AAISM practice questions
ISACA · AAISM · 200 questions
Original practice questions for the ISACA Advanced in AI Security Management (AAISM) exam, covering AI governance and program management, AI risk management, and AI technologies and controls. Content is original practice material aligned to the official ISACA AAISM exam content outline and framed in civic and municipal scenarios such as city AI pilots, public-health records, permitting chatbots, 311 assistants, courts and clerk workflows, and transit / utilities / emergency-management operations. This is not a brain-dump of actual exam questions.
This course contains the use of artificial intelligence.
About the AAISM exam
- Exam fee
- $599 USD
- Time allowed
- 2 hours 30 minutes
- Questions
- 90
- Passing score
- 450 (scaled, 200-800)
- Languages
- English, Spanish, Japanese
- Format
- Computer-based, 90 multiple-choice questions, at a PSI testing center or remotely proctored (test centers only for residents of India, Mainland China and Hong Kong)
Exam details published by the vendor, checked 22 October 2026. Vendors change fees and formats without notice — confirm on the vendor's own page before you book.
Practice Quizzes
Test your knowledge with standard 20-question practice sets.
Quiz 1
Quiz 2
Quiz 3
Quiz 4
Quiz 5
Quiz 6
Quiz 7
Quiz 8
Quiz 9
Quiz 10
Browse by Domain
Study specific topics at your own pace.
AI Governance and Program Management · 62 questions
- A city CIO briefs the mayor’s cabinet on anchoring the municipal AI charter. Which action best aligns stakeholder expectations with industry AI security governance?
- County counsel asks how EU AI Act–style risk-tier thinking should shape a resident benefits-triage chatbot. What is the most appropriate governance response?
- Public-health leadership wants NIST AI RMF language in the department’s AI oversight board charter. Which outcome does that primarily achieve?
- A transit board will approve an AI scheduling pilot only after roles are clear. What should security leadership do first?
- An elections office is drafting an RFP for a ballot-help assistant. How should leading ethical AI principles influence procurement governance?
- A housing authority privacy officer asks how ISO AI management standards relate to existing ISO 27001 controls for tenant-data AI tools. What is the soundest guidance?
- City council auditors ask who must be consulted before expanding a 311 generative assistant citywide. Which consultation set best reflects stakeholder considerations?
- A school-district security manager maps state student-privacy rules to an AI tutoring vendor’s data practices. What should drive the governance decision?
- Fire/EMS leadership compares a triage LLM that drafts clinical-style advice with one that only answers station routing FAQs. How should governance prioritize them?
- A water utility board must approve a leak-prediction model. What should be the governance baseline for AI security expectations?
- Municipal open-data stewards will publish model cards for city datasets used with public AI tools. Which constraint best reflects responsible-use principles?
- A courts administrator asks which external parties care about AI used in case-status messaging. Which answer best identifies relevant oversight stakeholders?
- County IT asks whether AI Fundamentals training alone satisfies management accountability for the AI steering committee. What is the correct distinction?
- A city information-security office must guide staff using generative tools on permit files. What is the most appropriate first policy action?
- Public libraries need a way to handle prompts that would summarize confidential donor notes. Which action best operationalizes AI policy?
- A permitting director wants AI to reduce fraud without bypassing human plan reviewers. Which strategy choice best fits?
- County HR asks security to cover generative AI on telework laptops. How should AI-specific policy content be maintained?
- A 311 manager needs a path when the chatbot gives unsafe answers about hazardous waste drop-off. What should procedures define?
- Transit security must stop staff from pasting badge-access logs into public LLM chatbots. Which artifact best translates policy into practice?
- A parks department proposes AI for turf irrigation scheduling. What should security require before capability rollout?
- Emergency management will use AI to draft after-action reports. What should standard operating procedures govern before public release?
- A housing authority discovers caseworkers used unsanctioned AI on personal tenant chats. What is the most appropriate strategy response?
- City legal and security co-author go-live rules for resident-facing AI. Which procedure requirement is most appropriate?
- School-district security sees teachers installing classroom AI agents without review. What procedural control should be embedded?
- A water utility’s AI security policy addresses models that recommend valve actions. Which policy stance best enforces control for high-impact operations?
- A municipal IT strategy committee wants to reduce exposure of housing and benefits case notes to consumer AI services. Which strategy choice best supports that goal?
- A city permitting office discovers multiple generative assistants and vector stores with no single owner list. What should security establish first for AI asset lifecycle management?
- Public-health leadership plans a fine-tuning experiment using extracts from clinic notes. What lifecycle action should security require before the experiment proceeds?
