AAISM describes AI architecture as a strategic alignment framework, ensuring AI systems, data pipelines, governance processes, and capabilities match organizational business goals and regulatory requirements.
While threat identification (B) and scalability (D) are advantages, the primary purpose is business alignment.
Option A is not a core architectural objective.
References: AAISM Study Guide - AI Architecture and Business Alignment.

Data splitting partitions a labeled dataset into training, validation, and test subsets to enable unbiased model tuning and evaluation. Training (A) consumes the training split; annotating (B) adds labels; learning (D) is a general term for model optimization, not a data management step.
References: AI Security Management™ (AAISM) Body of Knowledge - Data Lifecycle Controls; Dataset Partitioning for Validation and Testing. AAISM Study Guide - Train/Validation/Test Splits and Evaluation Integrity.

AAISM materials emphasize that the most effective preventive safeguard is to ensure input sanitization.
Preventive controls stop malicious or malformed inputs from reaching the model in the first place, thereby reducing the likelihood of prompt injection, evasion, or poisoning at inference time. Model output monitoring is a detective control, not preventive. Penetration testing is an assessment technique rather than a safeguard.
Differential privacy protects data privacy but does not prevent adversarial input manipulation. Therefore, the most important preventive safeguard in a new AI product is robust input sanitization.
References:
AAISM Study Guide - AI Technologies and Controls (Preventive vs. Detective Safeguards) ISACA AI Security Management - Input Validation in AI Systems

AAISM's risk management framework stresses that the most effective defense against deepfake-enabled fraud, such as payment diversion, is resilient payment approval processes. This includes multi-step verification, segregation of duties, and independent confirmations for high-value transactions. Employee training, policies, or limiting payment frequency may reduce exposure, but they cannot guarantee prevention.
Only process-based controls enforce structural safeguards that prevent fraudulent instructions from being executed, even if a deepfake impersonation attempt is successful.
References:
AAISM Exam Content Outline - AI Risk Management (Fraud and Deepfake Risk) AI Security Management Study Guide - Transactional Resilience and Controls

The highest-priority fit criterion for introducing a new AI security capability is alignment to the organization' s established control objectives and program architectures. Control objectives encode what must be achieved (e.g., detection coverage, response timeliness, accountability, auditability) and are the basis for requirements traceability across governance, risk, and technical controls. Ensuring the tool's capabilities directly satisfy those objectives provides architectural fit, policy conformance, and measurable assurance. While integration (e.g., SIEM), detection features (e.g., real-time anomaly detection), and orchestration are important, they are secondary to proving the tool maps to-and can be verified against-the control objectives that define the program's intended outcomes.
References:* AI Security Management™ (AAISM) Body of Knowledge: AI Governance and Program Management - Security program alignment, control objectives, and requirements traceability* AI Security Management™ Study Guide: Control objective mapping, architecture fit criteria, and solution selection governance