Isaca AAIA Practice Test 23
Question 220
An independent AI auditor reviews this case: A public model endpoint allows repeated probing but the threat register ignores model extraction and membership inference. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Inspect architecture data flows, attacker capabilities, attack trees, abuse test coverage and limiting controls.
- Track leading behavior, data-quality and control indicators with thresholds linked to risk appetite.
- Inspect initial impact, treatment choice, operating tests, risk acceptance authority and current residual metrics.
- Threat-model model-specific abuse paths, adversary access, safeguards and residual exposure.
- Assume ordinary perimeter firewalls address all adversarial manipulation of training and inference.
Explanation
Correct Answers
A:The acceptable verified outcome is: Risk register and tests cover plausible exploitation paths, and high-impact gaps are prioritized. For this situation: A public model endpoint allows repeated probing but the threat register ignores model extraction and membership inference.
D:The acceptable verified outcome is: Risk register and tests cover plausible exploitation paths, and high-impact gaps are prioritized. This response fits the risk associated with Adversarial risk and AI misuse scenarios: Threat-model model-specific abuse paths, adversary access, safeguards and residual exposure.
Incorrect Answers
B:This option concerns AI risk monitoring through leading KRIs, which is a related but different AI governance concern. It does not establish control effectiveness for Adversarial risk and AI misuse scenarios.
C:This option concerns Residual AI risk acceptance and mitigation efficacy, which is a related but different AI governance concern. For this situation: A public model endpoint allows repeated probing but the threat register ignores model extraction and membership inference.
E:This attractive shortcut does not resolve the Adversarial risk and AI misuse scenarios weakness: Assume ordinary perimeter firewalls address all adversarial manipulation of training and inference. The auditor should instead examine: Inspect architecture data flows, attacker capabilities, attack trees, abuse test coverage and limiting controls.
Question 221
A governance and assurance review uncovers the following: A retrieval assistant is allowed to execute financial tools although no misuse scenarios consider forged retrieved instructions. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Develop use-case-specific scenarios covering people, business process, privacy, safety, security and model behavior.
- Threat-model model-specific abuse paths, adversary access, safeguards and residual exposure.
- Define drift indicators and use-case-specific revalidation triggers with approved mitigation decisions.
- Assume ordinary perimeter firewalls address all adversarial manipulation of training and inference.
Explanation
Correct Answer
B:The acceptable verified outcome is: Risk register and tests cover plausible exploitation paths, and high-impact gaps are prioritized. The reason it is necessary is: AI attack surfaces include data, models, prompts, output use and agent capabilities beyond traditional network endpoints.
Incorrect Answers
A:This option concerns AI use-case risk scenario identification, which is a related but different AI governance concern. The audit must corroborate: Inspect architecture data flows, attacker capabilities, attack trees, abuse test coverage and limiting controls.
C:This option concerns Concept drift and changing customer behavior, which is a related but different AI governance concern. The decisive principle here is: AI attack surfaces include data, models, prompts, output use and agent capabilities beyond traditional network endpoints.
D:This attractive shortcut does not resolve the Adversarial risk and AI misuse scenarios weakness: Assume ordinary perimeter firewalls address all adversarial manipulation of training and inference. Effective closure requires: Risk register and tests cover plausible exploitation paths, and high-impact gaps are prioritized.
Question 222
A risk-based audit engagement examines this operating condition: A retrieval assistant is allowed to execute financial tools although no misuse scenarios consider forged retrieved instructions. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Data and concept distributions evolve; model performance can decay even when code and infrastructure remain unchanged.
- AI attack surfaces include data, models, prompts, output use and agent capabilities beyond traditional network endpoints.
- AI risk assessment must consider intended context and foreseeable misuse, not only traditional IT incidents.
- Assume ordinary perimeter firewalls address all adversarial manipulation of training and inference.
