Isaca ISACA-AAIA Online Practice Questions and Exam Preparation

Isaca ISACA-AAIA Online Questions & Answers

• Question 41:

  Which of the following BEST ensures that an AI system complies with user data ownership rights under privacy regulations?

  A. Applying data clustering techniques to anonymize data sets
  B. Enforcing strict data retention policies to limit storage duration
  C. Implementing a transparent data consent management process
  D. Regularly conducting AI system performance testing for accuracy
  C. Implementing a transparent data consent management process

  ---

  Explanation

  A transparent data consent management process ensures users are informed about how their data will be used, and enables them to exercise their rights to consent, access, rectify, or delete their data. This is a core requirement under

  regulations such as GDPR and CCPA.

  "Consent management is fundamental to respecting data ownership rights. Organizations must clearly disclose data usage purposes, provide opt-in/out capabilities, and maintain audit trails of user interactions."

  While anonymization and retention policies support compliance, they don't address user control. Performance testing (D) relates to model accuracy, not user rights. Thus, C is the best answer.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "Ethical and Legal Considerations in AI," Subsection: "User Data Rights and Consent Management"

• Question 42:

  An organization uses an AI image generation platform to create promotional materials. An IS auditor identifies that the platform includes copyrighted images in its training data. Which of the following is the auditor's BEST recommendation to address this issue?

  A. Implement a manual review process to ensure no copyrighted images are used in generated outputs.
  B. Use a platform that certifies the provenance and licensing of its training data.
  C. Label all AI-generated images to disclaim the possibility of third-party content.
  D. Suspend the use of the platform until the training data is sanitized.
  B. Use a platform that certifies the provenance and licensing of its training data.

  ---

  Explanation

  Ensuring that AI tools are trained on properly licensed and documented data sets is critical to avoiding copyright infringement and legal exposure. The AAIATM Study Guide emphasizes using platforms with certified and traceable training data to meet ethical and legal standards.

  "Organizations must verify the provenance and licensing of data used to train AI systems. Platforms that certify data sources reduce the risk of using protected intellectual property without consent."

  Manual review (A) is resource-intensive and may not detect embedded copyright violations. Labeling (C) is not sufficient for legal protection. Suspension (D) may be excessive without first attempting remediation. Thus, B is the most strategic

  and effective recommendation.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "Ethical and Legal Considerations in AI," Subsection: "Intellectual Property and Data Licensing in AI Systems"

• Question 43:

  Which of the following is the GREATEST challenge facing IS auditors evaluating the explainability of generative AI models?

  A. Differences of opinion regarding model types
  B. Difficulties in preventing the input of biased data
  C. Performance issues due to excessive computation
  D. Algorithms changing as AI continues to learn
  D. Algorithms changing as AI continues to learn

  ---

  Explanation

  The greatest challenge for IS auditors in evaluating the explainability of generative AI models is the changing nature of algorithms as AI continues to learn (option D). Generative AI models, especially those using advanced techniques like deep learning and reinforcement learning, often employ continuous or dynamic learning, which results in models that evolve over time. This adaptability can significantly hinder explainability because the logic, parameters, or decision pathways may shift with ongoing retraining or real- time learning.

  The ISACA Advanced in AI AuditTM (AAIATM) Study Guide stresses that: "Continually learning AI systems present unique audit challenges, as their internal representations and reasoning can change after deployment, making it difficult to fully capture and explain the rationale for outputs at any given point."

  Other options, such as bias in input data or computational performance, are significant but do not pose as fundamental a challenge to explainability as a model whose internal workings can dynamically change.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Explainability and Dynamic Models"

• Question 44:

  Which of the following is the MOST important purpose of conducting a risk assessment for AI models within an organization?

