Isaca ISACA-AAIA Online Practice Questions and Exam Preparation

Isaca ISACA-AAIA Online Questions & Answers

• Question 21:

  For a sales promotion, an AI system sorts customer attributes into several categories by analyzing transaction history. Verifying which of the following would BEST validate the effectiveness of this process?

  A. Stress tests are regularly conducted to maintain consistent AI performance.
  B. The applied methodology adequately reflects business objectives.
  C. Sensitive attributes are converted to other data types prior to input.
  D. Sampling of AI output is conducted to identify unusual decisions.
  B. The applied methodology adequately reflects business objectives.

  ---

  Explanation

  The effectiveness of an AI-driven business process--such as categorizing customers for promotional campaigns--depends on how well it supports defined business objectives. The AAIATM Study Guide recommends validating that AI

  methodology aligns with intended outcomes as part of performance auditing.

  "Effectiveness is best measured by assessing whether the AI logic contributes meaningfully to business goals. Output alignment with organizational KPIs or campaign strategies provides clear evidence of functional success."

  Options A and D support operational resilience and quality assurance. Option C is a privacy technique, not directly tied to effectiveness validation. Thus, B is correct.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI in Audit Processes," Subsection: "Evaluating AI Alignment with Business Objectives"

• Question 22:

  A healthcare organization uses data clustering to group patients by medical history for personalized treatment recommendations. Which of the following is the GREATEST privacy risk associated with this practice?

  A. The clustering requires more data, increasing the risk of a privacy breach.
  B. Clustering increases the complexity of the model, making data harder to anonymize.
  C. Irrelevant features in the data may result in inaccurate or biased treatments.
  D. Clusters can reveal sensitive personal information depending on how the information is presented.
  D. Clusters can reveal sensitive personal information depending on how the information is presented.

  ---

  Explanation

  Clustering, especially in sensitive domains like healthcare, can inadvertently expose confidential patient data if the resulting groups are too specific or reveal underlying health conditions. The AAIATM Study Guide warns that clustering can

  increase privacy risks when small, homogenous groups are formed that effectively re-identify individuals or reveal sensitive traits.

  "Clustering results must be carefully reviewed to prevent indirect re-identification or unintended exposure of sensitive traits. Ethical handling of aggregated patient data is essential to protect individual privacy."

  While A and B involve general concerns, and C focuses on performance, D directly addresses the most significant privacy threat: exposure through cluster outputs.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "Ethical and Legal Considerations in AI," Subsection: "Data Anonymization and Re-identification Risks"

• Question 23:

  Which of the following controls helps mitigate the risk of competitors poisoning data utilized by a machine learning (ML) model performing sentiment analysis of product reviews?

  A. Peer reviewing code that acquires product reviews from social media posts
  B. Hiring a marketing firm to text links to customers requesting product reviews for monetary compensation
  C. Augmenting the unbalanced product review data set with the use of oversampling by the model developer
  D. Requiring customers to authenticate access to their accounts prior to writing product reviews
  D. Requiring customers to authenticate access to their accounts prior to writing product reviews

  ---

  Explanation

  To prevent data poisoning, especially in systems relying on publicly submitted content such as product reviews, access authentication is critical. The AAIATM Study Guide specifies that authenticated input sources help ensure data integrity

  and traceability, reducing the likelihood of adversarial or malicious contributions.

  "Limiting review input to authenticated users restricts unauthorized actors--such as competitors or bots-- from submitting biased or harmful data. This control protects model training and outputs from being manipulated."

  Options A and C address technical data handling but not source authenticity. Option B may inadvertently incentivize biased reviews. Option D provides a robust control against poisoning.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Fundamentals and Technologies," Subsection: "Input Data Security and Adversarial Risk Mitigation"

• Question 24:

  Which of the following is the MOST important reason to perform regular ethical reviews of AI systems?

  A. To improve the accuracy and performance of the systems
  B. To align AI system development with organizational values and principles
  C. To ensure the systems align with the preservation of individual rights
  D. To identify and mitigate potential data drift within models
  C. To ensure the systems align with the preservation of individual rights

  ---

  Explanation

  The AAIATM Study Guide reinforces that regular ethical reviews are essential to uphold human rights, prevent discriminatory outcomes, and ensure systems function within the boundaries of fairness and legality. While aligning with values (B)

  and preventing drift (D) are secondary benefits, the primary ethical imperative is the protection of individuals' rights and freedoms.

  "Ethical reviews ensure AI systems do not violate rights related to privacy, fairness, access, and due process. This is foundational in building public trust and avoiding legal liabilities."

  Option C is the clearest expression of this responsibility. Performance and alignment with values are important but secondary to ensuring human-centric safeguards.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "Ethical and Legal Considerations in AI," Subsection: "Ongoing Ethical Oversight"

• Question 25:

  Which of the following controls MOST effectively helps to ensure an AI model is resilient against external threats?

  A. AI data set anonymization
  B. Monitoring of AI model developers
  C. Monitoring of AI access logs
  D. AI model configuration testing
  D. AI model configuration testing

  ---

  Explanation

  Ensuring AI model resilience against external threats involves validating that the model is configured to resist attacks, such as adversarial inputs, data poisoning, or misuse. The AAIATM Study Guide emphasizes configuration testing as a

  crucial control to simulate threat scenarios and assess robustness.

  "Model configuration testing simulates real-world threat conditions to validate model resilience. This includes testing against adversarial attacks, input manipulation, and exposure of sensitive outputs."