Explanation
Correct Answer
B:The acceptable verified outcome is: Risk register and tests cover plausible exploitation paths, and high-impact gaps are prioritized. Independent audit evidence includes: Inspect architecture data flows, attacker capabilities, attack trees, abuse test coverage and limiting controls.
Incorrect Answers
A:This option concerns Concept drift and changing customer behavior, which is a related but different AI governance concern. For this situation: A retrieval assistant is allowed to execute financial tools although no misuse scenarios consider forged retrieved instructions.
C:This option concerns AI use-case risk scenario identification, which is a related but different AI governance concern. For this situation: A retrieval assistant is allowed to execute financial tools although no misuse scenarios consider forged retrieved instructions.
D:This attractive shortcut does not resolve the Adversarial risk and AI misuse scenarios weakness: Assume ordinary perimeter firewalls address all adversarial manipulation of training and inference. For this situation: A retrieval assistant is allowed to execute financial tools although no misuse scenarios consider forged retrieved instructions.
Question 223
An audit committee asks for a defensible assessment of this situation: A retrieval assistant is allowed to execute financial tools although no misuse scenarios consider forged retrieved instructions. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Assume ordinary perimeter firewalls address all adversarial manipulation of training and inference.
- Inspect system purpose, actors, changes, market placement, impact, legal analysis and current phased applicability.
- Inspect architecture data flows, attacker capabilities, attack trees, abuse test coverage and limiting controls.
- Inspect initial impact, treatment choice, operating tests, risk acceptance authority and current residual metrics.
Explanation
Correct Answer
C:The acceptable verified outcome is: Risk register and tests cover plausible exploitation paths, and high-impact gaps are prioritized. The corrective action is: Threat-model model-specific abuse paths, adversary access, safeguards and residual exposure.
Incorrect Answers
A:This attractive shortcut does not resolve the Adversarial risk and AI misuse scenarios weakness: Assume ordinary perimeter firewalls address all adversarial manipulation of training and inference. Threat-model model-specific abuse paths, adversary access, safeguards and residual exposure.
B:This option concerns EU AI Act role and risk classification, which is a related but different AI governance concern. It does not establish control effectiveness for Adversarial risk and AI misuse scenarios.
D:This option concerns Residual AI risk acceptance and mitigation efficacy, which is a related but different AI governance concern. The decisive principle here is: AI attack surfaces include data, models, prompts, output use and agent capabilities beyond traditional network endpoints.
Question 224
During an AI controls assessment, the team learns that a retrieval assistant is allowed to execute financial tools although no misuse scenarios consider forged retrieved instructions. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Assume ordinary perimeter firewalls address all adversarial manipulation of training and inference.
- Residual risk is accepted within appetite or escalated with validated control improvements.
- Fairness monitoring detects problematic disparities and remediation does not conceal residual performance impacts.
- Risk register and tests cover plausible exploitation paths, and high-impact gaps are prioritized.
Explanation
Correct Answer
D:The reason it is necessary is: AI attack surfaces include data, models, prompts, output use and agent capabilities beyond traditional network endpoints. This is an observable validation result for Adversarial risk and AI misuse scenarios, not just management assurance: Risk register and tests cover plausible exploitation paths, and high-impact gaps are prioritized.
Incorrect Answers
A:For this situation: A retrieval assistant is allowed to execute financial tools although no misuse scenarios consider forged retrieved instructions.
B:This option concerns Residual AI risk acceptance and mitigation efficacy, which is a related but different AI governance concern. For this situation: A retrieval assistant is allowed to execute financial tools although no misuse scenarios consider forged retrieved instructions.
C:This option concerns Fairness assessment for proxy discrimination, which is a related but different AI governance concern. It does not establish control effectiveness for Adversarial risk and AI misuse scenarios.
Question 225
An independent AI auditor reviews this case: A prediction service accepts third-party CSV updates and the risk assessment overlooks contaminated training labels. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Assume ordinary perimeter firewalls address all adversarial manipulation of training and inference.
- Define drift indicators and use-case-specific revalidation triggers with approved mitigation decisions.