- Courts IT is retiring an obsolete case-summarization model that stored embeddings derived from sealed records. What lifecycle control should security prioritize?
- A transit authority wants assurance that datasets feeding an on-time prediction model are governed from collection through deletion. Which management approach best demonstrates that control?
- 311 operations finds duplicate chatbot agents in the municipal CMDB with unclear ownership. What should the AI security program require?
- A housing authority uses synthetic tenant profiles for model evaluation alongside a smaller set of real PII records. How should these be reflected in the AI data inventory?
- Library digital services collect prompt and response logs that include cardholder research queries. What lifecycle decision must security drive?
- Emergency management relies on a third-party foundation model hosted outside city infrastructure for draft situation summaries. How should the AI asset inventory treat that model?
- An assessor’s office uses parcel imagery datasets to power an AI valuation helper. Which lifecycle practice best strengthens AI data management?
- Parks department staff find an abandoned fine-tuned model still reachable with an old API key. What decommissioning control should security enforce?
- County IT builds RAG corpora from building-code PDFs and from resident complaint emails. What inventory action is most appropriate?
- A water utility proposes feeding SCADA historian data into a generative training pipeline without OT security review. What lifecycle gate should AI security enforce?
- A city CISO wants AI security managed as more than ad-hoc project advice. Which program action best establishes sustained coverage?
- Public-health security needs visibility into whether AI controls are operating. Which program management practice best provides that visibility?
- Transit leadership funds copilots for dispatch supervisors. What AI security program element should accompany that rollout?
- Courts administration asks how AI security tooling should be introduced. Which approach best fits AI security program management?
- A permitting office wants assurance that chatbot owners keep AI security controls current. Which program cadence best supports that goal?
- A county CIO wants AI security risk visible alongside other cyber risk. How should the AI security program be structured for reporting?
- Housing authority caseworkers increasingly use generative tools on tenant communications. What should the AI security program maintain?
- Emergency management is updating its annual security program maturity assessment. How should AI systems be included?
- School-district security has limited AI program capacity. Which roadmap prioritization best reflects AI security program management?
- A library consortium deploys shared AI assistants across city branches with unclear who approves changes. What program artifact should security establish?
- A water utility board understands NIST Cybersecurity Framework categories but is new to AI controls. How should security present AI program coverage?
- City security operations wants the information security program to cover misuse of municipal generative assistants. Which program action best expands detection coverage?
- A city updates its incident response plan after a permitting chatbot may have leaked resident PII. Which action best establishes AI-specific incident handling?
- Public-health business continuity planning must address flu-season surge if an AI triage helper goes offline. Which BC action best addresses that AI availability risk?
- Transit incident response playbooks must cover adversarial model drift that misroutes accessible-service vans. Which IR update best supports AI-specific investigation and reporting?
- Courts define response when an AI case-status messenger unexpectedly shows sealed-case content. Which action best establishes escalation for that AI security incident?
- Emergency management uses an AI tool to draft public alerts and depends on a model provider. Which DR/BC action best treats that third-party AI dependency?
- 311 operations must keep answering residents when the generative assistant is taken offline during an incident. Which continuity measure best supports that need?
- A housing authority suspects data poisoning against a tenant-services model and opens an incident. Which IR requirement best supports investigation?
- A water utility runs a tabletop that assumes the AI leak-detection model fails. Which exercise outcome best validates BC readiness for that AI failure mode?
- School-district security finds a malicious plugin inside a classroom agent. Which IR phase action best completes eradication and recovery for that AI compromise?
- A parks department AI map assistant posts incorrect trail closures to the public. Which incident action best addresses notification for that integrity failure?
- County counsel wants vendor-model breach notice timelines reflected in operations. Which IR runbook update best aligns AI incident reporting with those requirements?
- Fire/EMS leadership sees an AI assistant invent hydrant locations during drills. Which action best treats that integrity failure in municipal incident taxonomy?
AI Risk Management · 62 questions
- A city risk office must approve a generative benefits chatbot. Which action best defines AI risk thresholds before go-live?
- Public-health plans to deploy an outbreak-summary model on clinic notes. Which risk action should occur before deployment?
- Transit identifies bias risk in an on-time prediction model that varies by route. Which management action best selects an AI risk treatment?
- Courts assess risk that a drafting assistant could disclose confidential case material. Which assessment approach best frames that AI risk?
- A housing authority tracks AI risks for tenant tools. Which practice best oversees AI risk within the enterprise risk lifecycle?
- 311 leadership learns of a deepfake robocall campaign targeting the city’s phone tree. Which risk action best responds to that external AI-related factor?
- A water utility compares AI that can recommend valve changes with FAQ chatbots. Which threshold practice best reflects decision criticality?
