Isaca AAIA Practice Test 24
Question 230
An independent AI auditor reviews this case: Three banking business units adopt the same upstream AI API and lose service during one provider outage. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Quantify common-provider concentration and design alternative operations, exit and service continuity according to risk.
- Inspect architecture data flows, attacker capabilities, attack trees, abuse test coverage and limiting controls.
- Track leading behavior, data-quality and control indicators with thresholds linked to risk appetite.
- Review dependency map, provider incidents, contract exit clauses, portability tests and fallback workflows.
- Count different application names as provider diversification while ignoring their common model backend.
Explanation
Correct Answers
A:The reason it is necessary is: Multiple applications do not diversify AI exposure when they share a single provider or data dependency. This response fits the risk associated with Model concentration and systemic vendor dependency: Quantify common-provider concentration and design alternative operations, exit and service continuity according to risk.
D:The reason it is necessary is: Multiple applications do not diversify AI exposure when they share a single provider or data dependency. The corrective action is: Quantify common-provider concentration and design alternative operations, exit and service continuity according to risk.
Incorrect Answers
B:This option concerns Adversarial risk and AI misuse scenarios, which is a related but different AI governance concern. It does not establish control effectiveness for Model concentration and systemic vendor dependency.
C:This option concerns AI risk monitoring through leading KRIs, which is a related but different AI governance concern. The decisive principle here is: Multiple applications do not diversify AI exposure when they share a single provider or data dependency.
E:This attractive shortcut does not resolve the Model concentration and systemic vendor dependency weakness: Count different application names as provider diversification while ignoring their common model backend. For this situation: Three banking business units adopt the same upstream AI API and lose service during one provider outage.
Question 231
A governance and assurance review uncovers the following: Three banking business units adopt the same upstream AI API and lose service during one provider outage. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Compare feature necessity, identifiability, model utility, transformation design and data retention.
- Compare justified subgroup metrics, candidate proxies, sampling context, error costs and approved fairness criteria.
- Review dependency map, provider incidents, contract exit clauses, portability tests and fallback workflows.
- Count different application names as provider diversification while ignoring their common model backend.
Explanation
Correct Answer
C:The reason it is necessary is: Multiple applications do not diversify AI exposure when they share a single provider or data dependency. For this situation: Three banking business units adopt the same upstream AI API and lose service during one provider outage.
Incorrect Answers
A:This option concerns Privacy by design for model features, which is a related but different AI governance concern. It does not establish control effectiveness for Model concentration and systemic vendor dependency.
B:This option concerns Fairness assessment for proxy discrimination, which is a related but different AI governance concern. The decisive principle here is: Multiple applications do not diversify AI exposure when they share a single provider or data dependency.
D:This attractive shortcut does not resolve the Model concentration and systemic vendor dependency weakness: Count different application names as provider diversification while ignoring their common model backend. The auditor should instead examine: Review dependency map, provider incidents, contract exit clauses, portability tests and fallback workflows.
Question 232
A risk-based audit engagement examines this operating condition: Three banking business units adopt the same upstream AI API and lose service during one provider outage. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Critical decisions continue or fail safely during vendor disruption with documented recovery alternatives.
- Risk register and tests cover plausible exploitation paths, and high-impact gaps are prioritized.
- Fairness monitoring detects problematic disparities and remediation does not conceal residual performance impacts.
- Count different application names as provider diversification while ignoring their common model backend.
Explanation
Correct Answer
A:The reason it is necessary is: Multiple applications do not diversify AI exposure when they share a single provider or data dependency. This is an observable validation result for Model concentration and systemic vendor dependency, not just management assurance: Critical decisions continue or fail safely during vendor disruption with documented recovery alternatives.
Incorrect Answers
B:This option concerns Adversarial risk and AI misuse scenarios, which is a related but different AI governance concern. The decisive principle here is: Multiple applications do not diversify AI exposure when they share a single provider or data dependency.
C:This option concerns Fairness assessment for proxy discrimination, which is a related but different AI governance concern. For this situation: Three banking business units adopt the same upstream AI API and lose service during one provider outage.
D:This attractive shortcut does not resolve the Model concentration and systemic vendor dependency weakness: Count different application names as provider diversification while ignoring their common model backend. Quantify common-provider concentration and design alternative operations, exit and service continuity according to risk.
Question 233
An audit committee asks for a defensible assessment of this situation: Two insurers claim independent models but both depend on the same foundation-model supplier's risk-scoring endpoint. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Count different application names as provider diversification while ignoring their common model backend.
- Document inherent versus residual risk using tested control effectiveness and authorized business acceptance.
- Quantify common-provider concentration and design alternative operations, exit and service continuity according to risk.
- Assess subgroup outcomes, proxy variables, relevant legitimate factors and mitigations with lawful context.
Explanation
Correct Answer
C:The reason it is necessary is: Multiple applications do not diversify AI exposure when they share a single provider or data dependency. In this case: Two insurers claim independent models but both depend on the same foundation-model supplier's risk-scoring endpoint.
