Isaca AAIA Practice Test 18
Question 170
An independent AI auditor reviews this case: A warehouse AI optimizes picking speed but risk staff list only data breaches and miss worker safety hazards. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Track leading behavior, data-quality and control indicators with thresholds linked to risk appetite.
- Reuse a generic network security risk list and conclude all AI-specific adverse decisions are covered.
- Review use-case map, stakeholders, failure modes, risk register, impact assumptions and challenge workshops.
- Develop use-case-specific scenarios covering people, business process, privacy, safety, security and model behavior.
- Inspect system purpose, actors, changes, market placement, impact, legal analysis and current phased applicability.
Explanation
Correct Answers
C:The reason it is necessary is: AI risk assessment must consider intended context and foreseeable misuse, not only traditional IT incidents. This evidence directly tests the asserted control for AI use-case risk scenario identification: Review use-case map, stakeholders, failure modes, risk register, impact assumptions and challenge workshops.
D:The reason it is necessary is: AI risk assessment must consider intended context and foreseeable misuse, not only traditional IT incidents. For this situation: A warehouse AI optimizes picking speed but risk staff list only data breaches and miss worker safety hazards.
Incorrect Answers
A:This option concerns AI risk monitoring through leading KRIs, which is a related but different AI governance concern. It does not establish control effectiveness for AI use-case risk scenario identification.
B:This attractive shortcut does not resolve the AI use-case risk scenario identification weakness: Reuse a generic network security risk list and conclude all AI-specific adverse decisions are covered. For this situation: A warehouse AI optimizes picking speed but risk staff list only data breaches and miss worker safety hazards.
E:This option concerns EU AI Act role and risk classification, which is a related but different AI governance concern. It does not establish control effectiveness for AI use-case risk scenario identification.
Question 171
A governance and assurance review uncovers the following: A warehouse AI optimizes picking speed but risk staff list only data breaches and miss worker safety hazards. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Inspect monitoring design, owners, thresholds, near-misses, drift and documented actions for breaches.
- Review use-case map, stakeholders, failure modes, risk register, impact assumptions and challenge workshops.
- Compare justified subgroup metrics, candidate proxies, sampling context, error costs and approved fairness criteria.
- Reuse a generic network security risk list and conclude all AI-specific adverse decisions are covered.
Explanation
Correct Answer
B:The reason it is necessary is: AI risk assessment must consider intended context and foreseeable misuse, not only traditional IT incidents. The corrective action is: Develop use-case-specific scenarios covering people, business process, privacy, safety, security and model behavior.
Incorrect Answers
A:This option concerns AI risk monitoring through leading KRIs, which is a related but different AI governance concern. For this situation: A warehouse AI optimizes picking speed but risk staff list only data breaches and miss worker safety hazards.
C:This option concerns Fairness assessment for proxy discrimination, which is a related but different AI governance concern. For this situation: A warehouse AI optimizes picking speed but risk staff list only data breaches and miss worker safety hazards.
D:This attractive shortcut does not resolve the AI use-case risk scenario identification weakness: Reuse a generic network security risk list and conclude all AI-specific adverse decisions are covered. The auditor should instead examine: Review use-case map, stakeholders, failure modes, risk register, impact assumptions and challenge workshops.
Question 172
A risk-based audit engagement examines this operating condition: A warehouse AI optimizes picking speed but risk staff list only data breaches and miss worker safety hazards. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Fairness monitoring detects problematic disparities and remediation does not conceal residual performance impacts.
- Critical decisions continue or fail safely during vendor disruption with documented recovery alternatives.
- Reuse a generic network security risk list and conclude all AI-specific adverse decisions are covered.
- Material plausible failure scenarios have accountable controls, measurements and response plans.
Explanation
Correct Answer
D:The reason it is necessary is: AI risk assessment must consider intended context and foreseeable misuse, not only traditional IT incidents. This is an observable validation result for AI use-case risk scenario identification, not just management assurance: Material plausible failure scenarios have accountable controls, measurements and response plans.