- Identify relevant AI Act roles, use-case classifications, jurisdictions and applicable obligations with competent legal input.
- Threat-model model-specific abuse paths, adversary access, safeguards and residual exposure.
Explanation
Correct Answer
D:The acceptable verified outcome is: Risk register and tests cover plausible exploitation paths, and high-impact gaps are prioritized. In this case: A prediction service accepts third-party CSV updates and the risk assessment overlooks contaminated training labels.
Incorrect Answers
A:This attractive shortcut does not resolve the Adversarial risk and AI misuse scenarios weakness: Assume ordinary perimeter firewalls address all adversarial manipulation of training and inference. In this case: A prediction service accepts third-party CSV updates and the risk assessment overlooks contaminated training labels.
B:This option concerns Concept drift and changing customer behavior, which is a related but different AI governance concern. In this case: A prediction service accepts third-party CSV updates and the risk assessment overlooks contaminated training labels.
C:This option concerns EU AI Act role and risk classification, which is a related but different AI governance concern. In this case: A prediction service accepts third-party CSV updates and the risk assessment overlooks contaminated training labels.
Question 226
A governance and assurance review uncovers the following: A prediction service accepts third-party CSV updates and the risk assessment overlooks contaminated training labels. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Data and concept distributions evolve; model performance can decay even when code and infrastructure remain unchanged.
- Assume ordinary perimeter firewalls address all adversarial manipulation of training and inference.
- Risk classification and provider/deployer roles affect obligations; they cannot be assumed from product branding.
- AI attack surfaces include data, models, prompts, output use and agent capabilities beyond traditional network endpoints.
Explanation
Correct Answer
D:This is the applicable AI audit principle for Adversarial risk and AI misuse scenarios: AI attack surfaces include data, models, prompts, output use and agent capabilities beyond traditional network endpoints.
Incorrect Answers
A:This option concerns Concept drift and changing customer behavior, which is a related but different AI governance concern. For this situation: A prediction service accepts third-party CSV updates and the risk assessment overlooks contaminated training labels.
B:This attractive shortcut does not resolve the Adversarial risk and AI misuse scenarios weakness: Assume ordinary perimeter firewalls address all adversarial manipulation of training and inference. For this situation: A prediction service accepts third-party CSV updates and the risk assessment overlooks contaminated training labels.
C:This option concerns EU AI Act role and risk classification, which is a related but different AI governance concern. For this situation: A prediction service accepts third-party CSV updates and the risk assessment overlooks contaminated training labels.
Question 227
A risk-based audit engagement examines this operating condition: A prediction service accepts third-party CSV updates and the risk assessment overlooks contaminated training labels. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Assume ordinary perimeter firewalls address all adversarial manipulation of training and inference.
- Inspect monitoring design, owners, thresholds, near-misses, drift and documented actions for breaches.
- Inspect initial impact, treatment choice, operating tests, risk acceptance authority and current residual metrics.
- Inspect architecture data flows, attacker capabilities, attack trees, abuse test coverage and limiting controls.
Explanation
Correct Answer
D:This evidence directly tests the asserted control for Adversarial risk and AI misuse scenarios: Inspect architecture data flows, attacker capabilities, attack trees, abuse test coverage and limiting controls.
Incorrect Answers
A:For this situation: A prediction service accepts third-party CSV updates and the risk assessment overlooks contaminated training labels.
B:This option concerns AI risk monitoring through leading KRIs, which is a related but different AI governance concern. In this case: A prediction service accepts third-party CSV updates and the risk assessment overlooks contaminated training labels.
C:This option concerns Residual AI risk acceptance and mitigation efficacy, which is a related but different AI governance concern. In this case: A prediction service accepts third-party CSV updates and the risk assessment overlooks contaminated training labels.
Question 228
An audit committee asks for a defensible assessment of this situation: A prediction service accepts third-party CSV updates and the risk assessment overlooks contaminated training labels. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Risk register and tests cover plausible exploitation paths, and high-impact gaps are prioritized.
