cert
cert-1
cert-2

Pass Isaca AAIA Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
AAIA Exam - Verified By Experts
AAIA Premium Bundle
$14.99

AAIA Premium Bundle

$74.99
$89.98
  • Premium File 556 Questions & Answers. Last update: Nov 08, 2026
  • Training Course 110 Video Lectures
 
$89.98
$74.99
accept 22 downloads in last 7 days
block-screenshots
Purchase Isaca AAIA Exam Training Products Individually
Isaca AAIA Premium File
Premium File 556 Q&A
$76.99$69.99
Isaca AAIA Video Training Course
Training Course 110 Lectures
$21.99 $19.99
Isaca AAIA Practice Test 109

Question 1080

An independent AI auditor reviews this case: A regulated dataset is edited in the original storage location while auditors analyze it and no clean reference is preserved. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.

  1. Email unredacted extracts broadly and rely on filename similarity to establish forensic identity.
  2. Preserve evidence chain of custody, minimize personal data and verify controlled analytical copies.
  3. Inspect audit log access, integrity hash or signing, clock synchronization, record linkage and retention.
  4. Inspect acquisition records, file hashes, access log, transfer receipts and approved retention/destruction.
  5. Define objective risk-based audit criteria from approved organizational policies, relevant standards and applicable law.

Explanation

Correct Answers

B:

The reason it is necessary is: Evidence handling must protect confidentiality and integrity while maintaining the ability to demonstrate provenance. For this situation: A regulated dataset is edited in the original storage location while auditors analyze it and no clean reference is preserved.

D:

The corrective action is: Preserve evidence chain of custody, minimize personal data and verify controlled analytical copies.

Incorrect Answers

A:

It misses the key control principle: Evidence handling must protect confidentiality and integrity while maintaining the ability to demonstrate provenance.

C:

This option concerns Immutable AI decision audit trail and provenance, which is a related but different AI governance concern. In this case: A regulated dataset is edited in the original storage location while auditors analyze it and no clean reference is preserved.

E:

This option concerns AI audit criteria and control objectives, which is a related but different AI governance concern. In this case: A regulated dataset is edited in the original storage location while auditors analyze it and no clean reference is preserved.

Question 1081

A governance and assurance review uncovers the following: A cloud model vendor provides aggregate accuracy numbers but denies raw decisions needed for client-specific fairness testing. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.

  1. Collect timestamped evidence with integrity protection, authorized access and traceable provenance.
  2. State full reasonable assurance over an inaccessible model based only on its seller's reputation.
  3. Capture model and prompt versions, retrieval sources, seeds where relevant and external state for reproducible testing.
  4. Triangulate available independent evidence and document unresolved access limitations instead of overstating assurance.

Explanation

Correct Answer

D:

Independent audit evidence includes: Inspect contractual audit rights, alternative records, sampled outputs, independent tests and unresolved exclusions. This is the proportionate control response to Evidence sufficiency when source model is inaccessible: Triangulate available independent evidence and document unresolved access limitations instead of overstating assurance.

Incorrect Answers

A:

This option concerns Immutable AI decision audit trail and provenance, which is a related but different AI governance concern. It does not establish control effectiveness for Evidence sufficiency when source model is inaccessible.

B:

This attractive shortcut does not resolve the Evidence sufficiency when source model is inaccessible weakness: State full reasonable assurance over an inaccessible model based only on its seller's reputation.

C:

This option concerns Model version and retrieval evidence preservation, which is a related but different AI governance concern. It does not establish control effectiveness for Evidence sufficiency when source model is inaccessible.

Question 1082

A risk-based audit engagement examines this operating condition: A cloud model vendor provides aggregate accuracy numbers but denies raw decisions needed for client-specific fairness testing. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.

  1. Evidence handling must protect confidentiality and integrity while maintaining the ability to demonstrate provenance.
  2. Sufficiency and appropriateness require a fit between evidence and the audit assertion being made.
  3. Audit scope must follow enterprise AI exposure, not only visible software projects or infrastructure boundaries.
  4. State full reasonable assurance over an inaccessible model based only on its seller's reputation.

