r/aaism

Hey guys, Passed my ISACA AAIR exam this morning! It was pretty intense on the threat modelling and model drift side but I'm excited to have it out of the way.
My next target is lAPP AIGP. My brain is already in "study mode" so I want to keep the momentum going and dive right in.

For those of you who've done both (or just the AIGP):

How much does the AAIR IT risk knowledge transfer to the AGP privacy and governance focus?

work full time but can provide around 2-3 hours a day. Can we get through the APP syllabus and the EU Al Act frameworks in 4 weeks?

What are the best practice exams available right now? I find I learn best by asking questions based on scenarios.

Thanks for the advice in advance!

Hey all, wanted to give a bit of a different post and shout out to the other things that helped me provisionally pass my AAISM today. I did NOT finish the ISACA study guide (I read 23 pages). I don't sit still long enough to read cover to cover so I looked for other sources. My background is CISM, CDPSE, CRISC holder and 12+ year cyber security vet. I am a current Deputy CISO so that helped a lot here I think.

Shout out for the following things for helping me study:

1. AudioCert AAISM course on YouTube music for my morning walks (https://music.youtube.com/playlist?list=PLKoelOVvuOTtFGHDy\_zt7jKu-RBFRAYyR&si=31SpwgmlY1vFMPE4)

2. Destination Certification app. Studied all the flashcards and went through the question 2xs (https://apps.apple.com/us/app/destcert-exam-prep/id6469578076)

3. Bare Metal Cyber podcast to get your mindset right. I didn't listen to them all but they did help paint the right picture (https://baremetalcyber.com/isaca-aaism)

I'm not saying this is the fool proof way to do it, but I didn't want to spend extra money buying all the ISACA stuff. If you study these enough you can do it! Good luck all.

I just passed the exam today!

Definitely did it a bit too quickly (finished my first pass of the whole thing in 50mins), but flagging the questions and reviewing it all over again really helped.

Questions that tripped me up were around data augmentation and synthetic data alteration. Also had a couple of questions that were centred around "what is the first step that the security manager should take" and all the options were steps that would take place (E.g. identify use case) before the security manager gets involved. Would've been a really easy trap!

Just now passed the exam.

Materials used:

Official review manual
Official QAE
extensive use of chatgpt and claude to understand the weak area.

Flagged 15 questions and changed 5 of them and submitted.

Must know the concepts of Data poisoning, evasion, model inference ( got around 10 questions)

This section is horribly written in the guide, and I've tried mapping these terms out.
Can someone help me understand these incestuous relationships:

Data Assets - Literal data
Data Inventory - List of data assets
Data Elements - Per field data assets
Data Dictionary - Collection of data elements (not data assets, not data inventories) at the application level
Business Glossary - No clue, but somehow links to data assets "concepts?","business terms"?
Data Catalog - Correlates data inventories to business context (I presume from the business Glossary)

Of all the needless diagrams, this area is horribly short sighted.

About to start studying for the exam and I noticed most that have passed used the primary resources, Official Review Manual and the QAE. Does anyone recommend the On-Demand course from ISACA, or is it redundant to their Review Manual?