Incorrect Answers
A:This attractive shortcut does not resolve the Model concentration and systemic vendor dependency weakness: Count different application names as provider diversification while ignoring their common model backend. In this case: Two insurers claim independent models but both depend on the same foundation-model supplier's risk-scoring endpoint.
B:This option concerns Residual AI risk acceptance and mitigation efficacy, which is a related but different AI governance concern. It does not establish control effectiveness for Model concentration and systemic vendor dependency.
D:This option concerns Fairness assessment for proxy discrimination, which is a related but different AI governance concern. In this case: Two insurers claim independent models but both depend on the same foundation-model supplier's risk-scoring endpoint.
Question 234
During an AI controls assessment, the team learns that two insurers claim independent models but both depend on the same foundation-model supplier's risk-scoring endpoint. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Lagging incident counts can miss emerging model failure that leading indicators could reveal earlier.
- Data and concept distributions evolve; model performance can decay even when code and infrastructure remain unchanged.
- Count different application names as provider diversification while ignoring their common model backend.
- Multiple applications do not diversify AI exposure when they share a single provider or data dependency.
Explanation
Correct Answer
D:The corrective action is: Quantify common-provider concentration and design alternative operations, exit and service continuity according to risk. This is the applicable AI audit principle for Model concentration and systemic vendor dependency: Multiple applications do not diversify AI exposure when they share a single provider or data dependency.
Incorrect Answers
A:This option concerns AI risk monitoring through leading KRIs, which is a related but different AI governance concern. In this case: Two insurers claim independent models but both depend on the same foundation-model supplier's risk-scoring endpoint.
B:This option concerns Concept drift and changing customer behavior, which is a related but different AI governance concern. It does not establish control effectiveness for Model concentration and systemic vendor dependency.
C:This attractive shortcut does not resolve the Model concentration and systemic vendor dependency weakness: Count different application names as provider diversification while ignoring their common model backend. For this situation: Two insurers claim independent models but both depend on the same foundation-model supplier's risk-scoring endpoint.
Question 235
An independent AI auditor reviews this case: Two insurers claim independent models but both depend on the same foundation-model supplier's risk-scoring endpoint. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Compare feature necessity, identifiability, model utility, transformation design and data retention.
- Count different application names as provider diversification while ignoring their common model backend.
- Review dependency map, provider incidents, contract exit clauses, portability tests and fallback workflows.
- Review use-case map, stakeholders, failure modes, risk register, impact assumptions and challenge workshops.
Explanation
Correct Answer
C:The reason it is necessary is: Multiple applications do not diversify AI exposure when they share a single provider or data dependency. This evidence directly tests the asserted control for Model concentration and systemic vendor dependency: Review dependency map, provider incidents, contract exit clauses, portability tests and fallback workflows.
Incorrect Answers
A:This option concerns Privacy by design for model features, which is a related but different AI governance concern. The decisive principle here is: Multiple applications do not diversify AI exposure when they share a single provider or data dependency.
B:This attractive shortcut does not resolve the Model concentration and systemic vendor dependency weakness: Count different application names as provider diversification while ignoring their common model backend. Effective closure requires: Critical decisions continue or fail safely during vendor disruption with documented recovery alternatives.
D:This option concerns AI use-case risk scenario identification, which is a related but different AI governance concern. It does not establish control effectiveness for Model concentration and systemic vendor dependency.
Question 236
A governance and assurance review uncovers the following: Two insurers claim independent models but both depend on the same foundation-model supplier's risk-scoring endpoint. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Critical decisions continue or fail safely during vendor disruption with documented recovery alternatives.
- Fairness monitoring detects problematic disparities and remediation does not conceal residual performance impacts.
- Drift alerts trigger timely review and validated model changes without uncontrolled retraining.
- Count different application names as provider diversification while ignoring their common model backend.
Explanation
Correct Answer
A:The reason it is necessary is: Multiple applications do not diversify AI exposure when they share a single provider or data dependency. Independent audit evidence includes: Review dependency map, provider incidents, contract exit clauses, portability tests and fallback workflows.
Incorrect Answers
B:This option concerns Fairness assessment for proxy discrimination, which is a related but different AI governance concern. For this situation: Two insurers claim independent models but both depend on the same foundation-model supplier's risk-scoring endpoint.
C:This option concerns Concept drift and changing customer behavior, which is a related but different AI governance concern. For this situation: Two insurers claim independent models but both depend on the same foundation-model supplier's risk-scoring endpoint.
D:For this situation: Two insurers claim independent models but both depend on the same foundation-model supplier's risk-scoring endpoint.
Question 237
A risk-based audit engagement examines this operating condition: A public agency cannot move its model after an external provider changes terms because prompts and logs are stored in proprietary formats. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Count different application names as provider diversification while ignoring their common model backend.
- Document inherent versus residual risk using tested control effectiveness and authorized business acceptance.
- Quantify common-provider concentration and design alternative operations, exit and service continuity according to risk.
- Develop use-case-specific scenarios covering people, business process, privacy, safety, security and model behavior.