- Emergency management evaluates harms from an AI public-messaging assistant. Which assessment practice best includes AI-specific harm categories?
- A school-district risk team sets an agreed hallucination-rate limit for student-facing AI. Which practice best links that threshold to treatment?
- A library board reviews a low-stakes catalog recommender with limited resident harm potential. Which risk treatment is most appropriate when residual risk is within appetite?
- An assessor’s office learns of a statute change requiring greater algorithmic transparency for valuation helpers. Which risk action best follows?
- Parks adds human review before publishing AI-generated trail-closure posters. Which comparison best shows the control’s effect on AI risk?
- County IT is offered an AI vendor contract that claims privacy risk is fully transferred to the vendor. Which conclusion best reflects sound AI risk treatment?
- Fire/EMS leadership must prioritize AI risk treatment across several assistants. Which use case should receive treatment first?
- A permitting office relies heavily on AI plan-check suggestions. Which risk scenario should the assessment document and treat?
- City finance asks security for AI risk statements suitable for insurance and audit committees. Which approach best meets that governance need?
- Public works evaluates an AI that could autonomously issue stop-work orders at job sites. Which risk treatment best matches unacceptable autonomy?
- Elections risk officers learn the vendor changed the underlying foundation model mid-election cycle. What should they do next for AI risk management?
- Housing caseworkers paste tenant details into unsanctioned public AI chatbots. How should the AI risk assessment treat this condition?
- Transit monitoring shows a scheduling model’s fairness metrics worsened after a service change. Which AI risk action is most appropriate?
- A city CISO needs to allocate limited AI control investment across departments. Which assessment approach best supports that prioritization?
- A city SOC must improve threat coverage for the permitting chatbot. Which action best addresses the AI threat landscape?
- Public-health staff notice suspicious document uploads into a RAG knowledge base. What vulnerability-management action should security take?
- Transit security wants assurance that an operations assistant will not leak driver PII under adversarial prompts. Which threat-testing approach is most appropriate?
- Courts IT trains helpers on sets that may include sensitive opinion text. Which AI-specific vulnerability class should the threat assessment include?
- During storm season, 311 experiences oversized prompt floods against its resident assistant. Which AI threat concern should vulnerability management address?
- A housing authority finds an agent plugin that can update case records with excessive privileges. What is the appropriate vulnerability-management response?
- Emergency management worries adversaries could deepfake the emergency manager during a crisis. How should this appear in AI threat work?
- A water utility operates a leak-prediction model in production. Which vulnerability-management practice best sustains assurance over time?
- School-district security finds an assistant inventing disciplinary policy that staff might follow. How should this be treated in AI vulnerability management?
- Library IT learns a base-model update channel may have been compromised. Which threat perspective should vulnerability management apply?
- An assessor’s office sees model skew after parcel data quality drops post-migration. What should AI vulnerability management recognize?
- Parks security finds users can circumvent guardrails to obtain unsafe trail advice from a visitor assistant. What should be done?
- Fire/EMS evaluates an LLM assistant that returns clickable links in replies. Which threat should vulnerability management emphasize?
- County IT discovers a vector database holding complaint embeddings lacks access controls. How should AI vulnerability management prioritize this?
- Permitting security learns of new prompt-firewall bypass techniques in industry advisories. What is the correct threat-management response?
- Public works suspects a model reveals details from underground infrastructure maps used in training. Which threat class should drive treatment?
- An elections office uses RAG over voter-guide PDFs. Which AI threat should testing specifically target?
- City incident response needs a structured way to classify an attack on a municipal LLM gateway. Which approach best supports AI threat assessment?
- Housing chatbot capacity collapses after scrapers flood token-heavy requests. Which vulnerability-management response best addresses this AI threat?
- Transit security wants richer prompt logging for an AI assistant but worries the logs become a new exposure. What should management require?
- Courts plan major case-management releases that include AI features. Which testing practice best fits AI vulnerability management?
- A city is issuing an RFP for a 311 generative platform. Which action best embeds AI security into vendor selection?
- Public-health leadership is contracting an AI vendor that will process clinic-related content. Which supply-chain due diligence step is most appropriate?
- Transit depends on a vendor foundation model for safety-related assistant claims. What contractual control best manages model-change risk?
- Courts evaluate a legal-research AI vendor. Which evaluation criterion best reflects AI supply-chain assurance?
- A housing authority has live SLAs with a case-management AI vendor. Which practice best verifies ongoing AI security commitments?
- Emergency management adopts a SaaS AI drafting tool. Which supply-chain action best addresses hidden dependencies?