  While access monitoring (C) and anonymization (A) reduce risks, they don't actively validate model behavior under threat conditions. Therefore, D offers the most effective resilience measure.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Governance and Risk Management," Subsection: "Security and Resilience Testing for AI Models"

• Question 26:

  An AI social media platform uses an algorithm to increase user engagement that could unintentionally promote divisive content. Which of the following is the BEST course of action to mitigate this risk?

  A. Introduce controls allowing individuals to customize content preferences.
  B. Suspend the algorithm until concerns are addressed.
  C. Obtain users' consent for the content they wish to view.
  D. Regularly audit and adjust algorithms to reduce biases.
  D. Regularly audit and adjust algorithms to reduce biases.

  ---

  Explanation

  The AAIATM Study Guide emphasizes that regular algorithmic audits are critical for identifying unintended consequences such as the promotion of harmful or biased content. This proactive approach helps maintain trust and ensure that

  algorithmic decisions align with organizational values and ethical standards.

  "Auditing and monitoring AI models regularly helps detect and correct bias, drift, or other unintended behavior. It is essential for high-impact AI systems like content recommendation engines."

  While content customization (A) and user consent (C) are helpful, they don't prevent bias propagation. Suspension (B) may halt engagement and isn't sustainable. Therefore, D is the most balanced and strategic solution.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Governance and Risk Management," Subsection: "Model Monitoring and Risk Mitigation Strategies"

• Question 27:

  The PRIMARY objective of auditing AI systems is to:

  A. Identify biases and decision transparency.
  B. Maximize system efficiency and throughput.
  C. Optimize user experience and interface satisfaction.
  D. Minimize algorithm latency and information storage impacts.
  A. Identify biases and decision transparency.

  ---

  Explanation

  The AAIATM Study Guide outlines the primary goal of auditing AI systems as ensuring that they operate ethically, transparently, and fairly. This includes identifying potential biases in decision-making and confirming that the rationale behind

  outcomes can be explained and understood.

  "The key focus of an AI audit is to evaluate whether the system performs within the parameters of fairness, legality, and accountability. This involves testing for bias and ensuring decision-making transparency."

  Options B, C, and D refer to performance and usability concerns, which are secondary to the ethical and governance-focused purpose of AI audits.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI in Audit Processes," Subsection: "Purpose and Scope of AI Audits"

• Question 28:

  Which of the following controls would MOST effectively mitigate worst-case service disruption scenarios affecting an AI-based application system?

  A. Performing periodic tabletop exercises
  B. Implementing a kill chain process in the event of disruption
  C. Updating key risk indicators (KRIs) regularly
  D. Including a range of AI disruption scenarios in the disaster recovery plan (DRP)
  D. Including a range of AI disruption scenarios in the disaster recovery plan (DRP)

  ---

  Explanation

  Including AI-specific disruption scenarios in the organization's Disaster Recovery Plan (DRP) ensures preparedness for worst-case events affecting AI systems. The AAIATM Study Guide recommends tailoring business continuity and DR strategies to cover model unavailability, data corruption, and AI-specific dependencies.

  "AI disruptions can arise from unique causes such as model corruption, adversarial attacks, or drift. Integrating these into the DRP allows for effective, scenario-specific responses and minimizes downtime."

  Tabletop exercises (A) are valuable for preparedness but are less comprehensive than scenario planning. Kill chains (B) are security-specific. KRIs (C) aid in monitoring but don't ensure recovery. Therefore, D offers the most robust

  mitigation.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Governance and Risk Management," Subsection: "Business Continuity and Disaster Recovery Planning for AI"

• Question 29:

  The PRIMARY purpose of utilizing neural networks in AI is to:

  A. Improve the user interface.
  B. Increase computational power.
  C. Mimic human decision making.
  D. Minimize maintenance costs.
  C. Mimic human decision making.

  ---

  Explanation

  Neural networks are designed to mimic the way the human brain processes information, enabling AI systems to identify complex patterns and make decisions based on data inputs. The AAIATM Study Guide defines neural networks as

  central to deep learning architectures that emulate cognitive functions.

  "Neural networks simulate the interconnectivity and learning processes of the human brain. This capability enables AI systems to handle unstructured data and perform tasks such as image recognition, natural language processing, and

  predictive analytics."

  Options A, B, and D reflect ancillary benefits but not the core design purpose of neural networks. Thus, C is the most accurate.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Fundamentals and Technologies," Subsection: "Neural Networks and Deep Learning"

• Question 30:

  During a pre-implementation risk assessment, an AI model is determined to present a significant risk of bias and potential harm in excess of the organization's risk tolerance. Which of the following is the MOST appropriate response?

  A. Postpone deployment until the risk can be safely managed.
  B. Enhance the data that the model is trained on.
  C. Obtain board approval for an exception.
  D. Revisit the risk tolerance to ensure it is appropriate.
  A. Postpone deployment until the risk can be safely managed.

  ---

  Explanation

  The AAIATM Study Guide advises that if an AI model presents a risk that exceeds the organization's predefined risk tolerance--especially in cases of ethical harm or bias--deployment should be delayed until proper safeguards are in place.

  This approach prevents legal exposure and preserves stakeholder trust.

  "When AI risks exceed acceptable thresholds, organizations must suspend implementation until corrective action reduces the risk to within tolerance levels. Proceeding without mitigation violates sound governance principles."

  While improving data (B) may help, it does not address the immediate governance concern. Risk tolerance (D) should not be adjusted to fit flawed systems. Thus, A is the correct course.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Governance and Risk Management," Subsection: "Risk Evaluation and Implementation Decision-Making"