Explanation

Correct Answer

B:

Independent audit evidence includes: Inspect contractual audit rights, alternative records, sampled outputs, independent tests and unresolved exclusions. The corrective action is: Triangulate available independent evidence and document unresolved access limitations instead of overstating assurance.

Incorrect Answers

A:

This option concerns Chain of custody for sensitive AI audit extracts, which is a related but different AI governance concern. It does not establish control effectiveness for Evidence sufficiency when source model is inaccessible.

C:

This option concerns Risk-based AI audit universe and scope, which is a related but different AI governance concern. It does not establish control effectiveness for Evidence sufficiency when source model is inaccessible.

D:

This attractive shortcut does not resolve the Evidence sufficiency when source model is inaccessible weakness: State full reasonable assurance over an inaccessible model based only on its seller's reputation. For this situation: A cloud model vendor provides aggregate accuracy numbers but denies raw decisions needed for client-specific fairness testing.

Question 1083

An audit committee asks for a defensible assessment of this situation: A cloud model vendor provides aggregate accuracy numbers but denies raw decisions needed for client-specific fairness testing. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.

  1. Inspect deployment identifiers, prompt hashes, retrieval snapshots, tool trace IDs and evaluation settings.
  2. Reconcile AI inventory, data flows, business ownership, complaints, material incidents and risk appetite to audit plan.
  3. Inspect contractual audit rights, alternative records, sampled outputs, independent tests and unresolved exclusions.
  4. State full reasonable assurance over an inaccessible model based only on its seller's reputation.

Explanation

Correct Answer

C:

The corrective action is: Triangulate available independent evidence and document unresolved access limitations instead of overstating assurance. This evidence directly tests the asserted control for Evidence sufficiency when source model is inaccessible: Inspect contractual audit rights, alternative records, sampled outputs, independent tests and unresolved exclusions.

Incorrect Answers

A:

This option concerns Model version and retrieval evidence preservation, which is a related but different AI governance concern. For this situation: A cloud model vendor provides aggregate accuracy numbers but denies raw decisions needed for client-specific fairness testing.

B:

This option concerns Risk-based AI audit universe and scope, which is a related but different AI governance concern. For this situation: A cloud model vendor provides aggregate accuracy numbers but denies raw decisions needed for client-specific fairness testing.

D:

This attractive shortcut does not resolve the Evidence sufficiency when source model is inaccessible weakness: State full reasonable assurance over an inaccessible model based only on its seller's reputation. It misses the key control principle: Sufficiency and appropriateness require a fit between evidence and the audit assertion being made.

Question 1084

During an AI controls assessment, the team learns that a cloud model vendor provides aggregate accuracy numbers but denies raw decisions needed for client-specific fairness testing. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.

  1. A sampled decision and intervention sequence can be reconstructed from tamper-evident records.
  2. Final conclusions distinguish tested controls from unsupported claims and explain resulting scope restrictions.
  3. State full reasonable assurance over an inaccessible model based only on its seller's reputation.
  4. Independent auditors retain final conclusions and conflicts are mitigated with transparent quality review.

Explanation

Correct Answer

B:

Independent audit evidence includes: Inspect contractual audit rights, alternative records, sampled outputs, independent tests and unresolved exclusions. This is an observable validation result for Evidence sufficiency when source model is inaccessible, not just management assurance: Final conclusions distinguish tested controls from unsupported claims and explain resulting scope restrictions.

Incorrect Answers

A:

This option concerns Immutable AI decision audit trail and provenance, which is a related but different AI governance concern. For this situation: A cloud model vendor provides aggregate accuracy numbers but denies raw decisions needed for client-specific fairness testing.

C:

This attractive shortcut does not resolve the Evidence sufficiency when source model is inaccessible weakness: State full reasonable assurance over an inaccessible model based only on its seller's reputation. Triangulate available independent evidence and document unresolved access limitations instead of overstating assurance.

D:

This option concerns Auditor independence with AI-enabled workpapers, which is a related but different AI governance concern. It does not establish control effectiveness for Evidence sufficiency when source model is inaccessible.

Question 1085

An independent AI auditor reviews this case: An audit has system logs and policy documents but no proof that production users actually followed controls. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.

