Free AAISM practice test: 20 questions
Twenty questions across the three AAISM domains, weighted roughly as the real exam is. AAISM sits at the intersection of security management and AI, so answers favour controls a security manager can implement and evidence.
AI Governance and Program Management
Question 1. A security manager is establishing AI security governance. What is the first deliverable?
- A. A procurement standard for GPUs
- B. An inventory of AI systems with owner, data used and risk rating
- C. A red-teaming tool selection
- D. A vendor shortlist
Show answer
Answer: B
An inventory of AI systems with owners, data and risk rating defines the scope everything else applies to. Tooling and standards cannot be targeted without it.
Question 2. Which reporting line gives AI security the best chance of being effective?
- A. A working group inside the data science team
- B. An informal community of interest
- C. A quarterly newsletter
- D. Integration into existing security governance with executive escalation
Show answer
Answer: D
Integration into the existing security governance structure, with escalation to executive level, gives authority and avoids a parallel programme nobody acts on.
Question 3. An AI security policy must apply to systems built by business units without IT involvement. What makes this feasible?
- A. Risk-tiered requirements with a lightweight path for low-risk systems
- B. Identical requirements for every system regardless of risk
- C. Prohibiting business units from using AI
- D. Requiring a security architect on every project
Show answer
Answer: A
Risk-tiered requirements with a lightweight path for low-risk systems make compliance realistic for non-specialists. Uniform heavyweight requirements drive shadow deployment.
Question 4. Which KPI best reflects AI security programme maturity?
- A. Number of security tools deployed
- B. Size of the security team
- C. Percentage of the AI inventory security-assessed, and time to close findings
- D. Number of policies published
Show answer
Answer: C
Coverage of the inventory by completed security assessments, with time to close findings, measures both reach and follow-through. Tool and headcount counts measure inputs.
Question 5. Business pressure is to deploy an AI system before security review completes. What is the correct managerial response?
- A. Approve informally to avoid delay
- B. Document residual risk and require formal acceptance at the appropriate authority
- C. Refuse without offering an alternative
- D. Escalate to the external auditor
Show answer
Answer: B
Presenting the residual risk for formal acceptance at the right authority keeps the decision with the business while preserving the record. Silent approval or blanket refusal both fail.
Question 6. Which is the strongest evidence that AI security requirements are embedded in the delivery process?
- A. Pipeline gates with recorded instances of releases blocked or changed
- B. Attendance records for awareness sessions
- C. A published secure AI standard
- D. A security champion named per team
Show answer
Answer: A
Gates in the delivery pipeline that have actually blocked or changed releases show embedded control. Awareness sessions show communication only.
AI Risk Management
Question 7. A model consumes documents from an external partner. Which threat should be assessed first?
- A. Endpoint latency
- B. Inference cost growth
- C. Indirect prompt injection and content poisoning via the partner’s documents
- D. Storage capacity
Show answer
Answer: C
Untrusted content entering the model’s context is the direct path to indirect prompt injection and poisoning. Availability and cost matter less at assessment stage.
Question 8. How should the risk of model extraction be assessed for a public-facing endpoint?
- A. By the model’s parameter count
- B. By the model’s commercial value, achievable query volume and richness of returned output
- C. By the programming language used
- D. By the number of developers on the team
Show answer
Answer: B
Value of the model, query volume achievable and output richness determine feasibility and impact. Model size and framework are not the drivers.
Question 9. An AI system processes special category personal data. What should the risk assessment explicitly cover?
- A. Inference latency targets
- B. The choice of optimiser
- C. GPU utilisation
- D. Lawful basis, necessity and proportionality, data subject rights and retention
Show answer
Answer: D
Lawful basis, necessity and proportionality, plus data subject rights and retention, are the specific obligations attaching to special category data.
Question 10. Which residual risk is most often underestimated for agentic systems?
- A. The blast radius of the agent’s tool permissions when it is manipulated
- B. The cost of tokens
- C. The colour of the interface
- D. The size of the log files
Show answer
Answer: A
The blast radius of tool access, where a manipulated agent acts with its granted permissions, is routinely underestimated relative to content risks.
Question 11. A vendor refuses to disclose training data sources for a model used in a regulated process. How should this be treated?
