A company is integrating an AI-powered recommendation engine into its e-commerce website. The engine is hosted on a separate server and communicates via a REST API. The security team is concerned about prompt injection attacks where an attacker could manipulate the AI to output malicious content. The company also wants to ensure that the AI does not expose sensitive internal data. Which combination of controls is most effective?

Implement output filtering to block malicious content and restrict the AI's access to internal data.

Encrypt all communication between the website and the AI server.

Use a VPN to connect the website and the AI server.

Use a web application firewall (WAF) to block malicious requests.

A research institute is setting up an AI training environment that uses GPUs and large datasets. The environment must be isolated from the rest of the corporate network to prevent data leakage, but researchers need to access the environment remotely. Which architecture best meets these requirements?

Use a dedicated physical server with no network connectivity and transfer data via removable media.

Place the AI environment in a separate subnet with a VPN gateway for remote access.

Connect the AI environment directly to the corporate network with strong firewall rules.

Use a public cloud environment with no network restrictions and rely on encryption.

A software company is integrating a third-party AI chatbot into its customer support application. The chatbot accepts user input and returns responses. The security team is concerned about malicious input that could cause the chatbot to behave unexpectedly or leak sensitive information. Which control is most important to implement?

Implement rate limiting on the chatbot API to prevent denial-of-service attacks.

Encrypt all communication between the application and the chatbot API.

Use a firewall to restrict access to the chatbot API to only the application servers.

Input validation and sanitization of all user inputs before they are sent to the chatbot.

ISACAAdvanced in AI Security Management

Domain 3Objective 1

AI Security Architecture and Design AAISM Practice Questions (Page 1)

Part of the AI Technologies and Controls domain, which accounts for 38% of the AAISM exam.

31questions here

7free pages

7concepts

38%of the exam

Questions 1–5

1expert · hard
A company is integrating an AI-powered recommendation engine into its e-commerce website. The engine is hosted on a separate server and communicates via a REST API. The security team is concerned about prompt injection attacks where an attacker could manipulate the AI to output malicious content. The company also wants to ensure that the AI does not expose sensitive internal data. Which combination of controls is most effective?
Select an answer first
2application · medium
A research institute is setting up an AI training environment that uses GPUs and large datasets. The environment must be isolated from the rest of the corporate network to prevent data leakage, but researchers need to access the environment remotely. Which architecture best meets these requirements?
Select an answer first
3application · medium
A software company is integrating a third-party AI chatbot into its customer support application. The chatbot accepts user input and returns responses. The security team is concerned about malicious input that could cause the chatbot to behave unexpectedly or leak sensitive information. Which control is most important to implement?
Select an answer first
4foundation · medium
Which security practice is essential when integrating an AI component into a web application to prevent malicious inputs from causing unexpected behavior?
Select an answer first
5foundation · medium
Which security objective for an AI data pipeline ensures that data is accessible to authorized users and systems when needed?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AAISM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “AAISM” is a trademark of its owner, used for identification only.

AI Security Architecture and Design AAISM Practice Questions (Page 1)

Questions 1–5

Which security practice is essential when integrating an AI component into a web application to prevent malicious inputs from causing unexpected behavior?

Which security objective for an AI data pipeline ensures that data is accessible to authorized users and systems when needed?

Keep studying — AI Technologies and Controls