- Assume ordinary perimeter firewalls address all adversarial manipulation of training and inference.
- Fairness monitoring detects problematic disparities and remediation does not conceal residual performance impacts.
- Sampled denials have faithful understandable reasons, reliable escalation and documented accuracy versus simpler alternatives.
Explanation
Correct Answer
A:The reason it is necessary is: AI attack surfaces include data, models, prompts, output use and agent capabilities beyond traditional network endpoints. In this case: A prediction service accepts third-party CSV updates and the risk assessment overlooks contaminated training labels.
Incorrect Answers
B:It misses the key control principle: AI attack surfaces include data, models, prompts, output use and agent capabilities beyond traditional network endpoints.
C:This option concerns Fairness assessment for proxy discrimination, which is a related but different AI governance concern. In this case: A prediction service accepts third-party CSV updates and the risk assessment overlooks contaminated training labels.
D:This option concerns Explainable credit-model selection for adverse decisions, which is a related but different AI governance concern. It does not establish control effectiveness for Adversarial risk and AI misuse scenarios.
Question 229
During an AI controls assessment, the team learns that three banking business units adopt the same upstream AI API and lose service during one provider outage. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Track leading behavior, data-quality and control indicators with thresholds linked to risk appetite.
- Count different application names as provider diversification while ignoring their common model backend.
- Quantify common-provider concentration and design alternative operations, exit and service continuity according to risk.
- Assess subgroup outcomes, proxy variables, relevant legitimate factors and mitigations with lawful context.
Explanation
Correct Answer
C:The reason it is necessary is: Multiple applications do not diversify AI exposure when they share a single provider or data dependency. This is the proportionate control response to Model concentration and systemic vendor dependency: Quantify common-provider concentration and design alternative operations, exit and service continuity according to risk.
Incorrect Answers
A:This option concerns AI risk monitoring through leading KRIs, which is a related but different AI governance concern. It does not establish control effectiveness for Model concentration and systemic vendor dependency.
B:This attractive shortcut does not resolve the Model concentration and systemic vendor dependency weakness: Count different application names as provider diversification while ignoring their common model backend.
D:This option concerns Fairness assessment for proxy discrimination, which is a related but different AI governance concern. It does not establish control effectiveness for Model concentration and systemic vendor dependency.
Question 230
An independent AI auditor reviews this case: Three banking business units adopt the same upstream AI API and lose service during one provider outage. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Quantify common-provider concentration and design alternative operations, exit and service continuity according to risk.
- Inspect architecture data flows, attacker capabilities, attack trees, abuse test coverage and limiting controls.
- Track leading behavior, data-quality and control indicators with thresholds linked to risk appetite.
- Review dependency map, provider incidents, contract exit clauses, portability tests and fallback workflows.
- Count different application names as provider diversification while ignoring their common model backend.
Explanation
Correct Answers
A:The reason it is necessary is: Multiple applications do not diversify AI exposure when they share a single provider or data dependency. This response fits the risk associated with Model concentration and systemic vendor dependency: Quantify common-provider concentration and design alternative operations, exit and service continuity according to risk.
D:The reason it is necessary is: Multiple applications do not diversify AI exposure when they share a single provider or data dependency. The corrective action is: Quantify common-provider concentration and design alternative operations, exit and service continuity according to risk.
Incorrect Answers
B:This option concerns Adversarial risk and AI misuse scenarios, which is a related but different AI governance concern. It does not establish control effectiveness for Model concentration and systemic vendor dependency.
C:This option concerns AI risk monitoring through leading KRIs, which is a related but different AI governance concern. The decisive principle here is: Multiple applications do not diversify AI exposure when they share a single provider or data dependency.
E:This attractive shortcut does not resolve the Model concentration and systemic vendor dependency weakness: Count different application names as provider diversification while ignoring their common model backend. For this situation: Three banking business units adopt the same upstream AI API and lose service during one provider outage.
