Isaca AAIA Practice Test 110
Question 1090
An independent AI auditor reviews this case: A procurement platform blocks direct model access and an auditor concludes zero risk because of a vendor certification. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Inspect contractual audit rights, alternative records, sampled outputs, independent tests and unresolved exclusions.
- Triangulate available independent evidence and document unresolved access limitations instead of overstating assurance.
- Reconcile AI inventory, data flows, business ownership, complaints, material incidents and risk appetite to audit plan.
- Define objective risk-based audit criteria from approved organizational policies, relevant standards and applicable law.
- State full reasonable assurance over an inaccessible model based only on its seller's reputation.
Explanation
Correct Answers
A:The corrective action is: Triangulate available independent evidence and document unresolved access limitations instead of overstating assurance. In this case: A procurement platform blocks direct model access and an auditor concludes zero risk because of a vendor certification.
B:Independent audit evidence includes: Inspect contractual audit rights, alternative records, sampled outputs, independent tests and unresolved exclusions. For this situation: A procurement platform blocks direct model access and an auditor concludes zero risk because of a vendor certification.
Incorrect Answers
C:This option concerns Risk-based AI audit universe and scope, which is a related but different AI governance concern. For this situation: A procurement platform blocks direct model access and an auditor concludes zero risk because of a vendor certification.
D:This option concerns AI audit criteria and control objectives, which is a related but different AI governance concern. It does not establish control effectiveness for Evidence sufficiency when source model is inaccessible.
E:This attractive shortcut does not resolve the Evidence sufficiency when source model is inaccessible weakness: State full reasonable assurance over an inaccessible model based only on its seller's reputation. For this situation: A procurement platform blocks direct model access and an auditor concludes zero risk because of a vendor certification.
Question 1091
A governance and assurance review uncovers the following: A procurement platform blocks direct model access and an auditor concludes zero risk because of a vendor certification. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Inspect contractual audit rights, alternative records, sampled outputs, independent tests and unresolved exclusions.
- State full reasonable assurance over an inaccessible model based only on its seller's reputation.
- Inspect audit program, control objectives, regulatory applicability, measurements and management agreement on criteria.
- Inspect acquisition records, file hashes, access log, transfer receipts and approved retention/destruction.
Explanation
Correct Answer
A:The corrective action is: Triangulate available independent evidence and document unresolved access limitations instead of overstating assurance. For this situation: A procurement platform blocks direct model access and an auditor concludes zero risk because of a vendor certification.
Incorrect Answers
B:For this situation: A procurement platform blocks direct model access and an auditor concludes zero risk because of a vendor certification.
C:This option concerns AI audit criteria and control objectives, which is a related but different AI governance concern. For this situation: A procurement platform blocks direct model access and an auditor concludes zero risk because of a vendor certification.
D:This option concerns Chain of custody for sensitive AI audit extracts, which is a related but different AI governance concern. In this case: A procurement platform blocks direct model access and an auditor concludes zero risk because of a vendor certification.
Question 1092
A risk-based audit engagement examines this operating condition: A procurement platform blocks direct model access and an auditor concludes zero risk because of a vendor certification. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Final conclusions distinguish tested controls from unsupported claims and explain resulting scope restrictions.
- Independent auditors retain final conclusions and conflicts are mitigated with transparent quality review.
- State full reasonable assurance over an inaccessible model based only on its seller's reputation.
- Workpapers map each issue to an explicit criterion, condition, cause, consequence and evidence.
Explanation
Correct Answer
A:This is an observable validation result for Evidence sufficiency when source model is inaccessible, not just management assurance: Final conclusions distinguish tested controls from unsupported claims and explain resulting scope restrictions.
Incorrect Answers
B:This option concerns Auditor independence with AI-enabled workpapers, which is a related but different AI governance concern. In this case: A procurement platform blocks direct model access and an auditor concludes zero risk because of a vendor certification.
C:The auditor should instead examine: Inspect contractual audit rights, alternative records, sampled outputs, independent tests and unresolved exclusions.