  1. State full reasonable assurance over an inaccessible model based only on its seller's reputation.
  2. Capture model and prompt versions, retrieval sources, seeds where relevant and external state for reproducible testing.
  3. Define the AI audit universe and scope using use-case impact, third parties, control reliance and key risk scenarios.
  4. Triangulate available independent evidence and document unresolved access limitations instead of overstating assurance.

Explanation

Correct Answer

D:

Independent audit evidence includes: Inspect contractual audit rights, alternative records, sampled outputs, independent tests and unresolved exclusions. In this case: An audit has system logs and policy documents but no proof that production users actually followed controls.

Incorrect Answers

A:

This attractive shortcut does not resolve the Evidence sufficiency when source model is inaccessible weakness: State full reasonable assurance over an inaccessible model based only on its seller's reputation. In this case: An audit has system logs and policy documents but no proof that production users actually followed controls.

B:

This option concerns Model version and retrieval evidence preservation, which is a related but different AI governance concern. In this case: An audit has system logs and policy documents but no proof that production users actually followed controls.

C:

This option concerns Risk-based AI audit universe and scope, which is a related but different AI governance concern. In this case: An audit has system logs and policy documents but no proof that production users actually followed controls.

Question 1086

A governance and assurance review uncovers the following: An audit has system logs and policy documents but no proof that production users actually followed controls. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.

  1. Sufficiency and appropriateness require a fit between evidence and the audit assertion being made.
  2. Evidence handling must protect confidentiality and integrity while maintaining the ability to demonstrate provenance.
  3. Reperformance of probabilistic or tool-using AI needs contextual version evidence and a documented uncertainty bound.
  4. State full reasonable assurance over an inaccessible model based only on its seller's reputation.

Explanation

Correct Answer

A:

Independent audit evidence includes: Inspect contractual audit rights, alternative records, sampled outputs, independent tests and unresolved exclusions. The acceptable verified outcome is: Final conclusions distinguish tested controls from unsupported claims and explain resulting scope restrictions.

Incorrect Answers

B:

This option concerns Chain of custody for sensitive AI audit extracts, which is a related but different AI governance concern. In this case: An audit has system logs and policy documents but no proof that production users actually followed controls.

C:

This option concerns Model version and retrieval evidence preservation, which is a related but different AI governance concern. For this situation: An audit has system logs and policy documents but no proof that production users actually followed controls.

D:

This attractive shortcut does not resolve the Evidence sufficiency when source model is inaccessible weakness: State full reasonable assurance over an inaccessible model based only on its seller's reputation. For this situation: An audit has system logs and policy documents but no proof that production users actually followed controls.

Question 1087

A risk-based audit engagement examines this operating condition: An audit has system logs and policy documents but no proof that production users actually followed controls. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.

  1. Inspect deployment identifiers, prompt hashes, retrieval snapshots, tool trace IDs and evaluation settings.
  2. Inspect acquisition records, file hashes, access log, transfer receipts and approved retention/destruction.
  3. Inspect contractual audit rights, alternative records, sampled outputs, independent tests and unresolved exclusions.
  4. State full reasonable assurance over an inaccessible model based only on its seller's reputation.

Explanation

Correct Answer

C:

The corrective action is: Triangulate available independent evidence and document unresolved access limitations instead of overstating assurance. In this case: An audit has system logs and policy documents but no proof that production users actually followed controls.

Incorrect Answers

A:

This option concerns Model version and retrieval evidence preservation, which is a related but different AI governance concern. The decisive principle here is: Sufficiency and appropriateness require a fit between evidence and the audit assertion being made.

B:

This option concerns Chain of custody for sensitive AI audit extracts, which is a related but different AI governance concern. For this situation: An audit has system logs and policy documents but no proof that production users actually followed controls.

D:

This attractive shortcut does not resolve the Evidence sufficiency when source model is inaccessible weakness: State full reasonable assurance over an inaccessible model based only on its seller's reputation. Effective closure requires: Final conclusions distinguish tested controls from unsupported claims and explain resulting scope restrictions.

Question 1088

An audit committee asks for a defensible assessment of this situation: An audit has system logs and policy documents but no proof that production users actually followed controls. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.

