Isaca ISACA-AAIA Online Practice Questions and Exam Preparation

Isaca ISACA-AAIA Online Questions & Answers

• Question 61:

  Which of the following is MOST important to review in order to gain assurance that an AI model is performing without biases?

  A. AI training data
  B. AI development environment
  C. AI model adaptability
  D. AI model temperature
  A. AI training data

  ---

  Explanation

  Bias in AI models is most commonly introduced through the training data. The AAIATM Study Guide highlights that to ensure fairness, auditors and developers must evaluate the diversity, representativeness, and quality of the data used to

  train the model.

  "The greatest source of bias in AI comes from the training data. Reviewing and auditing this data is critical to ensuring that outputs do not disproportionately affect specific groups or skew results."

  While adaptability (C) and model parameters like temperature (D) affect behavior, they do not address the root cause of most biases. The development environment (B) supports infrastructure but not ethical assurance.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "Ethical and Legal Considerations in AI," Subsection: "Bias and Fairness in AI Systems"

• Question 62:

  Which of the following is the BEST way to support the development and design of high-risk AI systems?

  A. Regularly back up the AI system's data to a secure, offsite location.
  B. Conduct regular training sessions for users on data privacy.
  C. Ensure the availability of trustworthy data sets.
  D. Implement multi-factor authentication (MFA) for all users accessing the AI system.
  C. Ensure the availability of trustworthy data sets.

  ---

  Explanation

  The AAIATM Study Guide emphasizes that the foundation of any high-performing and ethical AI system lies in the quality and integrity of its data. For high-risk AI systems, such as those used in healthcare, finance, or criminal justice, it is

  essential to base models on trustworthy data. This ensures reliable predictions, reduces bias, and mitigates risk.

  "Trustworthy datasets are characterized by accuracy, completeness, consistency, and ethical sourcing. In high- risk AI applications, ensuring data quality at every stage is crucial to system reliability and compliance."

  While backups, user training, and MFA are important for security and operational resilience, they do not address the core challenge of ensuring model accuracy and fairness at the development and design phase.

  Therefore, option C is the most effective practice.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Fundamentals and Technologies," Subsection: "Data Governance and Management"

• Question 63:

  Which of the following is an IS auditor MOST likely to use in order to ensure an AI model has the ability to make correct predictions?

  A. Adversarial testing
  B. Group analysis
  C. Latency testing
  D. Confusion matrix
  D. Confusion matrix

  ---

  Explanation

  The confusion matrix is a key performance evaluation tool in machine learning and AI auditing. According to the AAIATM Study Guide, a confusion matrix presents detailed information about actual versus predicted classifications, allowing

  auditors to assess accuracy, precision, recall, and F1 scores.

  "A confusion matrix reveals not just how often predictions are correct, but also the types of errors being made--false positives and false negatives--thereby providing a clear view of the model's predictive reliability."

  Adversarial testing evaluates robustness, group analysis identifies bias across subgroups, and latency testing examines performance speed--not predictive accuracy. Thus, D is the most relevant for ensuring correct predictions.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Operations and Performance," Subsection: "Model Evaluation Metrics"

• Question 64:

  An IS auditor reviewing documentation for an AI model notes that the modeler utilized a K-means clustering algorithm, which clusters data into categories for correlations and analysis. Which of the following is the MOST important risk for the auditor to consider?

  A. K-means clustering is not a common data clustering method due to its complexity and difficulty categorizing data correctly.
  B. K-means clustering requires the modeler to supervise the learning analysis, which can introduce bias.
  C. K-means clustering algorithms are significantly sensitive to outliers and dependent on the similarity of units of measure.
  D. K-means clustering determines the number of clusters for the modeler without supervision.
  C. K-means clustering algorithms are significantly sensitive to outliers and dependent on the similarity of units of measure.

  ---

  Explanation

  K-means clustering is a widely used unsupervised learning algorithm. However, it is sensitive to outliers and assumes that features are on the same scale, which can distort clustering results if not properly normalized. According to the

  AAIATM Study Guide, this sensitivity can impact model reliability and the meaningfulness of clusters.

  "Auditors should assess whether proper data preprocessing (e.g., normalization, outlier removal) was applied in clustering models. K-means assumes Euclidean distances, making it prone to errors when features differ in scale or contain

  outliers."

  Therefore, C correctly identifies the key risk.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Fundamentals and Technologies," Subsection: "Clustering Algorithms and Data Risks"

• Question 65:

  An organization is using information gathered from customer accounts to train its AI chatbot. Which of the following is the GREATEST risk associated with this practice?

  A. Disclosure of personal information
  B. AI bias
  C. Transparency
  D. AI model hallucinations
  A. Disclosure of personal information

  ---

  Explanation

  The use of customer data in AI training presents a significant privacy risk, especially when the data is not properly anonymized or when consent has not been explicitly obtained. The AAIATM Study Guide classifies the unauthorized or

  inadvertent disclosure of personally identifiable information (PII) as the most severe risk in such contexts.

  "Training AI models on customer data without proper safeguards can result in the unintentional exposure of personal or sensitive information, leading to data breaches and compliance violations."

