Isaca ISACA-AAIA Online Practice Questions and Exam Preparation

Isaca ISACA-AAIA Online Questions & Answers

• Question 81:

  A healthcare organization uses patient data to train an AI model for early disease detection. Which of the following practices provides the BEST assurance that personal data is secure and its integrity is maintained?

  A. Encrypting stored data to reduce exposure and log access
  B. Updating the AI model with new data and tracking changes
  C. Implementing strict data access controls and conducting security tests
  D. Anonymizing patient data and performing regular quality checks
  D. Anonymizing patient data and performing regular quality checks

  ---

  Explanation

  In healthcare AI applications, protecting patient data is critical. The AAIATM Study Guide identifies anonymization as one of the most effective strategies to preserve privacy and maintain data integrity. When combined with quality checks, it

  ensures data accuracy and compliance with health data protection regulations (e.g., HIPAA, GDPR).

  "Anonymizing sensitive data removes identifying attributes, significantly reducing risk if data is accessed or leaked. Ongoing data quality checks ensure the integrity and utility of the anonymized dataset."

  While encryption (A) and access controls (C) are necessary technical safeguards, D provides the strongest dual assurance of privacy and accuracy. Option B focuses on model management rather than data security.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "Ethical and Legal Considerations in AI," Subsection: "Privacy and Security of Sensitive AI Data"

• Question 82:

  A retail organization uses an AI model to analyze customers' purchase history in order to offer personalized discounts. Which of the following practices represents the MOST ethical use of customer data?

  A. Utilizing customer purchase data only after obtaining explicit consent and allowing customers to opt out
  B. Retaining and analyzing all available customer data to ensure unbiased recommendations
  C. Providing the public with access to review and audit the data set of collected customer information
  D. Sharing customer purchase data with third-party vendors to improve advertising and communication
  A. Utilizing customer purchase data only after obtaining explicit consent and allowing customers to opt out

  ---

  Explanation

  The ethical use of customer data is rooted in respecting privacy, maintaining informed consent, and enabling data subjects to exercise control over their personal information. The AAIATM Study Guide clearly outlines that obtaining explicit

  consent and providing opt-out capabilities align with principles of data protection and ethical AI.

  "Ethical AI implementation includes transparency in data collection, clear consent mechanisms, and the right of users to opt out or control their personal data usage. Retail and consumer applications must ensure that personalized services do

  not override these data subject rights."

  Options B and D violate principles of minimal data use and consent, while C may create unnecessary privacy exposure. Therefore, A is the correct and most ethical practice.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "Ethical and Legal Considerations in AI," Subsection: "Informed Consent and Customer Privacy"

• Question 83:

  Which of the following BEST detects model drift or unexpected changes in AI model outputs?

  A. Standardization of AI configurations
  B. Anomaly monitoring
  C. AI model documentation reviews
  D. AI model retraining
  B. Anomaly monitoring

  ---

  Explanation

  Anomaly monitoring detects irregularities or deviations in input data or model outputs, which are key indicators of model drift. According to the AAIATM Study Guide, continuous anomaly detection is one of the most effective methods for

  identifying when a model is no longer functioning as expected due to changes in the data environment.

  "Monitoring for output anomalies enables early identification of model drift. This proactive approach allows organizations to retrain or adjust models before significant performance degradation occurs."

  Configuration standardization (A) and documentation reviews (C) support governance but don't detect changes. Retraining (D) is a remediation step, not a detection mechanism. Therefore, B is correct.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Operations and Performance," Subsection: "Model Drift Detection and Anomaly Monitoring"

• Question 84:

  When utilizing a machine learning (ML) model to predict whether a wind turbine electricity generator will fail, which model evaluation metric should be the PRIMARY focus?

  A. Precision
  B. Specificity
  C. Accuracy
  D. Recall
  D. Recall

  ---

  Explanation

  In predictive maintenance use cases--such as detecting turbine failure--the most critical concern is identifying as many actual failures as possible to prevent catastrophic events. The AAIATM Study Guide emphasizes that in such high-risk

  scenarios, Recall is the most appropriate metric because it measures the proportion of true positives correctly identified.

  "Recall is critical in scenarios where missing a positive instance (e.g., a failure) is costly or dangerous. It ensures that most real issues are caught by the model, even at the expense of some false positives."

  Precision measures correctness of positive predictions, specificity measures true negatives, and accuracy may be misleading if the data is imbalanced. Thus, D (Recall) is most appropriate.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Operations and Performance," Subsection: "Evaluation Metrics and Predictive Accuracy"

• Question 85:

  When an IS auditor is reviewing results from an AI system, which of the following would cause the GREATEST risk?

  A. Inability to identify where an AI system is housed
  B. System output not being checked for inconsistencies
  C. Cascading failures of AI system outputs
  D. Difficulty of documenting AI algorithm processes
  B. System output not being checked for inconsistencies

  ---

  Explanation

  Unchecked AI outputs pose a significant risk because incorrect or biased results may propagate into decision- making processes. The AAIATM Study Guide stresses that validating AI outputs for consistency, accuracy, and reasonableness is

  a critical responsibility of both operators and auditors.