- School-district procurement is scoring an edtech AI vendor. Which assurance artifact best supports AI supply-chain evaluation?
- A library consortium wants consistent AI vendor reviews across branches. Which approach best standardizes supply-chain due diligence?
- A niche water-utility leak-detection AI vendor is being acquired. Which supply-chain concern should management prioritize?
- Permitting IT will upload city documents into a vendor fine-tuning pipeline. Which vendor security requirement is most critical?
- An assessor’s office buys AI valuation assistance. Which contractual right best supports ongoing vendor oversight?
- Parks staff find a free consumer AI plugin silently enabled inside landscaping SaaS. How should security treat it?
- Fire/EMS is selecting a CAD AI vendor for sensitive call types. Which requirement best reflects data-sovereignty needs?
- County IT scores vendors for AI that influences benefit decisions. Which capability should weigh heavily in selection?
- City security reviews an LLM gateway SaaS before adoption. Which technical requirements are most appropriate?
- An elections office is offboarding a chatbot vendor. Which control best protects AI-related civic data at exit?
- Public works compares open-weight self-host versus closed API AI vendors. How should security requirements be applied?
- Housing counsel finds a vendor’s AI training opt-in is enabled by default. What should management require?
- Transit discovers a known OWASP LLM vulnerability in a vendor gateway before go-live. What is the appropriate supply-chain response?
- 311 operations relies on an AI SaaS platform. Which monitoring approach best manages ongoing vendor AI control risk?
AI Technologies and Controls · 76 questions
- A city needs secure access patterns for permitting and 311 assistants. Which architecture decision best fits AI security design?
- Public-health leadership plans to add an AI inference tier that processes clinic summaries. How should security advise integrating it into enterprise architecture?
- A transit authority wants operations analysts to call model endpoints used for schedule and ridership insights. Which architecture pattern best hardens that access?
- Courts IT is designing a legal-research assistant for clerks. Which design choice best layers AI-specific security into the solution?
- A housing authority is building a case-triage model. Which architecture decision best strengthens AI security?
- Emergency management needs EOC packet summarization that still works if cloud AI becomes unreachable. Which architecture approach best fits?
- A water utility wants analytics AI near OT historian data. Which protective design pattern should security require?
- A school district is designing an agent that can call student information system APIs. Which architecture control is most appropriate?
- Library digital services want AI help summarizing catalog FAQs without exposing cardholder PII to training. Which architecture pattern best reduces that exposure?
- An assessor’s office is deploying vector search over parcel documents. How should crypto architecture be handled?
- Parks wants multimodal trail-photo AI exposed through APIs. Which architecture approach best keeps controls consistent?
- Fire/EMS is reviewing a CAD AI that reads AVL locations and radio transcripts. What should the architecture review emphasize first?
- County IT reviews a proposed civic web app that calls a vendor LLM. Which finding is the clearest architecture anti-pattern?
- Permitting wants AI to draft plan-review comments. Which architectural control best keeps those drafts from becoming official without oversight?
- City security is reviewing a RAG design for internal policy assistants. Which requirement best protects document confidentiality?
- Elections officials want a ballot-help assistant. Which architecture decision best isolates that high-sensitivity workload?
- A city is choosing a model for code-enforcement FAQs. Which selection approach best fits AI lifecycle security management?
- Public-health has fine-tuned an outbreak summarizer. What validation step should occur before go-live?
- Transit is setting acceptance criteria for an on-time prediction model. What should validation emphasize beyond raw accuracy?
- Courts ML engineers note that training on sealed records would raise summarizer accuracy. What lifecycle decision is most appropriate?
- A housing authority trains a case-triage classifier. Which lifecycle practice best supports reproducibility and auditability?
- Emergency management changes its incident taxonomy used by an alert-drafting model. What lifecycle action should follow?
- A water utility has scarce labeled leak examples for a detection model. Which development approach best fits lifecycle judgment?
- A school district MLOps pipeline promotes classroom models toward production. Which gate belongs in that lifecycle?
- A library evaluates quantizing an on-prem summarizer to run on smaller hardware. What lifecycle consideration matters most for security posture?
- An assessor’s office plans to replace a production valuation helper with a newer model. Which practice best controls that change?
- Parks evaluation shows a trail-recommendation model favors some park districts over others. What lifecycle action best fits AI security management?
- Fire/EMS is validating a CAD assistant that reads noisy radio transcripts. Which validation requirement best strengthens operational AI assurance?
- County IT supports an internal RAG app through design, build, and release. How should security advice be applied across that AI development lifecycle?
- Permitting plans to release a plan-check assistant. Which validation practice best fits consequential civic decisions?