  A. Categorizing data used by the AI model
  B. Defining mitigation strategies for AI deployment
  C. Monitoring AI model performance on an ongoing basis
  D. Determining whether AI model outputs align with established use cases
  B. Defining mitigation strategies for AI deployment

  ---

  Explanation

  Risk assessments identify potential threats and vulnerabilities in AI systems and support the development of mitigation strategies. According to the AAIATM Study Guide, the main objective is not just identification of risks but to proactively

  design controls that minimize impact and ensure ethical and regulatory compliance.

  "The output of an AI risk assessment should lead to actionable mitigation strategies, supporting the secure and responsible deployment of AI solutions across business processes."

  Options A, C, and D are components of governance and monitoring, but B addresses the core intent of risk assessments.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Governance and Risk Management," Subsection: "Risk Assessment and Mitigation for AI Systems"

• Question 45:

  In order to streamline operations, a bank has deployed an AI application to automatically detect and prevent further fraud on accounts. However, customers have voiced concerns that their usual transactions are being rejected. Which of the following is the MOST likely cause of the false positives?

  A. Consent is not properly managed.
  B. Data versioning controls were not developed.
  C. Compute scale training was not performed.
  D. The hyperparameters are not optimized.
  D. The hyperparameters are not optimized.

  ---

  Explanation

  False positives in fraud detection AI systems often stem from poorly optimized hyperparameters. Hyperparameters control aspects of the model's learning process such as the learning rate, decision thresholds, and complexity penalties.

  When these parameters are not tuned correctly, the model can become overly sensitive and flag normal behavior as suspicious, leading to customer complaints.

  "Hyperparameter tuning is essential to balance sensitivity and specificity in AI models. Improper tuning can result in a high rate of false positives or negatives, particularly in systems like fraud detection that require nuanced pattern

  recognition."

  Options A and B relate to data governance but do not directly cause false positives in predictions. Option C (compute scale training) may affect model efficiency, not accuracy. Thus, D is the most appropriate answer.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Operations and Performance," Subsection: "Model Tuning and Optimization"

• Question 46:

  Which of the following correctly summarizes the conclusions of the model card excerpt provided?

  Model Card Electrical Grid Predictive Maintenance Model

  Model Information:

  1. Description: AI model designed to predict maintenance needs for electrical grid components, reduce unplanned downtime, and improve grid reliability.

  2. Inputs: Real-time sensor data, historical maintenance records, and operational logs.

  3. Outputs: Maintenance needs predictions for 60 and 90 days.Evaluation:

  4. Approach: Cross-validation and validation of accuracy, precision, and recall.

  5. Results: Accuracy 72%; Precision 60%; Recall 95%; F1 76%

  A. The AI model correctly predicts maintenance needs 95% of the time.
  B. The electrical grid uptime is expected to be 72% of the time.
  C. Grid failure is predicted to occur after 90 days.
  D. F1 indicates that the model identifies true maintenance needs 76% of the time.
  D. F1 indicates that the model identifies true maintenance needs 76% of the time.

  ---

  Explanation

  The F1 score is the harmonic mean of precision and recall, offering a balanced measure of model accuracy, especially when there is an imbalance in the classes (e.g., more "no-maintenance" than "needs-maintenance" outcomes). According to the AAIATM Study Guide, the F1 score is used to evaluate how well the model identifies true positives while balancing the risk of false positives and false negatives.

  "An F1 score summarizes the model's ability to correctly identify relevant events--in this case, true maintenance needs. A 76% F1 score means the model is relatively balanced and effective at catching maintenance requirements without generating too many false alerts."

  Thus, D is correct. Option A misrepresents recall as predictive accuracy. Option B misinterprets accuracy. Option C has no direct basis in the excerpt.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Operations and Performance," Subsection: "Understanding Evaluation Metrics and Model Cards"

• Question 47:

  Which of the following testing techniques would BEST validate whether an organization's data governance program effectively ensures data quality and integrity for AI model training and deployment?

