Good AAISM practice questions do not test whether you know what a firewall is. They test whether you can stop yourself giving the answer a good security manager would give. That follows from who ISACA lets sit the exam: you cannot register without an active CISM or CISSP, so the item writers already know what is in your head, and they write to catch it.
A useful walkthrough is therefore not five questions with the correct letter circled. It is five where a defensible classical answer sits in the option list and is wrong for an AI system. These five come from our own AAISM bank, rewritten as prose. Three are Domain 3, which carries 38 percent of a 90-question exam, and each ends with a paragraph per wrong option naming the misconception it exploits.
What is different about an AAISM question?
The stem shape is ISACA's usual: a short scenario, a qualifier in capitals, four options that are all real things a security function does. What changes is that the answer turns on a property of AI systems that classical controls assume away. The system is not deterministic, or its instructions and its data arrive through the same channel, or the artifact under attack is a set of weights rather than a codebase. Those properties generate most of the traps, and the trap type tracks the domain, so keep the AAISM domain breakdown open alongside this.
A backdoor is found in a production model. What do you do first?
Domain 3, AI Technologies and Controls.
An investigation into a set of fraudulent transactions reveals that a backdoor was inserted into the organization's AI model. Which of the following is the BEST immediate course of action?
A. Review the model's source code to identify and remove the malicious insertion point.
B. Apply enhanced input filtering and sanitization to prevent the backdoor from being triggered.
C. Conduct a thorough access review of who has had write access to the model weights.
D. Revert the AI model to the most recent known-good version prior to the suspected compromise.
Answer: D.
The backdoor is in the model, and the model is running. Reverting to a verified prior version removes the compromised artifact from production, which is the only option that stops the harm. Everything else happens afterward.
Option A is the software-security reflex and the strongest wrong answer in the set. In a classical compromise you find the malicious code and cut it out. A trained model does not work that way: the backdoor lives in learned weights, not a readable insertion point, and hunting for it leaves the compromised model serving traffic. Trap pattern: treating a model as a codebase.
Option B is the compensating-control reflex. Filtering inputs may suppress the trigger you identified and does nothing about variants you did not. It also leaves a known-compromised model in production.
Option C is correct work in the wrong order. Reviewing who had write access to the weights is investigation, not containment. ISACA's ordering questions punish good work done at the wrong moment more reliably than they punish bad work.
Why is access control the wrong answer to prompt injection?
Domain 3, AI Technologies and Controls.
Which of the following controls would BEST protect a large language model against prompt injection attacks?
A. Continuous validation and retraining of the model's training datasets to remove adversarial examples
B. Strict access controls limiting which users and systems can submit queries to the model
C. Context awareness mechanisms that enable the model to identify and disregard inputs attempting to override its instructions
D. Stress testing the model under high query volumes to identify performance degradation thresholds
Answer: C.
Prompt injection works because a language model cannot structurally tell an operator instruction from user text or retrieved content. They arrive in the same context window as the same kind of thing. The control that addresses that mechanism teaches the model to weigh an incoming prompt against its defined role and refuse instructions that try to override it. The OWASP Top 10 for LLM Applications treats context-aware instruction separation as the primary technical control.
Option B is the trap, and it catches more experienced candidates than any other option here. Restricting who can query the model is the right answer to almost every classical version of this question. Against injection it shrinks the attacker population and changes nothing else: an authorized user submits the same crafted prompt and it works just as well. Trap pattern: applying an access control to a semantic problem.
Option A moves the defense to the wrong life cycle stage. Cleaning training data addresses poisoning and model integrity before deployment. Injection happens at inference time, against a model whose training is already finished.
Option D is a capacity control wearing a security label. Stress testing tells you where throughput degrades and nothing about adversarial prompt patterns. It is on the list because testing looks like diligence.
What goes wrong when you decommission an agentic AI system?
Domain 3, AI Technologies and Controls.
An organization is decommissioning an agentic AI system that autonomously generated temporary credentials and dynamically produced code scripts during its operation. Which of the following represents the GREATEST security concern during decommissioning?
A. Loss of clarity in the decision-making audit trail for past autonomous actions.
B. Persistence of residual artifacts, such as credentials, scripts, and spawned processes, that could enable unauthorized activity after shutdown.
C. The ongoing cost of retaining operational logs beyond their useful retention period.
D. Unavailability of system performance data needed for post-decommission retrospective analysis.
Answer: B.
Classical secure disposal is about data: wipe the media, revoke the accounts you provisioned, archive what you have to keep. An agent that mints its own credentials and writes its own scripts has been provisioning things you never put on a list, and those credentials, scripts and scheduled jobs outlive the shutdown. The life cycle disposal expectations in ISO/IEC 42001 and ISO/IEC 27001 both land here.
Option A is the governance instinct, a genuine concern but not the greatest one here. A thin audit trail costs you accountability later. It does not leave an attacker a working path in tomorrow. Trap pattern: ranking an accountability gap above an open attack surface.
Option C is an operating-cost question dressed as a risk question. Log retention beyond usefulness is a budget conversation, not a security one.
Option D inverts the scenario. Losing performance data hurts your retrospective, which is an analysis problem, and the question asked about security.
Does naming the attack correctly actually matter?
Domain 2, named "AI Risk Management" on ISACA's exam content outline page and "AI Risk and Opportunity Management" in the AAISM Candidate Guide.
An attacker manipulates multiple AI agents into simultaneously executing CPU-intensive tasks, exhausting the organization's compute quota and rendering the AI environment unavailable. Which of the following agentic AI threat categories does this scenario represent?
A. Unbounded consumption
B. Reflection-loop entrapment
C. Intent-breaking manipulation
D. Agent identity spoofing
Answer: A.
