Isaca ISACA-AAIA Online Practice Questions and Exam Preparation

Isaca ISACA-AAIA Online Questions & Answers

• Question 71:

  Which of the following is MOST important to have in place when initially populating data into a data frame for an AI model?

  A. The box charts, histograms, scatterplots, and Venn diagrams that identify correlations and outliers
  B. The code for separating data into training and testing data sets
  C. An analysis of exploratory data that checks for incorrect data types, null values, and duplicate entries
  D. An approved risk assessment for including, excluding, or subsequently dropping data attributes from the model
  C. An analysis of exploratory data that checks for incorrect data types, null values, and duplicate entries

  ---

  Explanation

  Exploratory Data Analysis (EDA) is critical during the initial stages of AI model development. According to the AAIATM Study Guide, performing EDA--including identifying null values, incorrect data types, or duplicates--ensures that the data

  fed into the model is clean and reliable.

  "Initial data frames should be subject to thorough EDA to uncover data quality issues. These issues, if not addressed early, can severely affect model training and predictive accuracy."

  While separating data sets (B) and visualizations (A) are important steps in later phases, C is foundational to ensure readiness for model training. Risk assessments (D) are necessary but not the first operational step.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Fundamentals and Technologies," Subsection: "Exploratory Data Analysis and Preprocessing"

• Question 72:

  Which of the following is MOST important for an IS auditor to consider when identifying AI risk in a know your customer (KYC) application within a banking organization?

  A. Intellectual property leakage and invalidation
  B. Benchmarking against peer organizations
  C. Incident response plan
  D. Business disruption and financial impact
  D. Business disruption and financial impact

  ---

  Explanation

  In high-stakes financial applications like KYC, the primary concern is the potential business and regulatory impact of an AI error--such as false customer rejection or failure to detect fraudulent accounts. The AAIATM Study Guide emphasizes aligning AI risk assessments with business impact and regulatory exposure.

  "In financial institutions, the most material risk of AI errors lies in operational disruption and regulatory fines. KYC models must be assessed for how errors can lead to compliance failures or reputational harm."

  Benchmarking (B) supports best practice alignment, and incident response (C) is part of mitigation, but D addresses the most critical consequence of AI risks in banking.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Governance and Risk Management," Subsection: "Risk Impact and Business Alignment in AI Systems"

• Question 73:

  An organization is evaluating change management practices for AI-based decision support models. Which of the following BEST demonstrates effective AI-focused change management?

  A. Engaging an independent expert to review the model's accuracy and precision on a quarterly basis
  B. Assigning a single data science team member to adjust the model in order to establish accountability
  C. Documenting model updates and retraining sessions to ensure traceability
  D. Deploying two separate copies of the model after each adjustment to compare results
  C. Documenting model updates and retraining sessions to ensure traceability

  ---

  Explanation

  Documenting model updates and retraining sessions to ensure traceability (option C) is the hallmark of mature, audit-ready change management in AI. The AAIATM Study Guide states, "Traceability and documentation of all changes-including retraining events, parameter adjustments, and update rationales-- enable effective audit trails, accountability, and regulatory compliance for AI systems."

  While reviews and comparisons are useful, only comprehensive documentation guarantees ongoing transparency and effective management.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "Change Management and Traceability in AI"

• Question 74:

  In the context of an AI implementation, which of the following actions is MOST critical for an organization's change management program?

  A. Ensuring the organization has a dedicated AI governance committee
  B. Reviewing documentation for AI system changes, updates, and patches
  C. Conducting a comprehensive risk assessment specific to AI-related changes
  D. Verifying that all employees have completed mandatory AI ethics training
  C. Conducting a comprehensive risk assessment specific to AI-related changes

  ---

  Explanation

  The AAIATM Study Guide emphasizes that AI implementations introduce dynamic and non-deterministic elements into systems, increasing the risk associated with changes. A comprehensive, AI-specific risk assessment is therefore the most critical component of a change management program to ensure that updates, retraining, or parameter adjustments do not introduce vulnerabilities or unintended consequences.

  "Risk assessments tailored to AI are crucial because changes to models, training data, or infrastructure can affect performance, ethical compliance, or expose the system to new threats. A standard IT change review is often insufficient." While having a governance committee (A) and reviewing documentation (B) are important supporting practices, only option C directly mitigates the core risks of AI system change. Ethics training (D) supports awareness but is not directly tied to change control.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Governance and Risk Management," Subsection: "Change Management and AI Risk Control"

• Question 75:

  A healthcare organization uses an AI model to analyze patient data and provide diagnostic recommendations. Which of the following MOST effectively detects data drift related to the model's predictions?

  A. Comparing incoming patient data distributions with the training data set
  B. Applying overrides to allow healthcare professionals to correct the AI model's recommendations
  C. Conducting periodic model retraining to ensure alignment with updated patient data
  D. Using adversarial testing to simulate scenarios that stress test the model's predictions
  A. Comparing incoming patient data distributions with the training data set

  ---

  Explanation

  Detecting data drift is critical in maintaining the reliability and accuracy of AI models, especially in dynamic environments like healthcare where patient populations and data characteristics can change over time. According to the ISACA Advanced in AI AuditTM (AAIATM) Study Guide,data drift refers to changes in the input data's statistical properties compared to the data on which the model was originally trained . If not detected, data drift can degrade model performance and lead to erroneous predictions.

  The most effective approach to detect data drift is to continuously compare the statistical distributions of incoming (production) data with those of the training dataset . This allows organizations to identify deviations in data patterns, which can be early indicators that the AI model's predictions may no longer be valid or optimal.

