Isaca Updated AAISM Exam Questions and Answers by andrei

Secure aggregation cryptographically aggregates client updates so that the server learns only the sum/aggregate, not any single client’s update. Properly implemented, the server cannot recover individual contributions—even if compromised—thereby preserving client confidentiality. Option C (encryption in transit) is insufficient because decryption at the server reveals updates; Option A is procedural, not cryptographic; Option B (differential privacy) is a separate technique and not the defining property of secure aggregation.

The AAISM framework specifies that the primary metric of effectiveness in vendor management is the vendor’s compliance with AI-related requirements defined in contracts and governance frameworks. This provides measurable assurance that vendors adhere to agreed-upon privacy, security, and ethical standards. Reviews of threat reports, training results, or research participation are supplemental and may support continuous improvement, but they do not establish compliance accountability. Governance requires a direct focus on whether contractual and regulatory obligations are being fulfilled. Therefore, vendor compliance with AI requirements is the most important monitoring focus.

AAISM emphasizes that the primary objective of responsible AI is to establish and maintain trust in AI-driven decisions and predictions. Trust is achieved through transparency, accountability, fairness, and governance. While confidentiality and integrity are critical technical objectives, they are not the overarching purpose of responsible AI service provision. Autonomy and learning ability are features of AI, but without trust, adoption and compliance falter. The correct answer is that responsible AI services must focus on building trust in AI outcomes.

The most critical risk when deriving statistical insights from AI-generated data is systemic bias in data. According to the AI Security Management™ (AAISM) framework, systemic bias directly undermines the fairness, reliability, and validity of analytical results derived from AI systems. If the input data or learned model patterns are biased—reflecting skewed representation, sampling imbalance, or embedded prejudice—the statistical outputs will propagate and amplify these biases, leading to misinformed decisions and compliance violations.

Why Option A is Correct:

Systemic bias affects the integrity and trustworthiness of AI-generated statistical information.

It can introduce discriminatory outcomes, ethical breaches, and regulatory non-compliance—key concerns in AAISM’s AI Risk Management and Governance principles.

Mitigating systemic bias requires data quality assessments, fairness audits, bias detection tools, and model interpretability measures to ensure the derived insights are accurate and ethically sound.

Why Other Options Are Incorrect:

Option B: Incomplete outputs can affect accuracy but are typically handled through process monitoring or retraining, not as a primary risk factor in statistical validity.

Option C: Lack of data normalization is a technical preprocessing issue, not a governance-level risk impacting statistical trustworthiness.

Option D: Hallucinations occur mainly in generative models (e.g., LLMs) and affect content generation, not statistical computation pipelines.

Exact Extract from Official AAISM Study Guide:

“Systemic bias in AI training and inference data represents the most material statistical risk. Bias propagates through derived metrics, predictive models, and decision outputs, compromising fairness, accuracy, and compliance. AI Security Management requires implementing bias detection, fairness testing, and governance mechanisms to identify and mitigate such systemic bias before using AI-generated analytics for organizational or regulatory reporting.”