Isaca ISACA-AAIA Online Practice Questions and Exam Preparation

Isaca ISACA-AAIA Online Questions & Answers

• Question 1:

  Which of the following is the MOST effective way an IS auditor could use generative AI to plan an audit of a new database storing transactional data?

  A. Identifying separation of duties conflicts for database data changes
  B. Developing architecture diagrams
  C. Identifying technology-specific risk and considerations
  D. Summarizing meeting transcripts from interviews with database administrators (DBAs)
  C. Identifying technology-specific risk and considerations

  ---

  Explanation

  Generative AI excels at synthesizing large datasets and technical documentation into understandable insights. The AAIATM Study Guide recommends leveraging generative AI to identify domain-specific risks and control considerations by

  analyzing complex environments and correlating them with industry risk patterns.

  "AI can assist auditors during planning by generating tailored risk profiles for technologies under review, helping prioritize audit focus and scoping."

  While summarizing interviews (D) and creating diagrams (B) are helpful, only C directly informs audit planning with actionable intelligence. A (separation of duties) is a later-stage control assessment.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI in Audit Processes," Subsection: "Generative AI Use in Planning and Scoping"

• Question 2:

  When using off-the-shelf AI models, which of the following is the MOST appropriate way for organizations to approach vendor management?

  A. Ensure a minimum of three quotes have been obtained for market research and comparison.
  B. Establish responsibility and clear terms for model updates and support.
  C. Only use models from vendors with globally recognized accreditation.
  D. Use the vendor only if the contract has been reviewed by the information security department.
  B. Establish responsibility and clear terms for model updates and support.

  ---

  Explanation

  When organizations leverage off-the-shelf AI models, effective vendor management is critical to ensure operational reliability, compliance, and long-term support. The ISACA Advanced in AI AuditTM (AAIATM) Study Guide highlights that the "establishment of clear contractual terms regarding responsibilities for ongoing model updates, maintenance, support, and incident response is essential for managing third-party AI risks."

  By clearly defining the roles and expectations for updates and support (option B), organizations reduce the risk of unaddressed vulnerabilities, outdated models, or unclear recourse in the event of an incident or system failure. This approach supports ongoing risk management and ensures that both parties understand their obligations throughout the model's lifecycle.

  While market research, vendor accreditation, and contract review by information security are important due diligence steps, they do not directly address the need for clarity in ongoing vendor responsibilities, which is critical for effective governance and sustained operation of AI solutions.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "Vendor Management for AI Systems," Subsection: "Third-Party AI Risk and Contractual Obligations"

• Question 3:

  The PRIMARY objective of machine learning (ML) in data processing is to:

  A. Analyze data sets to identify visual patterns and trends.
  B. Enhance the explainability of AI model outputs.
  C. Perform actions that would typically require human intelligence.
  D. Draw statistical inferences for creating artificial human intelligence.
  C. Perform actions that would typically require human intelligence.

  ---

  Explanation

  The AAIATM Study Guide defines the core purpose of machine learning as the ability to enable systems to learn from data and make decisions or perform tasks that typically require human cognitive functions. ML allows AI systems to identify

  patterns, learn from historical data, and automate complex decision-making.

  "Machine learning empowers systems to simulate aspects of human intelligence, including pattern recognition, language understanding, and decision-making. It forms the backbone of many AI applications designed to replace or augment

  human tasks."

  While visual analysis (A) and statistical inference (D) are functions of ML, they are subsets--not primary goals. Explainability (B) is important but is not a core ML function. Thus, C best represents the primary objective.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Fundamentals and Technologies," Subsection: "Machine Learning Basics and Objectives"

• Question 4:

  Which of the following will provide the BEST evidence to support the alignment of an AI model with an organization's business objectives?

  A. AI model vulnerability assessment
  B. AI change management requests
  C. AI model inventory
  D. AI acceptable use policy
  C. AI model inventory

  ---

  Explanation

  An AI model inventory documents the models in use, their purposes, and how they support specific business functions. According to the AAIATM Study Guide, maintaining a comprehensive AI model inventory allows auditors to trace model

  objectives, performance metrics, and use cases back to business goals.

  "A well-maintained AI model inventory supports governance and alignment by offering a centralized view of model functions, business integration, and ownership. It ensures transparency and strategic coherence."

  While policies and assessments are important, only the inventory directly shows which AI models exist and their connection to organizational objectives.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI in Audit Processes," Subsection: "Evidence and Documentation of AI Strategy Alignment"

• Question 5:

  Which of the following is the MOST important consideration when auditing the data used for training an AI model?

  A. Timeliness
  B. Predictability
  C. Representativeness
  D. Understandability
  C. Representativeness

  ---

  Explanation

  Representativeness ensures that the training data reflects the full spectrum of conditions the AI model will encounter in production. According to the AAIATM Study Guide, models trained on non-representative data are prone to bias, poor

  generalization, and underperformance in real-world applications.

  "Ensuring that training data accurately represents the operational environment is critical for model reliability, fairness, and scalability. Without it, the model may perform well in testing but fail in actual usage."

  Timeliness (A) and understandability (D) support performance and usability, but they are secondary to ensuring data coverage. Predictability (B) may not be desirable in dynamic modeling.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Fundamentals and Technologies," Subsection: "Training Data Characteristics and Model Validity"

• Question 6:

  An IS auditor is performing an inventory audit for a manufacturing organization. Which of the following would BEST enable the auditor to identify types of products without assistance from organizational staff?

