Isaca AAIA Practice Test 30
Question 290
An independent AI auditor reviews this case: A venue deploys face matching for visitor access without assessing necessity or alternatives. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Assume a strong encryption cipher alone establishes proportionality of invasive biometric collection.
- Conduct a documented impact assessment of purpose, necessity, proportionality, alternatives and safeguards before deployment.
- Assess individual and group impact before deployment, require proportional human intervention and record appeal and remediation processes.
- Inspect data flows, prompt logs, retrieval chunks, masking controls and representative least-data tests.
- Review data categories, stakeholder impacts, alternatives, lawful basis, accuracy and mitigation decisions.
Explanation
Correct Answers
B:The reason it is necessary is: High-impact monitoring of people can cause harm even when encryption and access controls are sound. For this situation: A venue deploys face matching for visitor access without assessing necessity or alternatives.
E:The reason it is necessary is: High-impact monitoring of people can cause harm even when encryption and access controls are sound. In this case: A venue deploys face matching for visitor access without assessing necessity or alternatives.
Incorrect Answers
A:This attractive shortcut does not resolve the Privacy impact assessment for biometric AI weakness: Assume a strong encryption cipher alone establishes proportionality of invasive biometric collection. For this situation: A venue deploys face matching for visitor access without assessing necessity or alternatives.
C:This option concerns Automated decision impact on individuals, which is a related but different AI governance concern. It does not establish control effectiveness for Privacy impact assessment for biometric AI.
D:This option concerns Data minimization and PII in prompts, which is a related but different AI governance concern. For this situation: A venue deploys face matching for visitor access without assessing necessity or alternatives.
Question 291
A governance and assurance review uncovers the following: A venue deploys face matching for visitor access without assessing necessity or alternatives. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Assume a strong encryption cipher alone establishes proportionality of invasive biometric collection.
- Review data categories, stakeholder impacts, alternatives, lawful basis, accuracy and mitigation decisions.
- Inspect data flows, prompt logs, retrieval chunks, masking controls and representative least-data tests.
- Compare justified subgroup metrics, candidate proxies, sampling context, error costs and approved fairness criteria.
Explanation
Correct Answer
B:The reason it is necessary is: High-impact monitoring of people can cause harm even when encryption and access controls are sound. This evidence directly tests the asserted control for Privacy impact assessment for biometric AI: Review data categories, stakeholder impacts, alternatives, lawful basis, accuracy and mitigation decisions.
Incorrect Answers
A:This attractive shortcut does not resolve the Privacy impact assessment for biometric AI weakness: Assume a strong encryption cipher alone establishes proportionality of invasive biometric collection. The auditor should instead examine: Review data categories, stakeholder impacts, alternatives, lawful basis, accuracy and mitigation decisions.
C:This option concerns Data minimization and PII in prompts, which is a related but different AI governance concern. The decisive principle here is: High-impact monitoring of people can cause harm even when encryption and access controls are sound.
D:This option concerns Fairness assessment for proxy discrimination, which is a related but different AI governance concern. It does not establish control effectiveness for Privacy impact assessment for biometric AI.
Question 292
A risk-based audit engagement examines this operating condition: A venue deploys face matching for visitor access without assessing necessity or alternatives. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Validated reduced-data features meet model purpose without exposing unnecessary identities or content.
- Adverse outcomes, challenge rights and corrections are monitored with approved accountable decision owners.
- Use case proceeds only with documented lawful purpose and proportionate risk treatment or is stopped.
- Assume a strong encryption cipher alone establishes proportionality of invasive biometric collection.
Explanation
Correct Answer
C:The reason it is necessary is: High-impact monitoring of people can cause harm even when encryption and access controls are sound. This is an observable validation result for Privacy impact assessment for biometric AI, not just management assurance: Use case proceeds only with documented lawful purpose and proportionate risk treatment or is stopped.
Incorrect Answers
A:This option concerns Privacy by design for model features, which is a related but different AI governance concern. It does not establish control effectiveness for Privacy impact assessment for biometric AI.
B:This option concerns Automated decision impact on individuals, which is a related but different AI governance concern. For this situation: A venue deploys face matching for visitor access without assessing necessity or alternatives.
D:This attractive shortcut does not resolve the Privacy impact assessment for biometric AI weakness: Assume a strong encryption cipher alone establishes proportionality of invasive biometric collection. Effective closure requires: Use case proceeds only with documented lawful purpose and proportionate risk treatment or is stopped.