  A. Performing a business impact analysis (BIA) to assess the consequences of AI model failure
  B. Reviewing the organization's AI software development life cycle documentation
  C. Conducting a penetration test to identify vulnerabilities in the model
  D. Assessing data lineage to verify the traceability of data sources
  D. Assessing data lineage to verify the traceability of data sources

  ---

  Explanation

  Assessing data lineage provides insight into the origin, flow, and transformation of data across its lifecycle, which is crucial for validating data governance. The AAIATM Study Guide states that data lineage is essential to ensure the accuracy, consistency, and trustworthiness of data used in training AI models.

  "Traceability of data sources is a core tenet of effective data governance. Data lineage validation ensures data quality, prevents unauthorized modifications, and maintains auditability."

  BIA (A) focuses on impact, not data quality. Reviewing SDLC (B) is broad and may not highlight data- specific risks. Penetration testing (C) addresses security, not governance. Therefore, D is the best method.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Governance and Risk Management," Subsection: "Data Quality, Integrity, and Governance Practices"

• Question 48:

  Which of the following is the PRIMARY purpose of an AI acceptable use policy?

  A. Establishing guidance on the ethical use of AI
  B. Outlining AI usage monitoring procedures
  C. Educating employees on where to find and how to use AI tools
  D. Explaining the distinction between different types of AI
  A. Establishing guidance on the ethical use of AI

  ---

  Explanation

  An AI acceptable use policy (AUP) defines how AI tools and technologies should be ethically and responsibly used within an organization. According to the AAIATM Study Guide, the primary goal of an AUP is to prevent misuse and promote

  adherence to ethical, legal, and operational standards.

  "An AI acceptable use policy provides governance over how AI tools may be used, especially regarding data handling, fairness, and prohibited uses. It aligns employee actions with organizational values and compliance requirements."

  Monitoring procedures (B), training (C), and taxonomy explanations (D) may be included in broader AI documentation, but the AUP's core purpose is ethical usage governance.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Governance and Risk Management," Subsection: "Policies, Standards, and Ethical Frameworks for AI"

• Question 49:

  Which of the following is MOST important to consider when auditing an organization's AI procedures?

  A. Frequency of AI system updates to enhance security
  B. Employee training on recognized AI best practices
  C. Backup and recovery in the event of an AI data breach
  D. AI data validation and filtration to prevent data poisoning
  D. AI data validation and filtration to prevent data poisoning

  ---

  Explanation

  The integrity of data fed into AI systems is a critical concern. The AAIATM Study Guide emphasizes that validation and filtration processes are essential to mitigate the risk of data poisoning--an attack that can manipulate model behavior by

  injecting malicious inputs.

  "Data poisoning represents a major vulnerability in AI pipelines. Effective controls include robust validation, filtration, and monitoring of training data sources. These preventive practices are essential to ensure model reliability and security."

  While options A, B, and C are important operational and training measures, only D addresses a technical risk that can directly compromise model outputs and trustworthiness.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Governance and Risk Management," Subsection: "AI Data Integrity and Attack Prevention"

• Question 50:

  While evaluating a complex machine learning (ML) model used for regulatory compliance in a financial institution, which of the following should the IS auditor do to BEST ensure transparency?

  A. Document sources and data processes.
  B. Create dashboards to show outputs.
  C. Provide periodic model audit reports.
  D. Use tools that explain model decisions.
  D. Use tools that explain model decisions.

  ---

  Explanation

  Transparency in AI, especially in regulated sectors like finance, is best achieved by using explainability tools that interpret the internal workings and outputs of complex ML models. The AAIATM Study Guide highlights model explainability as

  essential for both auditors and regulators to understand why certain decisions are made.

  "Explainability tools allow auditors to trace predictions back to input features, helping verify fairness, logic, and compliance. These tools support transparency and trustworthiness in black-box models."

  While documentation (A) and reporting (C) are part of governance, D directly supports decision-level clarity.

  Dashboards (B) show results, not rationale.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI in Audit Processes," Subsection: "Model Explainability and Regulatory Assurance"