  A. Natural language processing
  B. Speech modeling
  C. Robotic process automation (RPA)
  D. Computer vision
  D. Computer vision

  ---

  Explanation

  Computer vision uses machine learning techniques to identify and classify visual data such as images or videos. In inventory audits, it can be used to recognize product types, scan barcodes, or evaluate storage conditions without human

  assistance.

  "Computer vision is particularly effective in automated environments like manufacturing, where visual data from cameras or sensors can be processed to verify product identification and placement."

  NLP (A) and speech modeling (B) are not suitable for image-based tasks. RPA (C) automates tasks but cannot visually interpret products. Therefore, D is the correct tool.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI in Audit Processes," Subsection: "AI Tools in Operational and Inventory Audits"

• Question 7:

  A digital bank utilizes an AI system to generate credit scores. Which of the following would BEST mitigate the risk of sudden and unexplained changes in a borrower's credit score?

  A. Ensuring the system is periodically reviewed and calibrated by human experts to maintain stability in predictions
  B. Using only data from the last six months to one year to avoid outdated information affecting the credit score
  C. Allowing the AI to operate fully autonomously to prevent processing delays
  D. Obtaining and validating the credit scores from third-party agencies to cross-check AI-generated results
  A. Ensuring the system is periodically reviewed and calibrated by human experts to maintain stability in predictions

  ---

  Explanation

  Sudden and unexplained changes in AI-generated credit scores may result from data drift, model overfitting, or lack of recalibration. According to the AAIATM Study Guide, regular expert review and calibration help maintain model reliability

  and transparency, particularly in high-stakes decisions like credit scoring.

  "Ongoing human oversight ensures that predictive models remain stable and justifiable. In high-impact environments, such as banking, experts must review and recalibrate AI systems to prevent opaque or unexpected behavior."

  Option B may cause the exclusion of relevant long-term patterns. C promotes risk by removing oversight. D is a validation strategy, not a stability control. Therefore, A is the best option.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Operations and Performance," Subsection: "Model Monitoring and Recalibration Strategies"

• Question 8:

  A generative AI system has a validation control in place to reject inappropriate questions by checking them against built-in ethical standards. Which of the following enables malicious actors to circumvent this control through prompt engineering?

  A. Submitting the same questions in a foreign language translated by another AI-based system
  B. Presenting theoretical situations to justify the reason for asking the questions
  C. Asking the same questions later when the algorithm has changed after further learning
  D. Randomly placing keywords unrelated to the main topic
  B. Presenting theoretical situations to justify the reason for asking the questions

  ---

  Explanation

  Prompt engineering manipulation often involves disguising inappropriate questions in hypothetical or conditional formats, tricking the AI system into bypassing its filters. The AAIATM Study Guide highlights this as a common attack vector in

  generative AI misuse.

  "Adversaries may reframe queries as academic or theoretical scenarios to exploit AI models' reasoning patterns, bypassing ethical constraints. Auditors should test for these circumvention techniques."

  Other methods (A, C, D) may work under specific conditions, but B is the most widely effective and documented prompt-engineering technique.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Fundamentals and Technologies," Subsection: "Prompt Engineering and Generative AI Risks"

• Question 9:

  Which of the following is the MOST important course of action for an organization prior to allowing end users to utilize an AI tool?

  A. Develop an AI policy with guidelines on appropriate use.
  B. Determine the impact to the disaster recovery plan (DRP).
  C. Implement baseline performance metrics.
  D. Ensure a cybersecurity insurance clause is in place to include the use of AI.
  A. Develop an AI policy with guidelines on appropriate use.

  ---

  Explanation

  An AI usage policy sets the foundation for safe, ethical, and effective AI deployment. According to the AAIATM Study Guide, having an AI policy in place ensures that users understand acceptable behaviors, limitations, and responsibilities

  when interacting with AI tools.

  "AI acceptable use policies promote governance by clearly outlining the dos and don'ts of AI interaction, preventing misuse and aligning user activity with organizational values and compliance standards."

  Other actions (B, C, D) are important in operations and risk management but should follow the establishment of governance protocols through a usage policy. Hence, A is the highest-priority prerequisite.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Governance and Risk Management," Subsection: "Policy Frameworks for End-User AI Interaction"

• Question 10:

  Which of the following is the GREATEST risk associated with using AI in audit planning?

  A. Increased planning costs
  B. Scope creep
  C. Incomplete data
  D. Limited knowledge
  C. Incomplete data

  ---

  Explanation

  In the context of AI-driven audit planning, the AAIATM Study Guide identifies incomplete or inaccurate data as the most significant risk. If the data input into AI tools is missing, outdated, or inconsistent, the model's suggestions for risk

  prioritization or control testing will be flawed.

  "Audit planning supported by AI tools is only as strong as the underlying data. Incomplete data may cause incorrect risk assessments or misallocate audit resources, undermining audit effectiveness."

  While scope creep and cost are common concerns in project management, and limited AI knowledge can be mitigated through training, only incomplete data directly impacts the validity of audit planning outputs.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI in Audit Processes," Subsection: "Data Integrity and Planning Risks"