Incorrect Answers
A:This option concerns Fairness assessment for proxy discrimination, which is a related but different AI governance concern. The decisive principle here is: AI risk assessment must consider intended context and foreseeable misuse, not only traditional IT incidents.
B:This option concerns Model concentration and systemic vendor dependency, which is a related but different AI governance concern. It does not establish control effectiveness for AI use-case risk scenario identification.
C:This attractive shortcut does not resolve the AI use-case risk scenario identification weakness: Reuse a generic network security risk list and conclude all AI-specific adverse decisions are covered. Effective closure requires: Material plausible failure scenarios have accountable controls, measurements and response plans.
Question 173
An audit committee asks for a defensible assessment of this situation: A lender's risk register discusses cyber threats but not customer harm from systematically rejected applications. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Develop use-case-specific scenarios covering people, business process, privacy, safety, security and model behavior.
- Track leading behavior, data-quality and control indicators with thresholds linked to risk appetite.
- Reuse a generic network security risk list and conclude all AI-specific adverse decisions are covered.
- Document inherent versus residual risk using tested control effectiveness and authorized business acceptance.
Explanation
Correct Answer
A:The reason it is necessary is: AI risk assessment must consider intended context and foreseeable misuse, not only traditional IT incidents. Independent audit evidence includes: Review use-case map, stakeholders, failure modes, risk register, impact assumptions and challenge workshops.
Incorrect Answers
B:This option concerns AI risk monitoring through leading KRIs, which is a related but different AI governance concern. The decisive principle here is: AI risk assessment must consider intended context and foreseeable misuse, not only traditional IT incidents.
C:This attractive shortcut does not resolve the AI use-case risk scenario identification weakness: Reuse a generic network security risk list and conclude all AI-specific adverse decisions are covered. In this case: A lender's risk register discusses cyber threats but not customer harm from systematically rejected applications.
D:This option concerns Residual AI risk acceptance and mitigation efficacy, which is a related but different AI governance concern. It does not establish control effectiveness for AI use-case risk scenario identification.
Question 174
During an AI controls assessment, the team learns that a lender's risk register discusses cyber threats but not customer harm from systematically rejected applications. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- AI risk assessment must consider intended context and foreseeable misuse, not only traditional IT incidents.
- Reuse a generic network security risk list and conclude all AI-specific adverse decisions are covered.
- Multiple applications do not diversify AI exposure when they share a single provider or data dependency.
- Data and concept distributions evolve; model performance can decay even when code and infrastructure remain unchanged.
Explanation
Correct Answer
A:Independent audit evidence includes: Review use-case map, stakeholders, failure modes, risk register, impact assumptions and challenge workshops. This is the applicable AI audit principle for AI use-case risk scenario identification: AI risk assessment must consider intended context and foreseeable misuse, not only traditional IT incidents.
Incorrect Answers
B:This attractive shortcut does not resolve the AI use-case risk scenario identification weakness: Reuse a generic network security risk list and conclude all AI-specific adverse decisions are covered. For this situation: A lender's risk register discusses cyber threats but not customer harm from systematically rejected applications.
C:This option concerns Model concentration and systemic vendor dependency, which is a related but different AI governance concern. The decisive principle here is: AI risk assessment must consider intended context and foreseeable misuse, not only traditional IT incidents.
D:This option concerns Concept drift and changing customer behavior, which is a related but different AI governance concern. The decisive principle here is: AI risk assessment must consider intended context and foreseeable misuse, not only traditional IT incidents.
Question 175
An independent AI auditor reviews this case: A lender's risk register discusses cyber threats but not customer harm from systematically rejected applications. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Inspect architecture data flows, attacker capabilities, attack trees, abuse test coverage and limiting controls.
- Review use-case map, stakeholders, failure modes, risk register, impact assumptions and challenge workshops.
