Isaca ISACA-AAIA Online Practice Questions and Exam Preparation

Isaca ISACA-AAIA Online Questions & Answers

• Question 51:

  A retail organization uses an AI model to forecast inventory based on customer purchasing trends and updates the model quarterly. The model recently failed to recognize a surge in demand during a popular shopping season. Which of the following issues does this situation BEST demonstrate?

  A. Limited data set diversity impacting model training
  B. Data drift impacting system forecasting
  C. Overfitting issues due to a small training data set
  D. Lack of outlier checks in data affecting forecast accuracy
  B. Data drift impacting system forecasting

  ---

  Explanation

  Data drift occurs when the statistical properties of input data change over time, impacting the accuracy of an AI model. In this case, the model failed to adapt to recent demand trends, indicating that the data on which it was trained no longer reflects current behavior.

  "Data drift leads to performance degradation in AI systems when real-world input data shifts away from training data patterns. Monitoring for drift is essential, particularly in dynamic environments such as retail."

  Although training diversity (A) and outlier detection (D) are relevant to accuracy, only B addresses the temporal misalignment between training data and real-time data. Overfitting (C) would more likely cause poor generalization in other contexts.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Operations and Performance," Subsection: "Model Monitoring and Data Drift Detection"

• Question 52:

  Which of the following strategies used by modelers to enhance data accuracy has the GREATEST risk of bias and information loss?

  A. Filling blank attributes in records with the mean, median, or mode within a grouping
  B. Identifying and deleting duplicate entries in the data set
  C. Separating multiple data attributes within one field into individual attribute columns
  D. Placing numerical data into bins or buckets for a manageable quantity of correlations and result analyses
  A. Filling blank attributes in records with the mean, median, or mode within a grouping

  ---

  Explanation

  Imputing missing values using the mean, median, or mode is a common technique to fill blanks in datasets. However, according to the AAIATM Study Guide, this method introduces a significant risk of information distortion, especially if the

  data is not normally distributed or if imputed values disproportionately impact underrepresented groups.

  "Simple imputation can reduce data variability and reinforce existing biases. It may also misrepresent the true distribution of the data, leading to skewed model outputs."

  Other options (B, C, D) may involve transformations, but they do not inherently cause as much bias or data misrepresentation as A.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Fundamentals and Technologies," Subsection: "Data Imputation and Transformation Risks"

• Question 53:

  An IS auditor notes that an AI model achieved significantly better results on training data than on test data. Which of the following problems with the model has the IS auditor identified?

  A. Underfitting
  B. Overfitting
  C. Generalization
  D. Bias
  B. Overfitting

  ---

  Explanation

  Overfitting occurs when a model performs very well on training data but poorly on unseen data, indicating that the model has learned patterns specific to the training set rather than generalizing effectively. The AAIATM Study Guide identifies

  overfitting as a common problem that impacts model reliability.

  "Overfitting limits the model's applicability to real-world scenarios. It reflects excessive tailoring to the training data and poor performance on new, diverse inputs."

  Underfitting (A) would result in poor performance on both training and test data. Generalization (C) is the desired state, and bias (D) is a separate issue. Therefore, B is correct.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Operations and Performance," Subsection: "Overfitting, Underfitting, and Generalization"

• Question 54:

  An organization shares an AI model with external partners. One partner reports that sensitive data has been inadvertently exposed through the model's outputs. Which of the following is the IS auditor's BEST recommendation?

  A. Limit the model's outputs to anonymized results while investigating further.
  B. Audit the data pipelines of all partners to identify the source of the leak.
  C. Disable the shared model and notify partners of the potential breach.
  D. Retrain the model immediately and implement privacy-preserving techniques.
  C. Disable the shared model and notify partners of the potential breach.

  ---

  Explanation

  In the case of a potential data exposure through AI model outputs, the first and most responsible action from an auditing and risk standpoint is to halt further risk propagation. According to the AAIATM Study Guide, immediate containment is

  vital, especially when regulatory and reputational risks are high.

  "Upon detection of a data breach risk, AI models should be immediately disabled from public or partner use, and all relevant parties should be notified as part of a responsible disclosure and containment strategy."

  While options A and D are longer-term remediation steps and B is investigative, none of them provide the urgent containment that is best practice in such a breach context.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "Ethical and Legal Considerations in AI," Subsection: "AI Data Breach and Disclosure Management"

• Question 55:

  An IS auditor is looking to expedite reporting for an audit with complex issues. Which of the following would be the MOST effective way for the auditor to use generative AI?

  A. Developing action items discussed in closing meetings for management action plans
  B. Developing a draft of an executive summary based on detailed findings and audit scope
  C. Revising audit conclusions with precise verbiage to describe the audit observations
  D. Revising audit background and scope information based on new information from management
  B. Developing a draft of an executive summary based on detailed findings and audit scope

  ---

  Explanation

  The AAIATM Study Guide highlights that generative AI tools can significantly enhance audit productivity, especially in content generation tasks. Drafting executive summaries--condensing complex findings into clear, concise formats--is a

  high-impact use case that benefits from generative AI's natural language generation capabilities.

  "Generative AI can be leveraged by auditors to automate reporting sections, such as executive summaries, ensuring consistency and saving time without compromising content clarity."

  While A, C, and D are valid uses, B delivers the most value by expediting a time-intensive and high-level reporting task in complex audits.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI in Audit Processes," Subsection: "Generative AI Applications in Audit Reporting"

• Question 56:

  Which of the following is the MOST important task when gathering data during the AI system development process?