Question 293
An audit committee asks for a defensible assessment of this situation: A manufacturer monitors worker attention through camera analytics while privacy owners see no impact assessment. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Conduct a documented impact assessment of purpose, necessity, proportionality, alternatives and safeguards before deployment.
- Assume a strong encryption cipher alone establishes proportionality of invasive biometric collection.
- Validate intended secondary use against lawful basis, original purposes and documented governance before training.
- Test whether less identifying features or on-premises transformations satisfy the business purpose.
Explanation
Correct Answer
A:The reason it is necessary is: High-impact monitoring of people can cause harm even when encryption and access controls are sound. In this case: A manufacturer monitors worker attention through camera analytics while privacy owners see no impact assessment.
Incorrect Answers
B:This attractive shortcut does not resolve the Privacy impact assessment for biometric AI weakness: Assume a strong encryption cipher alone establishes proportionality of invasive biometric collection. In this case: A manufacturer monitors worker attention through camera analytics while privacy owners see no impact assessment.
C:This option concerns Purpose limitation in AI training data reuse, which is a related but different AI governance concern. It does not establish control effectiveness for Privacy impact assessment for biometric AI.
D:This option concerns Privacy by design for model features, which is a related but different AI governance concern. The decisive principle here is: High-impact monitoring of people can cause harm even when encryption and access controls are sound.
Question 294
During an AI controls assessment, the team learns that a manufacturer monitors worker attention through camera analytics while privacy owners see no impact assessment. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Assume a strong encryption cipher alone establishes proportionality of invasive biometric collection.
- Removing an explicit sensitive field does not guarantee fairness if correlated inputs and outcomes retain inequity.
- High-impact monitoring of people can cause harm even when encryption and access controls are sound.
- Availability of data inside a company does not imply every new AI training purpose is authorized.
Explanation
Correct Answer
C:The acceptable verified outcome is: Use case proceeds only with documented lawful purpose and proportionate risk treatment or is stopped. This is the applicable AI audit principle for Privacy impact assessment for biometric AI: High-impact monitoring of people can cause harm even when encryption and access controls are sound.
Incorrect Answers
A:This attractive shortcut does not resolve the Privacy impact assessment for biometric AI weakness: Assume a strong encryption cipher alone establishes proportionality of invasive biometric collection. For this situation: A manufacturer monitors worker attention through camera analytics while privacy owners see no impact assessment.
B:This option concerns Fairness assessment for proxy discrimination, which is a related but different AI governance concern. The decisive principle here is: High-impact monitoring of people can cause harm even when encryption and access controls are sound.
D:This option concerns Purpose limitation in AI training data reuse, which is a related but different AI governance concern. For this situation: A manufacturer monitors worker attention through camera analytics while privacy owners see no impact assessment.
Question 295
An independent AI auditor reviews this case: A manufacturer monitors worker attention through camera analytics while privacy owners see no impact assessment. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Inspect region endpoints, service architecture, contractual transfer mechanisms, subprocessor lists and logs.
- Inspect notices, collection purposes, privacy review, access approvals, lineage and training-set membership.
- Review data categories, stakeholder impacts, alternatives, lawful basis, accuracy and mitigation decisions.
- Assume a strong encryption cipher alone establishes proportionality of invasive biometric collection.
Explanation
Correct Answer
C:The reason it is necessary is: High-impact monitoring of people can cause harm even when encryption and access controls are sound. The corrective action is: Conduct a documented impact assessment of purpose, necessity, proportionality, alternatives and safeguards before deployment.
Incorrect Answers
A:This option concerns Cross-border AI data transfer mapping, which is a related but different AI governance concern. The decisive principle here is: High-impact monitoring of people can cause harm even when encryption and access controls are sound.
B:This option concerns Purpose limitation in AI training data reuse, which is a related but different AI governance concern. The decisive principle here is: High-impact monitoring of people can cause harm even when encryption and access controls are sound.
D:This attractive shortcut does not resolve the Privacy impact assessment for biometric AI weakness: Assume a strong encryption cipher alone establishes proportionality of invasive biometric collection. Conduct a documented impact assessment of purpose, necessity, proportionality, alternatives and safeguards before deployment.