D:This option concerns AI audit criteria and control objectives, which is a related but different AI governance concern. The decisive principle here is: Sufficiency and appropriateness require a fit between evidence and the audit assertion being made.
Question 1093
An audit committee asks for a defensible assessment of this situation: An AI auditor replays a disputed support answer against today's retrieval index and assumes it proves what was available last month. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Collect timestamped evidence with integrity protection, authorized access and traceable provenance.
- Capture model and prompt versions, retrieval sources, seeds where relevant and external state for reproducible testing.
- Treat a single new model response as definitive evidence of the exact historical output under changed conditions.
- Define the AI audit universe and scope using use-case impact, third parties, control reliance and key risk scenarios.
Explanation
Correct Answer
B:The reason it is necessary is: Reperformance of probabilistic or tool-using AI needs contextual version evidence and a documented uncertainty bound. This is the proportionate control response to Model version and retrieval evidence preservation: Capture model and prompt versions, retrieval sources, seeds where relevant and external state for reproducible testing.
Incorrect Answers
A:This option concerns Immutable AI decision audit trail and provenance, which is a related but different AI governance concern. It does not establish control effectiveness for Model version and retrieval evidence preservation.
C:This attractive shortcut does not resolve the Model version and retrieval evidence preservation weakness: Treat a single new model response as definitive evidence of the exact historical output under changed conditions.
D:This option concerns Risk-based AI audit universe and scope, which is a related but different AI governance concern. It does not establish control effectiveness for Model version and retrieval evidence preservation.
Question 1094
During an AI controls assessment, the team learns that an AI auditor replays a disputed support answer against today's retrieval index and assumes it proves what was available last month. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Audit evidence strength depends on trustworthy origin, completeness and resistance to undetected change.
- Treat a single new model response as definitive evidence of the exact historical output under changed conditions.
- Reperformance of probabilistic or tool-using AI needs contextual version evidence and a documented uncertainty bound.
- Evidence handling must protect confidentiality and integrity while maintaining the ability to demonstrate provenance.
Explanation
Correct Answer
C:The corrective action is: Capture model and prompt versions, retrieval sources, seeds where relevant and external state for reproducible testing. This is the applicable AI audit principle for Model version and retrieval evidence preservation: Reperformance of probabilistic or tool-using AI needs contextual version evidence and a documented uncertainty bound.
Incorrect Answers
A:This option concerns Immutable AI decision audit trail and provenance, which is a related but different AI governance concern. The decisive principle here is: Reperformance of probabilistic or tool-using AI needs contextual version evidence and a documented uncertainty bound.
B:This attractive shortcut does not resolve the Model version and retrieval evidence preservation weakness: Treat a single new model response as definitive evidence of the exact historical output under changed conditions. For this situation: An AI auditor replays a disputed support answer against today's retrieval index and assumes it proves what was available last month.
D:This option concerns Chain of custody for sensitive AI audit extracts, which is a related but different AI governance concern. It does not establish control effectiveness for Model version and retrieval evidence preservation.
Question 1095
An independent AI auditor reviews this case: An AI auditor replays a disputed support answer against today's retrieval index and assumes it proves what was available last month. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Inspect audit log access, integrity hash or signing, clock synchronization, record linkage and retention.
- Inspect deployment identifiers, prompt hashes, retrieval snapshots, tool trace IDs and evaluation settings.
- Treat a single new model response as definitive evidence of the exact historical output under changed conditions.
- Inspect audit program, control objectives, regulatory applicability, measurements and management agreement on criteria.
Explanation
Correct Answer
B:The reason it is necessary is: Reperformance of probabilistic or tool-using AI needs contextual version evidence and a documented uncertainty bound. The corrective action is: Capture model and prompt versions, retrieval sources, seeds where relevant and external state for reproducible testing.
Incorrect Answers
A:This option concerns Immutable AI decision audit trail and provenance, which is a related but different AI governance concern. For this situation: An AI auditor replays a disputed support answer against today's retrieval index and assumes it proves what was available last month.