  As stated in the AAIATM Study Guide under "AI Model Monitoring and Maintenance":

  "Monitoring input data for distributional changes compared to the model's training data is an essential step in identifying data drift. Statistical tests and visualizations can help auditors and AI operators detect when the underlying data characteristics have shifted, prompting further investigation or retraining needs."

  While options such as retraining the model (option C) or adversarial testing (option D) are valuable for ongoing performance and robustness, they do not inherently detect data drift --they respond to or stress-test existing issues. Applying overrides (option B) is a human-in-the-loop safeguard, not a method for drift detection.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Model Monitoring and Maintenance," Subsection: "Detection and Management of Data Drift"

• Question 76:

  Which of the following is MOST important to consider when deciding whether to implement an AI solution?

  A. The cost of AI implementation
  B. The speed of AI implementation
  C. The space required for AI hardware
  D. The ethical implications of AI
  D. The ethical implications of AI

  ---

  Explanation

  While cost, speed, and infrastructure are practical considerations, the AAIATM Study Guide stresses that ethical implications must be the top priority. Implementing AI without evaluating potential harm, bias, discrimination, or privacy concerns

  can result in legal, social, and reputational damage.

  "Ethical implications should be central to AI implementation decisions. Responsible AI practices involve evaluating societal impact, transparency, accountability, and fairness before deployment."

  Therefore, D is the most essential consideration.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "Ethical and Legal Considerations in AI," Subsection: "Ethics-First Approach to AI Implementation"

• Question 77:

  Which of the following should be done FIRST when an attacker exfiltrates sensitive information from an AI model?

  A. Implement rate limiting and query restrictions to reduce exploitation attempts.
  B. Isolate impacted systems until the attack vector is identified.
  C. Rebuild the AI model using a more secure architecture.
  D. Inform regulators and affected stakeholders of a potential data breach.
  B. Isolate impacted systems until the attack vector is identified.

  ---

  Explanation

  According to the AAIATM Study Guide, the first action in response to a confirmed or suspected data exfiltration attack should be containment. Isolating impacted systems helps prevent further exploitation while allowing for a secure

  investigation of the breach source.

  "The initial response to any AI-related data breach must prioritize containment of the threat. Immediate isolation of affected systems helps mitigate further damage and supports a controlled forensic analysis."

  While regulatory notification (D) and architectural remediation (C) are important, they follow containment. Query limitations (A) reduce future risk but do not address the current attack. Thus, B is the critical first step.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "Ethical and Legal Considerations in AI," Subsection: "AI Security Incident Response and Containment"

• Question 78:

  When auditing the transparency of an AI system, which of the following would be the MOST effective way to understand the model's decision-making process?

  A. Evaluating the diversity of the training data set
  B. Analyzing the complexity of the algorithms used
  C. Assessing the computational cost of the model
  D. Reviewing the explainability of AI outputs
  D. Reviewing the explainability of AI outputs

  ---

  Explanation

  Transparency in AI systems is a key requirement to ensure trust, accountability, and ethical compliance. According to the ISACA AAIATM Study Guide under the "AI Governance and Risk Management" section, understanding the decision-making process of an AI system falls under the principle of explainability. Explainability refers to the degree to which an observer can understand the internal mechanics of an AI system and the rationale behind its outputs.

  "Reviewing the explainability of AI outputs allows auditors and stakeholders to determine whether model decisions are interpretable and justifiable. High transparency means stakeholders can trace how and why a decision was made." While algorithm complexity and computational cost are technical considerations, they do not directly facilitate the audit of decision-making transparency. Similarly, training data diversity is essential for bias reduction but does not explain how decisions are derived. Therefore, option D is the most aligned with auditing transparency.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Governance and Risk Management," Subsection: "Transparency and Explainability"

• Question 79:

  An IS auditor notes the combined number of records utilized within the training, validation, and testing data sets exceeds the total number of records in the original data set. Which of the following is MOST important for the auditor to determine?

  A. Whether the training, validation, and testing data sets were created in the correct order
  B. Whether data leakage occurred from utilizing overlapping records in the data sets
  C. Whether a sufficient number of records were utilized in the training data set
  D. Whether the validation data set utilized the same number of records as the training data sets
  B. Whether data leakage occurred from utilizing overlapping records in the data sets

  ---

  Explanation

  If the combined size of the training, validation, and testing sets exceeds the original data size, it suggests that records may have been reused across sets. This can lead to data leakage, where the model has access to test or validation

  information during training, resulting in overly optimistic performance metrics.

  "Data leakage invalidates model evaluation because it introduces unintended data overlap. Auditors must ensure that the training, validation, and test sets are strictly partitioned."

  Options A, C, and D refer to process order or quantity, but only B addresses the root issue of compromised model integrity due to overlapping data.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Fundamentals and Technologies," Subsection: "Data Partitioning and Leakage Risks"

• Question 80:

  When reviewing contracts or other lengthy documentation in the planning phase, which of the following tools would BEST extract relevant information?

  A. Robotic process automation (RPA)
  B. Autoregressive sequencing model
  C. Predictive analytics
  D. Natural language processing
  D. Natural language processing

  ---

  Explanation

  Natural Language Processing (NLP) enables systems to understand, summarize, and extract relevant insights from unstructured text data such as contracts, emails, or reports. The AAIATM Study Guide recognizes NLP as the optimal tool for document review during audit planning or risk assessment phases. "NLP techniques can efficiently process large volumes of documentation, highlight key clauses, and identify inconsistencies or risk indicators. This enhances audit productivity and thoroughness."

  While RPA (A) automates repetitive tasks, it doesn't interpret content. Predictive analytics (C) forecasts trends, and autoregressive models (B) generate sequences, not summarize documents.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI in Audit Processes," Subsection: "NLP Applications in Audit Planning and Risk Identification"