Understand why enterprise AI cannot be managed as simply another SaaS application.
Topics
·Evolution from traditional applications to AI-powered applications
·Generative AI, LLMs, multimodal models and reasoning models
·AI applications versus AI agents; AI models versus AI systems
·Internal AI versus external AI; SaaS AI, APIs, local and private models
·Enterprise AI architecture: model providers, AI gateways, vector databases, RAG, MCP servers, plugins, agents, data sources, AI identity
Key concept
Traditional security: User → Application → Data. Enterprise AI: User → AI Application → Model → Data → Tools → Agents → External Systems. Every new connection creates a new control surface.
Aidome connection
Introduction to the Enterprise AI Control Plane.
ACASF Exam Summary
40 questions, 60 minutes, 80% to pass, 2-year certification validity.
AI architecture15%
AI security threats20%
AI governance15%
Data security15%
Agent and MCP security15%
AI risk management10%
AI Control Plane10%
Practice Test
Test your knowledge
ACASF Practice Exam
50 questions
1. Which best describes the enterprise AI interaction chain versus traditional applications?
2. What are the seven AI security surfaces?
3. AI security begins with:
4. Which is an AI-specific threat traditional controls may miss?
5. RAG poisoning is an attack against:
6. In OWASP GenAI, 'excessive agency' refers to:
7. A finance user may be allowed to use GPT-5 and financial RAG but not public models or payment tools. This is an example of:
8. The risk of AI increases dramatically when:
9. An AI agent with email, calendar, CRM, file access, payment API and cloud admin is best described as:
10. Which is a valid model policy tiering?
11. Which frameworks are introduced for AI risk management?
12. AI activity must become:
13. Where does the AI Control Plane sit?
14. Phase 1 of the CISO AI security program is:
15. An AI-BOM (AI Bill of Materials) tracks:
16. MCP governance includes approving:
17. The ACASF exam passing score is:
18. A user authorized to read two datasets separately should not necessarily be able to:
19. Which is a GenAI Firewall protection?
20. The strongest initial Academy structure is:
21. Generative AI, LLMs, multimodal models and reasoning models are part of:
22. What distinguishes an AI agent from an AI application?
23. Which is a component of enterprise AI architecture?
24. What is the key question for AI security instead of 'Is ChatGPT allowed?'
25. What is an AI-BOM?
26. Which is an example of sensitive information disclosure in AI?
27. What is jailbreaking in the AI security context?
28. What is model theft?
29. What is unbounded consumption in OWASP GenAI?
30. Which data classifications are introduced in the course?
31. What is RAG data?
32. Which identity standards are introduced for AI?
33. What is attribute-based policy in AI identity?
34. What is tool calling in the context of AI agents?
35. What is agent-to-agent communication?
36. What is delegated authority for an AI agent?
37. Which is a valid data residency concern for AI?
38. What is the model policy tiering for restricted information?
39. Which is a phase of the CISO AI security program?
40. What does AI observability require security teams to retain?
41. What is a GenAI Firewall?
42. What is the purpose of the AI Gateway?
43. Which is an example of excessive permissions for an AI agent?
44. What is the EU AI Act's role in the course?
45. What is NIST AI RMF?
46. What is the final CISO exercise in the course?
47. What is autonomous action risk?
48. What is the purpose of policy binding in an AI Control Plane?
49. What is the validity period of the ACASF certification?
50. What is the recommended prerequisite for ACASA?
Answer all questions to submit.
Get certified
Pass the official 40-question exam to earn the ACASF certificate, badge and LinkedIn credential.