C:This attractive shortcut does not resolve the Model version and retrieval evidence preservation weakness: Treat a single new model response as definitive evidence of the exact historical output under changed conditions. The auditor should instead examine: Inspect deployment identifiers, prompt hashes, retrieval snapshots, tool trace IDs and evaluation settings.
D:This option concerns AI audit criteria and control objectives, which is a related but different AI governance concern. It does not establish control effectiveness for Model version and retrieval evidence preservation.
Question 1096
A governance and assurance review uncovers the following: An AI auditor replays a disputed support answer against today's retrieval index and assumes it proves what was available last month. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- The plan covers material high-risk deployments and states documented scope boundaries and assurance limitations.
- Treat a single new model response as definitive evidence of the exact historical output under changed conditions.
- Auditors can reproduce or defensibly explain a decision with known context and documented stochastic limits.
- Independent auditors retain final conclusions and conflicts are mitigated with transparent quality review.
Explanation
Correct Answer
C:The reason it is necessary is: Reperformance of probabilistic or tool-using AI needs contextual version evidence and a documented uncertainty bound. This is an observable validation result for Model version and retrieval evidence preservation, not just management assurance: Auditors can reproduce or defensibly explain a decision with known context and documented stochastic limits.
Incorrect Answers
A:This option concerns Risk-based AI audit universe and scope, which is a related but different AI governance concern. The decisive principle here is: Reperformance of probabilistic or tool-using AI needs contextual version evidence and a documented uncertainty bound.
B:This attractive shortcut does not resolve the Model version and retrieval evidence preservation weakness: Treat a single new model response as definitive evidence of the exact historical output under changed conditions. Capture model and prompt versions, retrieval sources, seeds where relevant and external state for reproducible testing.
D:This option concerns Auditor independence with AI-enabled workpapers, which is a related but different AI governance concern. It does not establish control effectiveness for Model version and retrieval evidence preservation.
Question 1097
A risk-based audit engagement examines this operating condition: An incident team cannot identify which deployed prompt and model version caused a confidential citation leak. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Collect timestamped evidence with integrity protection, authorized access and traceable provenance.
- Treat a single new model response as definitive evidence of the exact historical output under changed conditions.
- Capture model and prompt versions, retrieval sources, seeds where relevant and external state for reproducible testing.
- Define objective risk-based audit criteria from approved organizational policies, relevant standards and applicable law.
Explanation
Correct Answer
C:The reason it is necessary is: Reperformance of probabilistic or tool-using AI needs contextual version evidence and a documented uncertainty bound. The acceptable verified outcome is: Auditors can reproduce or defensibly explain a decision with known context and documented stochastic limits.
Incorrect Answers
A:This option concerns Immutable AI decision audit trail and provenance, which is a related but different AI governance concern. In this case: An incident team cannot identify which deployed prompt and model version caused a confidential citation leak.
B:This attractive shortcut does not resolve the Model version and retrieval evidence preservation weakness: Treat a single new model response as definitive evidence of the exact historical output under changed conditions. In this case: An incident team cannot identify which deployed prompt and model version caused a confidential citation leak.
D:This option concerns AI audit criteria and control objectives, which is a related but different AI governance concern. The decisive principle here is: Reperformance of probabilistic or tool-using AI needs contextual version evidence and a documented uncertainty bound.
Question 1098
An audit committee asks for a defensible assessment of this situation: An incident team cannot identify which deployed prompt and model version caused a confidential citation leak. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Audit evidence strength depends on trustworthy origin, completeness and resistance to undetected change.
- Audit scope must follow enterprise AI exposure, not only visible software projects or infrastructure boundaries.
- Treat a single new model response as definitive evidence of the exact historical output under changed conditions.
- Reperformance of probabilistic or tool-using AI needs contextual version evidence and a documented uncertainty bound.
Explanation
Correct Answer
D:The corrective action is: Capture model and prompt versions, retrieval sources, seeds where relevant and external state for reproducible testing. The acceptable verified outcome is: Auditors can reproduce or defensibly explain a decision with known context and documented stochastic limits.
Incorrect Answers
A:This option concerns Immutable AI decision audit trail and provenance, which is a related but different AI governance concern. For this situation: An incident team cannot identify which deployed prompt and model version caused a confidential citation leak.