- Inspect temporal validation, segment error, data drift, concept labels, release dates and retraining criteria.
- Reuse a generic network security risk list and conclude all AI-specific adverse decisions are covered.
Explanation
Correct Answer
B:The reason it is necessary is: AI risk assessment must consider intended context and foreseeable misuse, not only traditional IT incidents. In this case: A lender's risk register discusses cyber threats but not customer harm from systematically rejected applications.
Incorrect Answers
A:This option concerns Adversarial risk and AI misuse scenarios, which is a related but different AI governance concern. It does not establish control effectiveness for AI use-case risk scenario identification.
C:This option concerns Concept drift and changing customer behavior, which is a related but different AI governance concern. For this situation: A lender's risk register discusses cyber threats but not customer harm from systematically rejected applications.
D:This attractive shortcut does not resolve the AI use-case risk scenario identification weakness: Reuse a generic network security risk list and conclude all AI-specific adverse decisions are covered. Develop use-case-specific scenarios covering people, business process, privacy, safety, security and model behavior.
Question 176
A governance and assurance review uncovers the following: A lender's risk register discusses cyber threats but not customer harm from systematically rejected applications. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Critical decisions continue or fail safely during vendor disruption with documented recovery alternatives.
- Reuse a generic network security risk list and conclude all AI-specific adverse decisions are covered.
- Material plausible failure scenarios have accountable controls, measurements and response plans.
- Residual risk is accepted within appetite or escalated with validated control improvements.
Explanation
Correct Answer
C:The reason it is necessary is: AI risk assessment must consider intended context and foreseeable misuse, not only traditional IT incidents. The acceptable verified outcome is: Material plausible failure scenarios have accountable controls, measurements and response plans.
Incorrect Answers
A:This option concerns Model concentration and systemic vendor dependency, which is a related but different AI governance concern. For this situation: A lender's risk register discusses cyber threats but not customer harm from systematically rejected applications.
B:For this situation: A lender's risk register discusses cyber threats but not customer harm from systematically rejected applications.
D:This option concerns Residual AI risk acceptance and mitigation efficacy, which is a related but different AI governance concern. For this situation: A lender's risk register discusses cyber threats but not customer harm from systematically rejected applications.
Question 177
A risk-based audit engagement examines this operating condition: A city services chatbot identifies service outage risk but excludes misleading advice and inaccurate accessibility assistance. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Document inherent versus residual risk using tested control effectiveness and authorized business acceptance.
- Reuse a generic network security risk list and conclude all AI-specific adverse decisions are covered.
- Quantify common-provider concentration and design alternative operations, exit and service continuity according to risk.
- Develop use-case-specific scenarios covering people, business process, privacy, safety, security and model behavior.
Explanation
Correct Answer
D:The reason it is necessary is: AI risk assessment must consider intended context and foreseeable misuse, not only traditional IT incidents. In this case: A city services chatbot identifies service outage risk but excludes misleading advice and inaccurate accessibility assistance.
Incorrect Answers
A:This option concerns Residual AI risk acceptance and mitigation efficacy, which is a related but different AI governance concern. The decisive principle here is: AI risk assessment must consider intended context and foreseeable misuse, not only traditional IT incidents.
B:This attractive shortcut does not resolve the AI use-case risk scenario identification weakness: Reuse a generic network security risk list and conclude all AI-specific adverse decisions are covered. In this case: A city services chatbot identifies service outage risk but excludes misleading advice and inaccurate accessibility assistance.
C:This option concerns Model concentration and systemic vendor dependency, which is a related but different AI governance concern. In this case: A city services chatbot identifies service outage risk but excludes misleading advice and inaccurate accessibility assistance.
Question 178
An audit committee asks for a defensible assessment of this situation: A city services chatbot identifies service outage risk but excludes misleading advice and inaccurate accessibility assistance. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Risk classification and provider/deployer roles affect obligations; they cannot be assumed from product branding.
- AI risk assessment must consider intended context and foreseeable misuse, not only traditional IT incidents.