  While bias (B) and hallucinations (D) are important operational concerns, they do not pose the same regulatory and ethical severity as PII exposure. Therefore, A is the most critical risk.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "Ethical and Legal Considerations in AI," Subsection: "Privacy Risks and Data Minimization"

• Question 66:

  During an audit of an investment organization's AI-powered software, an IS auditor identifies a potential security risk. What is the GREATEST risk associated with staff exfiltrating organizational data to a generative AI tool?

  A. Data contamination due to biased AI model outputs
  B. Unauthorized data disclosure
  C. Potential business disruptions
  D. Excessive reliance on AI-generated insights
  B. Unauthorized data disclosure

  ---

  Explanation

  The AAIATM Study Guide stresses that inputting confidential or proprietary data into third-party generative AI tools may result in unauthorized data disclosure. These tools may store, process, or retrain on the input data, leading to privacy and intellectual property risks.

  "When employees input sensitive data into external AI tools, organizations risk losing control over that information. This may result in regulatory non-compliance, legal exposure, and irreversible data leakage."

  While business disruption (C) and reliance (D) are notable, the most severe and immediate risk is B-- unauthorized disclosure. Data contamination (A) impacts model reliability, not data security.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "Ethical and Legal Considerations in AI," Subsection: "Data Privacy and Use of External AI Tools"

• Question 67:

  From a data appropriateness and bias perspective, which of the following should be of GREATEST concern when reviewing an AI model used in a credit scoring system?

  A. The model incorporates the applicant's loan history to assess spending habits.
  B. The model utilizes historical credit data to predict future credit behavior.
  C. The model considers the applicant's income level as a key factor in the credit decision.
  D. The model uses postal codes as a primary factor in determining creditworthiness.
  D. The model uses postal codes as a primary factor in determining creditworthiness.

  ---

  Explanation

  Using postal codes as a primary factor in credit scoring raises concerns of geographic and socioeconomic bias. Postal codes can serve as proxies for race, ethnicity, or income level--potentially violating fair lending laws and ethical guidelines.

  "Auditors should flag models that rely on proxies for protected attributes. Postal codes are high-risk features that may inadvertently lead to redlining or other discriminatory practices."

  A, B, and C are more justifiable under fair lending guidelines. Thus, D presents the highest concern.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Governance and Risk Management," Subsection: "Bias and Fairness in Financial AI Models"

• Question 68:

  An organization's system development process has been enhanced with AI. Which of the following features presents the GREATEST risk?

  A. The AI allocates resources for new system development projects.
  B. Non-technical users are validating AI results.
  C. The AI personalizes applications for the user.
  D. All codes are generated by AI without human oversight.
  D. All codes are generated by AI without human oversight.

  ---

  Explanation

  Allowing AI to autonomously generate code without human review introduces significant risks, including security vulnerabilities, logic errors, and noncompliance with organizational development standards. The AAIATM Study Guide strongly

  advocates for human-in-the-loop oversight, particularly in automated development contexts.

  "AI-assisted development must include manual code reviews to ensure functionality, compliance, and security. Autonomous code generation without validation increases the risk of introducing undetected flaws."

  While A, B, and C involve operational risks or inefficiencies, only D constitutes a direct breach of secure development life cycle principles.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Fundamentals and Technologies," Subsection: "AI in Software Development and Associated Risks"

• Question 69:

  When auditing a research agency's use of generative AI models for analyzing scientific data, which of the following is MOST critical to evaluate in order to prevent hallucinatory results and ensure the accuracy of outputs?

  A. The effectiveness of data anonymization processes that help preserve data quality
  B. The algorithms for generative AI models designed to detect and correct data bias before processing
  C. The frequency of data audits verifying the integrity and accuracy of inputs
  D. The measures in place to ensure the appropriateness and relevance of input data for generative AI models
  D. The measures in place to ensure the appropriateness and relevance of input data for generative AI models

  ---

  Explanation

  Ensuring that input data is appropriate and relevant (option D) is the most critical factor in preventing hallucinations--where generative models produce fabricated or misleading outputs. The AAIATM Study Guide notes, "Generative models are

  highly sensitive to input data; inaccurate, irrelevant, or inappropriate inputs increase the likelihood of nonsensical or incorrect outputs."

  While bias detection, data quality audits, and anonymization are important, ensuring the relevance and suitability of input data is foundational for reliable generative AI performance.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "Input Data Governance for Generative AI"

• Question 70:

  To confirm the fairness of AI model decisions, the BEST way to collect reliable evidence during an AI audit is by:

  A. Analyzing system metadata.
  B. Testing the model with a curated sample data set.
  C. Interviewing developers.
  D. Observing the system's interactions with end users.
  B. Testing the model with a curated sample data set.

  ---

  Explanation

  Testing the AI model with a curated and representative sample data set allows auditors to directly evaluate the fairness and bias of model decisions. This approach is aligned with best practices outlined in the AAIATM Study Guide, as it

  enables quantifiable analysis of model behavior across different demographics or input scenarios.

  "To assess fairness, auditors should use controlled data sets to evaluate whether model outputs disproportionately impact specific groups. This empirical testing provides stronger evidence than qualitative methods."

  While metadata (A) and developer interviews (C) can supplement findings, only B provides objective, reproducible evidence. Option D may reflect real-world interactions but lacks the control and consistency required in an audit.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "Ethical and Legal Considerations in AI," Subsection: "Fairness and Bias Testing in AI Systems"