According to AAISM study guidance, the most direct and effective way to obtain large volumes of diverse data for application testing is through open-source data repositories. These repositories provide freely available, well-documented, and often standardized data that supports testing and benchmarking in a compliant manner. Model cards document AI behavior but do not provide data. Incorporating search content may introduce legal, privacy, and quality risks. Data augmentation is useful for expanding existing sets but does not provide the breadth or size required when starting with insufficient data. The recommended best practice for sourcing large testing datasets is therefore the use of open-source repositories.
References:
AAISM Study Guide - AI Technologies and Controls (Data Sources and Testing Practices) ISACA AI Security Management - Data Governance and Compliance in AI Testing

Explanation:
AI tools that monitor sensitive data and access patterns can quickly detect anomalies or potential breaches. Early detection enables prompt initiation of incident response, minimizing the impact of unauthorized access and improving overall data security posture.

AAISM study materials stress that weak access controls are the most easily exploited vulnerability in AI systems. Without strong access restrictions, adversaries can directly query, extract, manipulate, or overload models, leading to data leakage or compromised outputs. While inaccurate generalizations, DoS vulnerabilities, or susceptibility to input manipulation are serious, they typically require more effort or specific conditions. Weak access control provides the most direct and immediate entry point for attackers. As such, it is identified as the most easily exploited vulnerability.

AAISM defines data poisoning as the insertion of malicious or corrupted data into training (or fine-tuning) pipelines to degrade or bias model behavior, thereby compromising output integrity in production. While poisoning occurs during development/training (C), its primary objective is the downstream integrity impact on predictions/outputs (D). Options A and B relate to confidentiality threats (e.g., inversion or leakage), not poisoning.
References:* AI Security Management (AAISM) Body of Knowledge: Model Integrity Threats-data poisoning aims and effects; supply-side data controls* AAISM Study Guide: Risk scenarios for poisoning; mitigations via data provenance checks, robust training, and anomaly detection

Implementing explainable AI techniques and documenting model decision logic addresses the core concern of transparency while allowing the organization to continue benefiting from the AI system's diagnostic accuracy. This supports accountability, regulatory compliance, and informed communication with patients and regulators.