B:This option concerns Risk-based AI audit universe and scope, which is a related but different AI governance concern. In this case: An incident team cannot identify which deployed prompt and model version caused a confidential citation leak.
C:This attractive shortcut does not resolve the Model version and retrieval evidence preservation weakness: Treat a single new model response as definitive evidence of the exact historical output under changed conditions. For this situation: An incident team cannot identify which deployed prompt and model version caused a confidential citation leak.
Question 1099
During an AI controls assessment, the team learns that an incident team cannot identify which deployed prompt and model version caused a confidential citation leak. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Inspect deployment identifiers, prompt hashes, retrieval snapshots, tool trace IDs and evaluation settings.
- Treat a single new model response as definitive evidence of the exact historical output under changed conditions.
- Inspect acquisition records, file hashes, access log, transfer receipts and approved retention/destruction.
- Review engagement conflicts, tool ownership, reviewer signoff, challenge evidence and decision trail.
Explanation
Correct Answer
A:The reason it is necessary is: Reperformance of probabilistic or tool-using AI needs contextual version evidence and a documented uncertainty bound. In this case: An incident team cannot identify which deployed prompt and model version caused a confidential citation leak.
Incorrect Answers
B:This attractive shortcut does not resolve the Model version and retrieval evidence preservation weakness: Treat a single new model response as definitive evidence of the exact historical output under changed conditions. Effective closure requires: Auditors can reproduce or defensibly explain a decision with known context and documented stochastic limits.
C:This option concerns Chain of custody for sensitive AI audit extracts, which is a related but different AI governance concern. The decisive principle here is: Reperformance of probabilistic or tool-using AI needs contextual version evidence and a documented uncertainty bound.
D:This option concerns Auditor independence with AI-enabled workpapers, which is a related but different AI governance concern. The decisive principle here is: Reperformance of probabilistic or tool-using AI needs contextual version evidence and a documented uncertainty bound.
Question 1100
An independent AI auditor reviews this case: An incident team cannot identify which deployed prompt and model version caused a confidential citation leak. Which THREE elements together provide a defensible AI audit conclusion: the corrective control, the evidence to test it, and a verified outcome? Select THREE answers.
- Capture model and prompt versions, retrieval sources, seeds where relevant and external state for reproducible testing.
- Review engagement conflicts, tool ownership, reviewer signoff, challenge evidence and decision trail.
- Inspect deployment identifiers, prompt hashes, retrieval snapshots, tool trace IDs and evaluation settings.
- Auditors can reproduce or defensibly explain a decision with known context and documented stochastic limits.
- Plan third-party evidence access, complementary user controls, limitation statements and risk-based alternative procedures.
- Treat a single new model response as definitive evidence of the exact historical output under changed conditions.
Explanation
Correct Answers
A:The reason it is necessary is: Reperformance of probabilistic or tool-using AI needs contextual version evidence and a documented uncertainty bound. For this situation: An incident team cannot identify which deployed prompt and model version caused a confidential citation leak.
C:The reason it is necessary is: Reperformance of probabilistic or tool-using AI needs contextual version evidence and a documented uncertainty bound. This evidence directly tests the asserted control for Model version and retrieval evidence preservation: Inspect deployment identifiers, prompt hashes, retrieval snapshots, tool trace IDs and evaluation settings.
D:The reason it is necessary is: Reperformance of probabilistic or tool-using AI needs contextual version evidence and a documented uncertainty bound. Independent audit evidence includes: Inspect deployment identifiers, prompt hashes, retrieval snapshots, tool trace IDs and evaluation settings.
Incorrect Answers
B:This option concerns Auditor independence with AI-enabled workpapers, which is a related but different AI governance concern. For this situation: An incident team cannot identify which deployed prompt and model version caused a confidential citation leak.
E:This option concerns Third-party AI assurance boundary and audit rights, which is a related but different AI governance concern. It does not establish control effectiveness for Model version and retrieval evidence preservation.
F:For this situation: An incident team cannot identify which deployed prompt and model version caused a confidential citation leak.