- Reuse a generic network security risk list and conclude all AI-specific adverse decisions are covered.
- AI attack surfaces include data, models, prompts, output use and agent capabilities beyond traditional network endpoints.
Explanation
Correct Answer
B:Independent audit evidence includes: Review use-case map, stakeholders, failure modes, risk register, impact assumptions and challenge workshops. In this case: A city services chatbot identifies service outage risk but excludes misleading advice and inaccurate accessibility assistance.
Incorrect Answers
A:This option concerns EU AI Act role and risk classification, which is a related but different AI governance concern. The decisive principle here is: AI risk assessment must consider intended context and foreseeable misuse, not only traditional IT incidents.
C:This attractive shortcut does not resolve the AI use-case risk scenario identification weakness: Reuse a generic network security risk list and conclude all AI-specific adverse decisions are covered. For this situation: A city services chatbot identifies service outage risk but excludes misleading advice and inaccurate accessibility assistance.
D:This option concerns Adversarial risk and AI misuse scenarios, which is a related but different AI governance concern. The decisive principle here is: AI risk assessment must consider intended context and foreseeable misuse, not only traditional IT incidents.
Question 179
During an AI controls assessment, the team learns that a city services chatbot identifies service outage risk but excludes misleading advice and inaccurate accessibility assistance. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Reuse a generic network security risk list and conclude all AI-specific adverse decisions are covered.
- Review use-case map, stakeholders, failure modes, risk register, impact assumptions and challenge workshops.
- Inspect temporal validation, segment error, data drift, concept labels, release dates and retraining criteria.
- Review dependency map, provider incidents, contract exit clauses, portability tests and fallback workflows.
Explanation
Correct Answer
B:This evidence directly tests the asserted control for AI use-case risk scenario identification: Review use-case map, stakeholders, failure modes, risk register, impact assumptions and challenge workshops.
Incorrect Answers
A:For this situation: A city services chatbot identifies service outage risk but excludes misleading advice and inaccurate accessibility assistance.
C:This option concerns Concept drift and changing customer behavior, which is a related but different AI governance concern. In this case: A city services chatbot identifies service outage risk but excludes misleading advice and inaccurate accessibility assistance.
D:This option concerns Model concentration and systemic vendor dependency, which is a related but different AI governance concern. For this situation: A city services chatbot identifies service outage risk but excludes misleading advice and inaccurate accessibility assistance.
Question 180
An independent AI auditor reviews this case: A city services chatbot identifies service outage risk but excludes misleading advice and inaccurate accessibility assistance. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Develop use-case-specific scenarios covering people, business process, privacy, safety, security and model behavior.
- Threat-model model-specific abuse paths, adversary access, safeguards and residual exposure.
- Reuse a generic network security risk list and conclude all AI-specific adverse decisions are covered.
- Review use-case map, stakeholders, failure modes, risk register, impact assumptions and challenge workshops.
- Inspect system purpose, actors, changes, market placement, impact, legal analysis and current phased applicability.
Explanation
Correct Answers
A:The reason it is necessary is: AI risk assessment must consider intended context and foreseeable misuse, not only traditional IT incidents. For this situation: A city services chatbot identifies service outage risk but excludes misleading advice and inaccurate accessibility assistance.
D:The corrective action is: Develop use-case-specific scenarios covering people, business process, privacy, safety, security and model behavior.
Incorrect Answers
B:This option concerns Adversarial risk and AI misuse scenarios, which is a related but different AI governance concern. For this situation: A city services chatbot identifies service outage risk but excludes misleading advice and inaccurate accessibility assistance.
C:It misses the key control principle: AI risk assessment must consider intended context and foreseeable misuse, not only traditional IT incidents.
E:This option concerns EU AI Act role and risk classification, which is a related but different AI governance concern. For this situation: A city services chatbot identifies service outage risk but excludes misleading advice and inaccurate accessibility assistance.