  "Auditors must verify that appropriate output validation mechanisms are in place. Failure to check outputs increases the likelihood of undetected errors influencing downstream processes or decisions."

  While cascading failures (C) are a consequence of unchecked outputs, B is the root issue. A and D present logistical and documentation risks but not the highest immediate impact.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI in Audit Processes," Subsection: "Audit Validation of AI Outputs"

• Question 86:

  An IS auditor is auditing an organization's data governance framework. The primary objective is to provide assurance that data management practices are standardized to support a trustworthy AI system. Which of the following should be the auditor's MOST important consideration?

  A. Retention of stored data
  B. Portability of data
  C. Data practices for training models
  D. Accountability for data management
  D. Accountability for data management

  ---

  Explanation

  Accountability for data management (option D) is the most crucial consideration. The AAIATM Study Guide emphasizes that "clear roles, responsibilities, and ownership for data management activities are central to trustworthy AI systems, as

  they ensure compliance, traceability, and the consistent application of policies and controls."

  Retention, portability, and data training practices are important, but accountability is foundational for the enforcement and monitoring of all other governance practices.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "Accountability in Data Governance for AI"

• Question 87:

  The PRIMARY purpose of maintaining an audit trail in AI systems is to:

  A. Facilitate transparency and traceability of decisions.
  B. Analyze model accuracy and fairness.
  C. Measure computational efficiency.
  D. Ensure compliance with regulatory standards for AI.
  A. Facilitate transparency and traceability of decisions.

  ---

  Explanation

  Audit trails in AI systems serve to document the inputs, processes, and outputs of AI decisions, allowing stakeholders and auditors to trace how decisions were made. The AAIATM Study Guide identifies transparency and traceability as the

  core functions of an AI audit trail.

  "Maintaining audit logs is critical to explainability and accountability. It ensures that decisions made by AI systems can be reconstructed and assessed for accuracy, ethics, and legality."

  Although compliance (D) is an outcome and fairness (B) a goal, only A captures the foundational purpose of audit trails in AI systems.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Governance and Risk Management," Subsection: "Auditability and Logging Mechanisms"

• Question 88:

  Which of the following is an IS auditor's MOST important course of action when determining whether source data should be entered into approved generative AI tools to assist with an audit?

  A. Validate that the tool is leveraging the latest model.
  B. Validate that the tool provides a privacy notice.
  C. Determine whether any AI model hallucinations have occurred.
  D. Determine whether the information is reliable.
  D. Determine whether the information is reliable.

  ---

  Explanation

  When using generative AI tools during audit activities, the most critical concern is the reliability and appropriateness of the information being entered and processed. According to the AAIATM Study Guide, auditors are accountable for

  ensuring that audit data is valid, confidential, and that generated outputs are factual and verifiable.

  "IS auditors must evaluate whether the information entered into AI tools is reliable and appropriate for the audit context. Inputting sensitive or unverified data may lead to regulatory violations or audit inaccuracies."

  While hallucinations (C) and privacy notices (B) are important concerns, the primary auditor responsibility is to ensure that source data is accurate and suitable. Therefore, D is the correct response.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "Ethical and Legal Considerations in AI," Subsection: "Auditor Responsibility and AI Input Validation"

• Question 89:

  An IS auditor is auditing an AI system that predicts inventory needs. The system recently failed to predict a stock outage for a key product. Which of the following audit tests would BEST validate the system's accuracy?

  A. Unit testing of the forecasting algorithm
  B. Load testing during peak sales periods
  C. Sensitivity analysis on input variables
  D. Historical testing with past sales data
  D. Historical testing with past sales data

  ---

  Explanation

  The best way to validate the accuracy of a predictive AI system is to use historical testing with past sales data (option D). According to the AAIATM Study Guide, "historical (or back-testing) is essential for evaluating how well a model would

  have performed using actual data from previous periods, directly reflecting its predictive validity." This method reveals any gaps or biases in the model by comparing predictions to known outcomes.

  Unit testing, load testing, and sensitivity analysis are useful for technical verification and robustness but do not provide direct evidence of prediction accuracy in real-world scenarios.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Model Validation Techniques"

• Question 90:

  Which of the following do supervised AI learning models PRIMARILY use to train algorithms?

  A. Unlabeled data sets
  B. Clustered data sets
  C. Labeled data sets
  D. Randomized data sets
  C. Labeled data sets

  ---

  Explanation

  Supervised learning is a foundational type of machine learning in which the model is trained on a labeled dataset. According to the AAIATM Study Guide, labeled data includes input features along with the correct output, enabling the model to

  learn the mapping function accurately.

  "In supervised learning, models learn from input-output pairs provided in the training data. This method enables predictive modeling tasks such as classification and regression."

  Unlabeled data (A) is used in unsupervised learning; clustered data (B) is a technique rather than a data type; and randomized data (D) refers to distribution strategy, not labeling. Hence, labeled data is the correct answer.

  ISACA Advanced in AI AuditTM (AAIATM) Study Guide, Section: "AI Fundamentals and Technologies," Subsection: "Types of AI Learning Models"