Which of the following is the GREATEST contributor to end user security risk associated with generative AI?
Correct Answer: A
End users are a primary interface with generative AI, and without sufficient awareness training they may unknowingly misuse the technology, expose sensitive data, or fall victim to AI-enabled threats, making this the largest contributor to security risk.
Question 122
A large financial services organization is integrating a third-party AI solution into its critical fraud detection system. Which of the following is the BEST way for the organization to reduce risk associated with AI vendor and supply chain dependencies?
Correct Answer: C
AAISM emphasizes supplier assurance through contractual obligations as the foundational control for AI supply chain risk. Contracts should require verifiable evidence of secure development practices (e.g., secure SDLC, model and data provenance documentation, SBOM/MBOM where applicable, vulnerability disclosure, patch SLAs, audit rights, incident notification, and regulatory compliance assertions). This creates enforceable, continuous assurance beyond point-in-time tests. * A is necessary but reactive and limited to your environment. * B addresses performance, not supply chain security. * D is a good isolation/validation practice but does not create vendor accountability across the lifecycle. References:* AI Security Management (AAISM) Body of Knowledge: Third-Party and Supply Chain Governance-Contractual security requirements, evidence-based assurance, right-to-audit.* AI Security Management Study Guide: Vendor due diligence artifacts, secure development evidence, lifecycle obligations for AI providers.
Question 123
An organization is updating its vendor arrangements to facilitate the safe adoption of AI technologies. Which of the following would be the PRIMARY challenge in delivering this initiative?
Correct Answer: C
In the AAISM™ guidance, vendor management for AI adoption highlights that large AI providers often resist contractual changes, particularly when customers seek to impose stricter security, transparency, or ethical obligations. The official study materials emphasize that while organizations must evaluate AI risk and build internal expertise, the primary challenge lies in negotiating acceptable contractual terms with dominant AI vendors who may not be willing to adjust their standardized agreements. This resistance limits the ability of organizations to enforce oversight, bias controls, and compliance requirements contractually. References: AAISM Exam Content Outline - AI Risk Management AI Security Management Study Guide - Third-Party and Vendor Risk
Question 124
Which of the following is an information security manager's BEST recommendation when the new release of a proprietary AI model is generating inconsistent output?
Correct Answer: D
Reverting to a prior stable version is the best immediate recommendation because inconsistent output from a new model release indicates potential instability or unintended behavior. Restoring the previously validated version minimizes operational and security risk while the issue is investigated and corrected.
Question 125
An organization is implementing AI agent development across engineering teams. What should AI-specific training focus on?
Correct Answer: A
AAISM states that AI agent security training should focus on the unique risks of agentic systems, which include: * prompt injection * memory control and context hijacking * unsafe tool execution (agents triggering unauthorized actions) These risks are specific to autonomous or semi-autonomous AI agents. Bias, fairness (B) and output moderation (C) are important but not the most critical for agent security. API abuse and plug-in risk (D) matter but are secondary. References: AAISM Study Guide - Agentic AI Security; Prompt Injection and Tool Execution Risks.