- Elections approaches a pre-election blackout window. Which lifecycle change-control action best fits that civic calendar?
- A city stores RAG embeddings of resident complaints for a 311 assistant. Which data management control best protects that corpus?
- Public-health is building a triage-model training extract. Which data management practice best treats AI lifecycle data risk?
- Transit wants AI analytics on operations logs that include badge identifiers. What data control should management require first?
- Courts IT is preparing fine-tuning buckets for a legal summarizer. Which data management control best enforces training-data boundaries?
- A housing authority needs case narratives for quality evaluation of a summarizer. Which data control best enables safer evaluation?
- Emergency management feeds geospatial layers into an AI damage-assessment tool. Which data management control best protects integrity?
- A water utility builds an AI feature store mixing customer and sensor data. Which design best fits data management controls?
- School-district staff might paste student IEP free text into unsanctioned AI tools. Which preventive data control best fits?
- A library indexes local-history scans for AI retrieval. Which data management practice best enables correct access decisions?
- An assessor’s office hosts parcel documents in a cloud vector database. Which cryptographic data control best fits management expectations?
- Parks generates synthetic training images of facilities for a vision model. Which data control best supports provenance?
- Fire/EMS trains a response-time predictor on operational datasets. Which data management practice best supports high-stakes civic AI?
- County IT archives prompts and responses from a resident-services assistant. How should that AI interaction data be managed?
- Permitting plans AI fraud scoring that would otherwise use contractor SSNs. Which data management control best fits before feature engineering?
- 311 quality finds tainted uploads in a knowledge base used by a resident assistant. What data management action should occur?
- A city AI may recommend denial of resident benefits. Which trust and safety control best fits that consequence?
- Public-health AI flags clinics for extra inspection. Which privacy, ethics, and trust control should management demand?
- Transit AI influences service-frequency proposals across neighborhoods. Which trust control best addresses ethical performance?
- Courts evaluate an AI feature that would profile litigants beyond operational need. What privacy-by-design response is most appropriate?
- A housing authority uses generative AI to draft tenant notices. Which trust and safety control best fits outbound civic communications?
- Emergency management drafts resident alerts with generative AI. Which transparency control best fits those civic communications?
- A water utility ethics review evaluates an AI that would prioritize leak fixes solely by property tax value. What should the review conclude?
- A school district plans classroom agents that process student work samples. Which privacy control best fits that use?
- A library chatbot helps with reference questions. Which privacy control best fits those conversational sessions?
- An assessor’s office uses vision AI on parcel photos. Which trust and safety practice best strengthens robustness?
- Parks and recreation wants an AI to post autonomously to social channels. What safety gating best fits before that goes live?
- Fire/EMS uses AI for protocol suggestions. Which oversight control best fits low-confidence outputs?
- A county plans a new resident-facing AI portal. Which privacy control best fits before launch?
- A permitting ethics board oversees AI-assisted findings on applications. Which accountability control best fits contested outcomes?
- Elections officials review a city-operated AI demo that could use voice clones. Which trust and safety rule best fits?
- A city operates a municipal LLM gateway. Which monitoring practice best fits security telemetry?
- Public-health leadership manages residual risk for clinical AI helpers. Which security control practice best fits ongoing assurance?
- Transit ops assistants use generative AI. Which logging practice best supports security monitoring without overexposure?
- A court AI retrieval system can pull from case repositories. Which detection control best fits unauthorized data access?
- A housing authority exposes a tenant chatbot API. Which preventive control best fits that endpoint?
- Emergency management tracks AI alert-draft quality. Which monitoring approach best treats integrity as security-relevant?
- A water utility depends on a vendor-hosted model that updates without notice. Which monitoring practice best detects silent behavior change?
- A school district monitors classroom agents for policy violations. Which automated response best fits repeated breaches?
- A library offers public AI search. Which monitoring signal best indicates scraping abuse?
- An assessor’s office feeds features into a valuation model. Which security control best protects that pipeline?
- Parks and recreation promotes chatbot builds through CI. Which security practice best fits that delivery pipeline?
- Fire/EMS administrators can change model settings from admin consoles. Which access control best fits that privilege?
- County clerks use AI productivity tools. Which monitoring practice best ties identity risk to AI use?
- Permitting operates a prompt firewall. Which monitoring practice best measures that control’s performance?
- 311 operations want anomaly detection on civic AI prompts. Which monitoring foundation best enables that detection?
These questions are original practice material and are NOT actual exam questions or brain-dump content. All vendor marks are trademarks of their respective owners. This site is not affiliated with, endorsed by, or sponsored by ISACA.