- A. Accepted silently, since vendors rarely disclose
- B. Rejected automatically
- C. Documented as a risk, mitigated contractually where possible, and escalated for a decision
- D. Referred to the marketing team
Show answer
Answer: C
It is a risk to be assessed, documented and either mitigated contractually or escalated for acceptance. Neither blind acceptance nor automatic rejection is a risk decision.
Question 12. What distinguishes AI risk assessment from conventional application risk assessment?
- A. AI systems run on different hardware
- B. Non-deterministic behaviour means testing cannot enumerate outcomes, shifting assurance to monitoring and constraint
- C. AI systems never handle personal data
- D. AI systems are exempt from change control
Show answer
Answer: B
Non-deterministic behaviour means testing cannot enumerate outputs, so assurance depends on monitoring and constraint rather than exhaustive verification.
AI Technologies and Controls
Question 13. Which control most directly reduces the impact of prompt injection in a retrieval-based application?
- A. Isolating retrieved content from the instruction channel and treating it as untrusted data
- B. Filtering for suspicious keywords in retrieved text
- C. Setting temperature to zero
- D. Using a larger model
Show answer
Answer: A
Separating retrieved content from the instruction channel and treating it as data removes the mechanism. Filtering keywords is brittle and easily evaded.
Question 14. An LLM application must not expose data belonging to other tenants. What is the primary control?
- A. A system prompt instructing the model to respect tenancy
- B. Per-tenant rate limits
- C. Separate colour themes per tenant
- D. Tenant-scoped authorisation enforced at retrieval, before content reaches the model
Show answer
Answer: D
Enforcing tenant scoping at retrieval and authorisation, before content reaches the model, prevents cross-tenant leakage. Prompt instructions cannot enforce isolation.
Question 15. What is the purpose of red-teaming a generative AI system?
- A. To measure inference latency under load
- B. To adversarially probe for harmful, unsafe or policy-violating behaviour
- C. To reduce token cost
- D. To benchmark against competitors
Show answer
Answer: B
Adversarial testing probes for harmful, unsafe or policy-violating behaviour that normal testing misses. It is not a performance or cost exercise.
Question 16. Which logging approach best supports AI incident investigation without creating a new data risk?
- A. No logging, to avoid retaining data
- B. Logging full prompts and completions indefinitely
- C. Logging metadata, decisions and source references with sensitive content redacted
- D. Logging only errors
Show answer
Answer: C
Logging metadata, decisions and references with sensitive content redacted supports investigation while limiting exposure. Logging everything in full creates a high-value target.
Question 17. An agent must call internal APIs. Which design limits harm if the agent is manipulated?
- A. Narrow, least-privilege tools with confirmation required for consequential actions
- B. A single credential with broad access for simplicity
- C. Disabling logging to reduce noise
- D. Allowing the agent to generate its own API calls freely
Show answer
Answer: A
Narrowly scoped, least-privilege tools with confirmation for consequential actions cap what any manipulation can achieve. Broad credentials do the opposite.
Question 18. Which control addresses model supply chain risk most directly?
- A. Endpoint rate limiting
- B. Output content filtering
- C. Access reviews for the data team
- D. Provenance and integrity verification of model artefacts, with pinned versions from trusted sources
Show answer
Answer: D
Verifying provenance and integrity of model artefacts, and pinning versions from trusted registries, addresses tampering and substitution in the supply chain.
Question 19. Content filtering is applied only to model outputs. What gap remains?
- A. Latency increases
- B. Malicious input still reaches the model and may drive harmful actions before output filtering applies
- C. Costs rise
- D. Logs become larger
Show answer
Answer: B
Without input filtering, malicious or policy-violating prompts still reach the model and may cause harmful tool use or leakage before any output is produced.
Question 20. Which measure best protects against an insider exfiltrating a proprietary model?
- A. Least-privilege access to model artefacts with monitoring and egress controls
- B. Output content filtering on the endpoint
- C. A stronger system prompt
- D. Rate limiting on the public API
Show answer
Answer: A
Restricting and monitoring access to model artefacts, with egress controls, addresses the actual asset. Endpoint filtering and prompt rules protect use, not the weights.
How did you do?
Sixteen or more correct suggests you are close. Below fourteen, the domain guides in this section are the fastest fix — AAISM rewards picking the control that removes the attack’s mechanism rather than the one that merely detects it.