Isaca Updated AAISM Exam Questions and Answers by leni

AAISM defines data poisoning as directly capable of causing model drift because corrupted training data shifts the statistical distribution, leading to degraded or unsafe performance.

Model stealing (A) extracts model behavior but does not cause drift. Perfect knowledge (B) is an attacker capability, not an attack causing drift. Membership inference (D) attacks privacy, not performance.

AAISM stresses AI-specific change management as essential for vendor-driven or system-driven updates. Proper change control includes:

• impact assessments

• ethical review

• risk evaluation

• approval checkpoints

• rollback plans

An MSA (A) supports contracts but does not manage operational change. Shared responsibility (C) describes roles, not change control. Data minimization (D) reduces exposure but doesn't control model updates.

AAISM stresses that the largest and most immediate risk for generative AI is unintentional data leakage by employees, making acceptable-use policies and staff training the most effective short-term risk mitigation. Users must be instructed not to input sensitive data, understand usage restrictions, and follow governance requirements.

Relying solely on third-party audits (D) is insufficient. IP agreements (A) and opt-out clauses (B) are contractual protections, not operational safeguards.

AAISM highlights that model cards are a governance tool designed to document ethical considerations, limitations, fairness constraints, data sources, and suitability of use cases for AI models—especially when they affect individuals' rights, opportunities, or access to services.

Their greatest value is providing transparency and ethical clarity, ensuring stakeholders understand risks, bias considerations, and how decisions impact users.

Deployment instructions (B) are not part of model cards. They do not reduce data needs (C), nor is model type selection (D) their primary purpose.