AAIR practice examsFinished
ISACA Advanced in AI Risk
Managing AI risk: AI models, frameworks and use cases, integrating AI risk into enterprise risk management, ownership and accountability, policies and training, regulation and legal considerations, and trustworthiness and ESG; risk across the AI life cycle from design and procurement to training, validation, deployment and decommissioning, with data and asset management; and the AI risk program: scenarios and assessment, treatment, controls, metrics and reporting, supply chain risk, and incident response and continuity.
What you get
Papers are cut from the bank and weighted like the real exam, and no question appears in two of them. Every wrong answer comes back on later days until you have it right.
What the exam covers
| AI Risk Governance and Framework Integration | 37% |
| AI Life Cycle Risk Management | 21% |
| AI Risk Program Management | 42% |
Two sample questions
1. A company's product team asks why the AI RMF does not give it templates. What should the risk manager point the team to instead?
- A certification scheme run by NIST's own auditors for each AI system
- Profiles that tailor the framework to settings and goals — correct
- A fixed checklist that applies to every AI system
- A list of approved AI vendors for each industry
Why: The RMF does not prescribe templates; it offers use-case, temporal and cross-sectoral profiles.
2. A company lets its AI assistant draft payments but not send them. Which treatment does this partial restriction represent, based on the course?
- Full transfer of the payment risk to the bank
- Acceptance of every payment risk without controls
- Partial avoidance by removing a high-impact capability — correct
- Detection of payment fraud after it has occurred
Why: Avoidance can be partial, for example letting an assistant draft but not send payments.
The real AAIR exam
| Length | 150 minutes (2.5 hours) |
|---|---|
| Questions | 90 |
| Pass mark | 450 on a scale of 200 to 800 |
| Price | $459 (ISACA members) / $599 (non-members) |
| Recommended before you sit it | A qualifying certification such as CRISC, CISA, CISM, CGEIT, CDPSE, CISSP, CIA or PMI-RMP |
| Valid for | Maintained under the AAIR continuing professional education (CPE) policy |
Exam facts as published by ISACA; always check the vendor’s page before you book.
Study AAIR with Chiron
Chiron is invitation-only while we are in beta, and nothing is for sale yet: invited accounts use every paper, drill and course note for free.