Isaca Updated AAISM Exam Questions and Answers by efan

According to AAISM lifecycle management guidance, the best justification for disabling an AI system immediately is the detection of excessive model drift. Drift results in outputs that are no longer reliable, accurate, or aligned with intended purpose, creating significant risks. Performance slowness and overly detailed outputs are operational inefficiencies but not critical shutdown triggers. Insufficient training should be addressed before deployment rather than after. The trigger for immediate deactivation in production is excessive drift compromising reliability.

AAISM training guidance specifies that social engineering is the awareness topic most impacted by AI-enabled risks. With generative AI and deepfake technologies, attackers can create highly convincing phishing messages, synthetic voices, or fake executive requests, increasing the sophistication of social engineering attacks. Clean desk policies, insider threat awareness, and authentication procedures remain relevant but are not directly altered by AI advancements. The most likely revision to employee awareness programs in the AI era is therefore enhanced social engineering awareness.

AAISM frameworks highlight output-based controls, including output filtering, restriction validation, and policy-aligned guardrails as primary defenses for AI agents with high privileges. Ensuring the agent does not output unauthorized instructions or sensitive data directly mitigates misuse.

Allowing user configuration (B) increases risk. Prohibiting manipulation entirely (C) is impractical. Reducing human oversight (D) increases system abuse potential.

AAISM emphasizes strong contractual restrictions on how vendors use customer data, especially prohibiting vendors from using customer inputs to train or fine-tune shared models.

This protects against:

• data leakage

• intellectual property exposure

• regulatory violations

• shadow training of external models

Log sharing (B) and query limits (D) are operational controls but do not directly prevent data misuse. Unlimited retraining (A) has no relevance to security.