  A. Stratifying the data
  B. Isolating the system
  C. Cleaning the data
  D. Training the system
  C. Cleaning the data

  ---

  Explanation

  Data cleaning is a foundational task in the AI development lifecycle. The AAIATM Study Guide identifies data quality--ensuring completeness, accuracy, consistency, and correctness--as critical to building effective and unbiased AI systems.

  Cleaning the data involves removing duplicates, correcting errors, addressing missing values, and standardizing formats.

  "Data cleaning is a prerequisite for effective training and evaluation. Poor-quality data leads to inaccurate or misleading model outputs, increasing operational and ethical risks."

  While training (D) is essential, it must occur only after the data has been adequately prepared. Stratification (A) supports certain modeling approaches but is secondary to data integrity. Therefore, C is the most important task at the data-

  gathering stage.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Fundamentals and Technologies," Subsection: "Data Collection and Preparation"

• Question 57:

  Which use case for an AI model to be used by a food delivery service would pose ethical risk to the organization?

  A. Correlating time, cost, delivery distance, and customer satisfaction metrics to issue coupons to customers receiving substandard service
  B. Basing driver retention and termination decisions on the number of delivered orders per total hours worked as compared to an industry benchmark
  C. Comparing total food preparation and delivery time to an industry benchmark to set key performance and risk indicators for individual restaurants
  D. Using customer service metrics for service speed and food quality to predict customer retention and forecast revenue
  B. Basing driver retention and termination decisions on the number of delivered orders per total hours worked as compared to an industry benchmark

  ---

  Explanation

  Using AI to make employment decisions such as driver termination or retention introduces significant ethical risks. If based solely on performance metrics without context or human review, such systems can lead to unfair treatment or

  discrimination--violating principles of transparency and due process.

  "Automating workforce decisions must be approached cautiously to prevent discriminatory outcomes. Ethical AI governance requires oversight when AI is used for employment-impacting decisions."

  A, C, and D involve business optimization without directly affecting individual employment rights. Therefore, B poses the greatest ethical risk.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "Ethical and Legal Considerations in AI," Subsection: "Human Impact and Workforce Automation Ethics"

• Question 58:

  An organization deploys an AI recruitment platform to screen job applicants. The IS auditor identifies that the platform's decisions may be influenced by model bias. Which of the following risk mitigation strategies is BEST for the auditor to recommend?

  A. Implement a process to periodically test the AI system for biases and adjust parameters as needed.
  B. Suspend the use of the AI system until the training data can be verified for fairness and compliance.
  C. Retrain the AI model using an external data set certified for inclusivity and fairness.
  D. Require manual reviews of all AI-generated recruitment decisions before hiring is finalized.
  A. Implement a process to periodically test the AI system for biases and adjust parameters as needed.

  ---

  Explanation

  Periodic testing and monitoring for bias is a sustainable, proactive strategy aligned with best practices outlined in the AAIATM Study Guide. This approach ensures that the AI system remains compliant over time, even as data and hiring

  conditions change.

  "Ongoing fairness assessments help detect emerging biases and ensure that the AI model maintains equitable decision-making standards. Periodic testing also allows organizations to take corrective action before regulatory or reputational

  damage occurs."

  Suspending the system (B) or relying solely on external datasets (C) are temporary or limited in scope. Manual reviews (D) are effective but do not solve the root issue. Therefore, A provides a comprehensive, audit-aligned solution.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "Ethical and Legal Considerations in AI," Subsection: "Bias Mitigation and Monitoring"

• Question 59:

  Which of the following metrics are the BEST indication of a mature and effective approach to an organization's data governance program for its AI systems?

  A. Number of AI projects completed within the last fiscal year
  B. Percentage of AI models with documented data lineage
  C. Frequency of data quality audits on the organization's data sets
  D. Total budget allocated to AI initiatives across all departments
  B. Percentage of AI models with documented data lineage

  ---

  Explanation

  Documented data lineage (option B) is a cornerstone of mature data governance. The ISACA AAIATM Study Guide highlights that "effective data governance for AI is characterized by the organization's ability to trace and document the origin,

  transformation, and use of data throughout its lifecycle and within AI models." This documentation provides transparency, supports accountability, and enables effective risk management.

  While regular data quality audits (option C) are important, they do not, by themselves, ensure transparency or traceability. The number of projects (option A) and budget allocation (option D) are not directly indicative of governance maturity.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "Data Governance in AI: Data Lineage and Traceability"

• Question 60:

  An organization is adopting AI for its procurement and inventory teams, raising concern from stakeholders that they will lose their jobs due to AI. Which of the following is the BEST way for the IS auditor to assess whether the potential negative impacts were minimized?

  A. Review human-centered design practices to determine how they were considered.
  B. Review the AI roadmap for short-term and long-term milestones.
  C. Review how the project management team collected feedback in engagement activities.
  D. Review the current state assessment of how AI may impact the organization.
  A. Review human-centered design practices to determine how they were considered.

  ---

  Explanation

  Human-centered design (HCD) focuses on integrating stakeholder needs, ethical implications, and social impact into AI system development. The AAIATM Study Guide emphasizes the role of HCD in minimizing negative workforce impacts

  and ensuring inclusive design.

  "Auditors should review whether the AI system design process included human-centered practices-- particularly for applications affecting jobs or critical human roles. HCD ensures responsible adoption."

  While feedback collection (C) and impact assessments (D) provide useful context, A directly addresses ethical impact mitigation at the design level.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "Ethical and Legal Considerations in AI," Subsection: "Human-Centered AI and Workforce Impacts"