  1. State full reasonable assurance over an inaccessible model based only on its seller's reputation.
  2. The plan covers material high-risk deployments and states documented scope boundaries and assurance limitations.
  3. Final conclusions distinguish tested controls from unsupported claims and explain resulting scope restrictions.
  4. Independent auditors retain final conclusions and conflicts are mitigated with transparent quality review.

Explanation

Correct Answer

C:

Independent audit evidence includes: Inspect contractual audit rights, alternative records, sampled outputs, independent tests and unresolved exclusions. The reason it is necessary is: Sufficiency and appropriateness require a fit between evidence and the audit assertion being made.

Incorrect Answers

A:

For this situation: An audit has system logs and policy documents but no proof that production users actually followed controls.

B:

This option concerns Risk-based AI audit universe and scope, which is a related but different AI governance concern. For this situation: An audit has system logs and policy documents but no proof that production users actually followed controls.

D:

This option concerns Auditor independence with AI-enabled workpapers, which is a related but different AI governance concern. In this case: An audit has system logs and policy documents but no proof that production users actually followed controls.

Question 1089

During an AI controls assessment, the team learns that a procurement platform blocks direct model access and an auditor concludes zero risk because of a vendor certification. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.

  1. Triangulate available independent evidence and document unresolved access limitations instead of overstating assurance.
  2. Collect timestamped evidence with integrity protection, authorized access and traceable provenance.
  3. Define the AI audit universe and scope using use-case impact, third parties, control reliance and key risk scenarios.
  4. State full reasonable assurance over an inaccessible model based only on its seller's reputation.

Explanation

Correct Answer

A:

Independent audit evidence includes: Inspect contractual audit rights, alternative records, sampled outputs, independent tests and unresolved exclusions. In this case: A procurement platform blocks direct model access and an auditor concludes zero risk because of a vendor certification.

Incorrect Answers

B:

This option concerns Immutable AI decision audit trail and provenance, which is a related but different AI governance concern. In this case: A procurement platform blocks direct model access and an auditor concludes zero risk because of a vendor certification.

C:

This option concerns Risk-based AI audit universe and scope, which is a related but different AI governance concern. In this case: A procurement platform blocks direct model access and an auditor concludes zero risk because of a vendor certification.

D:

This attractive shortcut does not resolve the Evidence sufficiency when source model is inaccessible weakness: State full reasonable assurance over an inaccessible model based only on its seller's reputation. In this case: A procurement platform blocks direct model access and an auditor concludes zero risk because of a vendor certification.

Question 1090

An independent AI auditor reviews this case: A procurement platform blocks direct model access and an auditor concludes zero risk because of a vendor certification. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.

  1. Inspect contractual audit rights, alternative records, sampled outputs, independent tests and unresolved exclusions.
  2. Triangulate available independent evidence and document unresolved access limitations instead of overstating assurance.
  3. Reconcile AI inventory, data flows, business ownership, complaints, material incidents and risk appetite to audit plan.
  4. Define objective risk-based audit criteria from approved organizational policies, relevant standards and applicable law.
  5. State full reasonable assurance over an inaccessible model based only on its seller's reputation.

Explanation

Correct Answers

A:

The corrective action is: Triangulate available independent evidence and document unresolved access limitations instead of overstating assurance. In this case: A procurement platform blocks direct model access and an auditor concludes zero risk because of a vendor certification.

B:

Independent audit evidence includes: Inspect contractual audit rights, alternative records, sampled outputs, independent tests and unresolved exclusions. For this situation: A procurement platform blocks direct model access and an auditor concludes zero risk because of a vendor certification.

Incorrect Answers

C:

This option concerns Risk-based AI audit universe and scope, which is a related but different AI governance concern. For this situation: A procurement platform blocks direct model access and an auditor concludes zero risk because of a vendor certification.

D:

This option concerns AI audit criteria and control objectives, which is a related but different AI governance concern. It does not establish control effectiveness for Evidence sufficiency when source model is inaccessible.

E:

This attractive shortcut does not resolve the Evidence sufficiency when source model is inaccessible weakness: State full reasonable assurance over an inaccessible model based only on its seller's reputation. For this situation: A procurement platform blocks direct model access and an auditor concludes zero risk because of a vendor certification.

ISACA Advanced in AI Audit (AAIA) Practice Tests