Every AAISM exam question is multiple choice, with a stem and four options, and every one is written to have a single best answer, often decided by a qualifier such as MOST likely or BEST. That is as much as ISACA says about its questions in public, because the questions themselves are confidential: ISACA's terms forbid candidates to copy, recreate or share any exam content. So a search for AAISM exam questions turns up two kinds of page: sites offering what they claim are the real questions, which ISACA says are "either deceptive or violating copyright laws", and practice questions written to ISACA's outline in the exam's format. This guide explains the format in ISACA's words, gives four original questions in that format with full rationales, sets out ISACA's rules on exam content and what breaking them costs, and says where legitimate practice can be found.
The short answer
- 90 questions, four options each, one best answer. "Every question has a stem (question) and four options (answer choices)", and "All questions are designed with one best answer."
- Qualifiers decide. "A question may require you to choose the answer based on a qualifier, such as MOST likely or BEST."
- Practical, not definitional. ISACA's questions are "developed with the intent of measuring practical knowledge and the application of general concepts and standards."
- Confidential. Copying, recreating or sharing exam content is prohibited, and the consequences run from a voided exam to a ban from every ISACA exam.
- Legitimate practice exists: ISACA's free practice quiz and its paid questions database, and independent banks of original questions written to the outline, like ours.
The format, in ISACA's words
The candidate guide describes the questions in three lines:
- "Every question has a stem (question) and four options (answer choices)."
- "Choose the correct or best answer from the options."
- "The stem may be in the form of a question or incomplete statement."
Its exam tips add the two habits that matter most: "Read each question carefully. A question may require you to choose the answer based on a qualifier, such as MOST likely or BEST." And: "Eliminate known incorrect answers and then make the best choice possible."
The phrase "best answer" is the key to the AAISM. When a question turns on a qualifier, more than one option can be partly right, and you are choosing the one that answers this question best, from the position of an AI security manager. That is why reading the stem for its qualifier before reading the options pays off, and why learning why each wrong option is wrong teaches more than learning which one is right.
How ISACA writes its questions
ISACA's page for item writers describes how questions for its exams are made. "We welcome certified practitioners to submit potential exam questions", and "Submitted items go through a rigorous review process by a panel of certified subject matter experts". On submission, "a member of our Item Development Team will review the item for adherence to ISACA's item writing guidelines", and "Writers are paid an honorarium and awarded two CPEs for each item accepted by the working group."
In other words, the questions come from certified practitioners and pass more than one round of review against ISACA's writing guidelines before they reach an exam. Practice questions worth your time follow the same discipline: a single defensible best answer, plausible wrong options, and a scenario a practitioner would recognize.
Four original AAISM-style questions
These four questions follow ISACA's format: a stem, four options, one best answer, and a qualifier. Each sits in a different part of the outline, and each rationale explains every option, not just the right one.
The first is about Domain 3's AI life cycle: what keeps watching a model after it goes live.
The second stays in Domain 3 but turns from monitoring to change: what a security manager should insist on before a model changes.
The third is a Domain 1 question about reporting to the board, where the trap is a number that looks reassuring.
The fourth is from Domain 2's risk treatment, and its qualifier is BEST describes, so you are choosing the most accurate statement.
What the four have in common
Each question has at least one option that is not wrong in itself: a yearly revalidation, a confidentiality agreement, a count of blocked sites, an insurance policy. Each is defeated by the qualifier or by the role you are playing, an AI security manager accountable for the enterprise's risk. That is the pattern to practice:
- Find the qualifier (EARLIEST, MOST, BEST) before reading the options.
- Decide what the manager is responsible for in the scenario: the decision, the control, the measure, the accountability.
- Eliminate options that answer a different question, however true they are.
- Choose the option that answers this one best.
To build that habit into a plan, see how to study for the AAISM.
Why AAISM dumps are a trap
Searches for AAISM exam questions also turn up sites selling what they call real, recent or leaked questions, sometimes as a PDF. ISACA's rules leave no room for them. Among the activities its Terms of Use prohibit, the candidate guide lists:
- "Copying, photographing, recording, memorizing, or otherwise attempting to retain or recreate any exam content or assisting anyone in retaining, recreating, or reconstructing exam content for any purpose"
- "Attempting to sell, license, distribute, exchange, give away, share, comment on, disclose, or discuss, either directly or indirectly, any exam content to any person or entity before, during, or after the exam verbally, in writing, or through any other method of communication, including but not limited to the internet, email, or online forum"
The consequences the guide lists for breaking the rules are "Dismissal or disqualification", "Voiding of the exam", "Revocation of ISACA membership and any certifications currently held" and "Banned from taking any ISACA exam". Revocation reaches any ISACA certification you already hold, a CISM included. The guide also says that ISACA "has the right to nullify exam scores if any of unacceptable behaviors are identified."
ISACA's own article on exam integrity is blunter still: "websites that offer access to supposed “live” test questions are either deceptive or violating copyright laws, and this would be considered a breach of the test-taker agreement." It lists other red flags too, "like guarantees to pass and individuals who encourage sharing questions from the latest exam."
Leaving the rules aside, a dump is also bad preparation. If its questions are invented, you are memorizing someone's guesses; if they are copied, using them breaks the rules above. Either way you are not learning to choose a best answer, which is the skill the exam tests.
How many questions are on the AAISM exam?
The exam is "2.5 hours (150 minutes); 90 multiple-choice questions". Not all of them count: "ISACA exams are comprised of scored items as well as pretest items. Pretest items are not used to calculate exam scores." ISACA does not say how many of the 90 are pretest items, and you cannot tell which they are, so every question deserves your full attention. Wrong answers cost nothing, in the guide's words "There are no penalties for incorrect answers", so answer all 90. The full format and scoring are in the AAISM exam format and scoring.
Where to practice AAISM questions
- ISACA's free practice quiz. ISACA publishes a short free AAISM practice quiz on its site, with explanations, and calls its questions "a small preview of what you can expect on exam day". You submit a form to see your results. Its questions are ISACA's, so we link to the quiz rather than repeat any of it.
- ISACA's questions database. ISACA sells an AAISM Questions, Answers & Explanations Database as a subscription, listed on its AAISM page.
- Our AAISM question bank. 1,717 original questions written to ISACA's outline in the exam's format, each with a rationale that explains the right answer and why each wrong one falls short. In practice mode the qualifier is marked in every stem that has one, you can practice by topic, by lesson or only the questions you missed, and the mock exam draws 90 questions by ISACA's domain shares on one 150-minute clock.
AAISM practice exam explains how to take a full mock and how to review it.
QualExam is an independent study resource, not one of ISACA's Accredited Training Organizations, and is not affiliated with, endorsed by, or sponsored by ISACA. Every question in our bank is original; none is AAISM exam content.
A free account opens the first topic, AI governance and regulation, in full: its 147 questions with rationales, its lessons and its flashcards, plus a short diagnostic and a study plan. You can see how the practice works on the AAISM practice page, and full access to all 1,717 questions is a single payment, with nothing to renew.
By QualExam editorial. Written against the certifying body’s published documents, pinned by hash so a revised edition shows up as a change.