You recognized the mechanism before you read the options. It is resource exhaustion, and in a classical environment you would call it a denial-of-service attack and move on. The question is not asking you to recognize it. It asks whether you have learned the agentic vocabulary, in which agents driven to consume compute, memory, API quota or token budget without limit fall under unbounded consumption.
Option B is a different failure in the same family. Reflection-loop entrapment exploits an agent's self-evaluation step to trap it in recursive analysis. Compute does get consumed, but the entry point is the agent's own reasoning loop rather than externally triggered tasks.
Option C, intent-breaking manipulation, is goal corruption: the agent is redirected to pursue something other than its assigned objective. Nothing here says the agents did the wrong work. They did heavy work until the quota ran out.
Option D is impersonation. Identity spoofing covers an attacker masquerading as a trusted agent, which is not what this scenario describes.
Vocabulary questions are the cheapest marks on this exam and the most annoying to lose. They are part of why the AAISM is harder than its length suggests.
Employees are using unapproved AI tools. What actually works?
Domain 1, AI Governance and Program Management.
Employees across multiple departments are using AI tools that have not been reviewed or approved by the organization's AI governance team. Which of the following actions BEST minimizes the risk from this shadow AI usage?
A. Implementing a formal AI performance evaluation framework for all deployed tools.
B. Combining detective controls to identify unauthorized AI usage with employee training on approved AI practices.
C. Issuing a policy that prohibits all shadow AI and establishing penalties for violations.
D. Banning the use of all AI tools organization-wide until an approval framework is established.
Answer: B.
Detection gives you the usage already happening, through network monitoring, data-loss prevention and software inventory. Training changes what happens next, by giving people an approved route to the thing they were going to do anyway. Shadow AI is a demand problem with a visibility problem attached, and addressing only one leaves the other running.
Option C is the classical security manager's answer, and the one this question exists to catch. Policy plus penalties is how you handle unapproved software in a world where you can see unapproved software. Without detective controls you have published an intention and built no enforcement, so the tools stay embedded and stay invisible. Trap pattern: mistaking a written prohibition for a control.
Option D is the same instinct with the volume turned up. A blanket ban is disruptive, usually unenforceable and counterproductive: it pushes usage underground, leaving your visibility worse than before you acted.
Option A is a governance activity aimed at the wrong population. A performance evaluation framework governs approved tools. It says nothing about the ones you do not know exist.
Which domain catches experienced security managers out?
Domain 3, and not because the material is hardest in the abstract. It is the domain that feels most like home. It is the technical one, it is 38 percent, and its scenarios are full of endpoints, credentials, incident response and control selection. That familiarity is the problem: you answer from muscle memory, and Domain 3 is where the properties of the system changed while the vocabulary stayed the same.
Domain 1 is the opposite. If you hold a CISM, its governance questions are close to free, because program structure, roles, policy and training do not change much when the asset is a model. Domain 2 sits in between and fails on naming rather than judgment, a study problem rather than a thinking problem. Domain 3 therefore deserves more than 38 percent of your practice time, which is how our AAISM study plan weights it.
How should you use AAISM practice questions?
Work in small sets while you are still learning, ten to fifteen questions on the material you studied that session, and save full-length timed runs for the last couple of weeks. The exam is 90 multiple-choice questions in 150 minutes, about 100 seconds each, and that pace only means something once your coverage is wide enough for a score to be informative.
Then do the part most candidates skip. For every question you got right, write one sentence on why the second-most-attractive option failed. That is the habit these five are built to develop, because the distractor is never obviously bad. It is the answer you would give in a meeting, about a system that does not behave the way the systems in that meeting behave. ISACA AAISM: Simply Certified Study Guide explains all four options for every item in both practice exams.
One thing not to over-read: your score report. AAISM is reported on a scaled range of 200 to 800 with 450 to pass, and domain-level results are informational only, since scoring does not work from domain percentages. Find your weak domain in practice instead.
FAQ
How many AAISM practice questions should I do before the exam?
There is no magic number, and the quality of your review matters more than the volume. A reasonable target is a few hundred questions worked properly, plus two full-length 90-question timed runs late in your preparation. Reworking every error, including the near-miss options on questions you answered correctly, is worth more than doubling the count.
Are AAISM practice questions the same style as CISM questions?
The format is the same, including the capitalized qualifiers such as BEST, FIRST and GREATEST. The reasoning differs. CISM distractors are usually wrong controls or wrong sequencing, while AAISM distractors are frequently right controls applied to a system property that has changed, such as a model that cannot separate instructions from data.
Which AAISM domain has the most practice questions?
Domain 3, AI Technologies and Controls, at 38 percent of the exam. Domain 1, AI Governance and Program Management, and Domain 2 are 31 percent each. Any practice set worth using should follow that split rather than dividing evenly in three.
Do I need to know NIST AI RMF and ISO/IEC 42001 by heart?
You need to recognize what each one is for and where it applies, not recite its structure. Questions reference NIST AI RMF, ISO/IEC 42001, ISO/IEC 27001, the OWASP Top 10 for LLM Applications and MITRE ATLAS as the reason an answer is correct, so being able to place each framework in the right conversation is enough. For the wider picture of what this credential covers, see what the AAISM certification is.
Working through AI security questions and want every option explained? ISACA AAISM: Simply Certified Study Guide teaches all three domains at the published 31/31/38 weighting and includes two full-length practice exams with a worked explanation for every answer, correct and incorrect.
Simply Certified is an independent publisher. AAISM, CISM and ISACA are trademarks of ISACA. Our books are independent study material and are not affiliated with, endorsed by, or sponsored by ISACA.