise is entitled to perform, whereas the collection purpose here never extended to creditworthiness inference.
Meter readings contain estimation and interpolation errors that would propagate into default predictions affecting individual customers. Measurement error in interval meter data is real and does propagate into consequential decisions, warranting data quality controls. Accuracy affects how well the resulting model performs rather than whether the training use is permitted at all.

Read: GDPR Art. 5(1)(b), Art. 6; ISO/IEC 42001 Annex A.7; NIST AI RMF MAP-4

AI Technologies & Controls · 3D Human oversight, trust & safety

Question 10

An AI system recommends which building permit applications a municipal officer should approve. Officers process 60 applications a shift and accept the recommendation in 98% of cases. Management cites the officer's involvement as human oversight. What is the STRONGEST challenge?

The recommendation is presented before the officer forms an independent view, which anchors the assessment that follows
Officers have no authority to reject a recommendation without escalating, so their involvement cannot change the outcome
Acceptance decisions are not recorded with reasons, so the municipality cannot evidence that review took place
At this throughput with nothing shown to support the recommendation, officers confirm it rather than genuinely evaluate it

Show the answer and explanation

Best answer: At this throughput with nothing shown to support the recommendation, officers confirm it rather than genuinely evaluate it

A 98% acceptance rate with no supporting basis surfaced is automation bias, and the officer confirms the recommendation rather than evaluating it. The fixes are showing the basis for each recommendation, allocating realistic review time, and tracking the override rate as a health measure for the control.

How to work it: Anchoring, escalation-only rejection and unrecorded reasons are all real design faults, and each could be fixed while the officer still accepts almost everything. The challenge that explains the 98% is that sixty a shift with no supporting evidence leaves no room to evaluate.

The rule it tests: Oversight needs competence, information, time and authority; at sixty applications a shift with nothing shown, three of the four are missing.

Why the other options lose

The recommendation is presented before the officer forms an independent view, which anchors the assessment that follows Anchoring from a recommendation shown first is a genuine and well-studied effect on human reviewers. Sequencing amplifies deference, whereas the fundamental problem is the absence of time and information to evaluate.
Officers have no authority to reject a recommendation without escalating, so their involvement cannot change the outcome Lacking authority to reject would indeed void oversight entirely and is the more severe design flaw where present. Nothing here indicates officers cannot reject; the evidence points to them being unable to evaluate.
Acceptance decisions are not recorded with reasons, so the municipality cannot evidence that review took place Unrecorded reasons do weaken the evidence trail and make the control hard to audit afterwards. Recording reasons documents a review that the throughput suggests is not substantively happening.

Read: EU AI Act Art. 14; NIST AI RMF MANAGE-2.3; ISO/IEC 42001 Annex A.9

Get the other ten free questions

The CyberQue app has the full free sample of 20 questions, and 540 in total across six timed mock exams scored from 200 to 800. Every question gets the same explanation you see here, and a mistakes review brings back what you got wrong.

First 20 questions free.
Android 10 or later.

CyberQue is made by CyberQue Digital. It is independent and isn't affiliated with, endorsed by or sponsored by ISACA. AAISM is a trademark of ISACA.