Explanation
Correct Answer
C:The reason it is necessary is: Multiple applications do not diversify AI exposure when they share a single provider or data dependency. In this case: A public agency cannot move its model after an external provider changes terms because prompts and logs are stored in proprietary formats.
Incorrect Answers
A:This attractive shortcut does not resolve the Model concentration and systemic vendor dependency weakness: Count different application names as provider diversification while ignoring their common model backend. In this case: A public agency cannot move its model after an external provider changes terms because prompts and logs are stored in proprietary formats.
B:This option concerns Residual AI risk acceptance and mitigation efficacy, which is a related but different AI governance concern. The decisive principle here is: Multiple applications do not diversify AI exposure when they share a single provider or data dependency.
D:This option concerns AI use-case risk scenario identification, which is a related but different AI governance concern. The decisive principle here is: Multiple applications do not diversify AI exposure when they share a single provider or data dependency.
Question 238
An audit committee asks for a defensible assessment of this situation: A public agency cannot move its model after an external provider changes terms because prompts and logs are stored in proprietary formats. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Mitigation exists only when control performance reduces measured exposure; a planned action is not risk reduction.
- Multiple applications do not diversify AI exposure when they share a single provider or data dependency.
- Lagging incident counts can miss emerging model failure that leading indicators could reveal earlier.
- Count different application names as provider diversification while ignoring their common model backend.
Explanation
Correct Answer
B:The corrective action is: Quantify common-provider concentration and design alternative operations, exit and service continuity according to risk. In this case: A public agency cannot move its model after an external provider changes terms because prompts and logs are stored in proprietary formats.
Incorrect Answers
A:This option concerns Residual AI risk acceptance and mitigation efficacy, which is a related but different AI governance concern. For this situation: A public agency cannot move its model after an external provider changes terms because prompts and logs are stored in proprietary formats.
C:This option concerns AI risk monitoring through leading KRIs, which is a related but different AI governance concern. In this case: A public agency cannot move its model after an external provider changes terms because prompts and logs are stored in proprietary formats.
D:This attractive shortcut does not resolve the Model concentration and systemic vendor dependency weakness: Count different application names as provider diversification while ignoring their common model backend. For this situation: A public agency cannot move its model after an external provider changes terms because prompts and logs are stored in proprietary formats.
Question 239
During an AI controls assessment, the team learns that a public agency cannot move its model after an external provider changes terms because prompts and logs are stored in proprietary formats. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Review dependency map, provider incidents, contract exit clauses, portability tests and fallback workflows.
- Review use-case map, stakeholders, failure modes, risk register, impact assumptions and challenge workshops.
- Count different application names as provider diversification while ignoring their common model backend.
- Inspect architecture data flows, attacker capabilities, attack trees, abuse test coverage and limiting controls.
Explanation
Correct Answer
A:The reason it is necessary is: Multiple applications do not diversify AI exposure when they share a single provider or data dependency. The acceptable verified outcome is: Critical decisions continue or fail safely during vendor disruption with documented recovery alternatives.
Incorrect Answers
B:This option concerns AI use-case risk scenario identification, which is a related but different AI governance concern. For this situation: A public agency cannot move its model after an external provider changes terms because prompts and logs are stored in proprietary formats.
C:For this situation: A public agency cannot move its model after an external provider changes terms because prompts and logs are stored in proprietary formats.
D:This option concerns Adversarial risk and AI misuse scenarios, which is a related but different AI governance concern. In this case: A public agency cannot move its model after an external provider changes terms because prompts and logs are stored in proprietary formats.
Question 240
An independent AI auditor reviews this case: A public agency cannot move its model after an external provider changes terms because prompts and logs are stored in proprietary formats. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Test whether less identifying features or on-premises transformations satisfy the business purpose.
- Count different application names as provider diversification while ignoring their common model backend.
- Review dependency map, provider incidents, contract exit clauses, portability tests and fallback workflows.
- Inspect monitoring design, owners, thresholds, near-misses, drift and documented actions for breaches.
- Quantify common-provider concentration and design alternative operations, exit and service continuity according to risk.
Explanation
Correct Answers
C:The reason it is necessary is: Multiple applications do not diversify AI exposure when they share a single provider or data dependency. For this situation: A public agency cannot move its model after an external provider changes terms because prompts and logs are stored in proprietary formats.
E:This response fits the risk associated with Model concentration and systemic vendor dependency: Quantify common-provider concentration and design alternative operations, exit and service continuity according to risk.
Incorrect Answers
A:This option concerns Privacy by design for model features, which is a related but different AI governance concern. In this case: A public agency cannot move its model after an external provider changes terms because prompts and logs are stored in proprietary formats.
B:It misses the key control principle: Multiple applications do not diversify AI exposure when they share a single provider or data dependency.
D:This option concerns AI risk monitoring through leading KRIs, which is a related but different AI governance concern. For this situation: A public agency cannot move its model after an external provider changes terms because prompts and logs are stored in proprietary formats.