Question 296
A governance and assurance review uncovers the following: A manufacturer monitors worker attention through camera analytics while privacy owners see no impact assessment. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Adverse outcomes, challenge rights and corrections are monitored with approved accountable decision owners.
- Deletion requests remove or appropriately constrain applicable copies within documented policy and legal requirements.
- Assume a strong encryption cipher alone establishes proportionality of invasive biometric collection.
- Use case proceeds only with documented lawful purpose and proportionate risk treatment or is stopped.
Explanation
Correct Answer
D:The reason it is necessary is: High-impact monitoring of people can cause harm even when encryption and access controls are sound. Independent audit evidence includes: Review data categories, stakeholder impacts, alternatives, lawful basis, accuracy and mitigation decisions.
Incorrect Answers
A:This option concerns Automated decision impact on individuals, which is a related but different AI governance concern. The decisive principle here is: High-impact monitoring of people can cause harm even when encryption and access controls are sound.
B:This option concerns AI inference retention and right-to-erasure handling, which is a related but different AI governance concern. It does not establish control effectiveness for Privacy impact assessment for biometric AI.
C:For this situation: A manufacturer monitors worker attention through camera analytics while privacy owners see no impact assessment.
Question 297
A risk-based audit engagement examines this operating condition: A campus introduces voice-emotion analytics for counseling appointments without examining false inference and privacy risk. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Assess individual and group impact before deployment, require proportional human intervention and record appeal and remediation processes.
- Assume a strong encryption cipher alone establishes proportionality of invasive biometric collection.
- Validate intended secondary use against lawful basis, original purposes and documented governance before training.
- Conduct a documented impact assessment of purpose, necessity, proportionality, alternatives and safeguards before deployment.
Explanation
Correct Answer
D:The reason it is necessary is: High-impact monitoring of people can cause harm even when encryption and access controls are sound. In this case: A campus introduces voice-emotion analytics for counseling appointments without examining false inference and privacy risk.
Incorrect Answers
A:This option concerns Automated decision impact on individuals, which is a related but different AI governance concern. In this case: A campus introduces voice-emotion analytics for counseling appointments without examining false inference and privacy risk.
B:This attractive shortcut does not resolve the Privacy impact assessment for biometric AI weakness: Assume a strong encryption cipher alone establishes proportionality of invasive biometric collection. In this case: A campus introduces voice-emotion analytics for counseling appointments without examining false inference and privacy risk.
C:This option concerns Purpose limitation in AI training data reuse, which is a related but different AI governance concern. In this case: A campus introduces voice-emotion analytics for counseling appointments without examining false inference and privacy risk.
Question 298
An audit committee asks for a defensible assessment of this situation: A campus introduces voice-emotion analytics for counseling appointments without examining false inference and privacy risk. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Contractual no-training promises do not address independent log retention, indexing or deletion obligations.
- Model prompts, embeddings, logs and training datasets can be transferred even when the front-end appears local.
- Assume a strong encryption cipher alone establishes proportionality of invasive biometric collection.
- High-impact monitoring of people can cause harm even when encryption and access controls are sound.
Explanation
Correct Answer
D:The acceptable verified outcome is: Use case proceeds only with documented lawful purpose and proportionate risk treatment or is stopped. In this case: A campus introduces voice-emotion analytics for counseling appointments without examining false inference and privacy risk.
Incorrect Answers
A:This option concerns AI inference retention and right-to-erasure handling, which is a related but different AI governance concern. The decisive principle here is: High-impact monitoring of people can cause harm even when encryption and access controls are sound.
B:This option concerns Cross-border AI data transfer mapping, which is a related but different AI governance concern. In this case: A campus introduces voice-emotion analytics for counseling appointments without examining false inference and privacy risk.
C:This attractive shortcut does not resolve the Privacy impact assessment for biometric AI weakness: Assume a strong encryption cipher alone establishes proportionality of invasive biometric collection. For this situation: A campus introduces voice-emotion analytics for counseling appointments without examining false inference and privacy risk.
Question 299
During an AI controls assessment, the team learns that a campus introduces voice-emotion analytics for counseling appointments without examining false inference and privacy risk. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Inspect provider terms, retention schedules, index lifecycle, backups, deletion tickets and test identifiers.
- Review data categories, stakeholder impacts, alternatives, lawful basis, accuracy and mitigation decisions.
- Inspect notices, collection purposes, privacy review, access approvals, lineage and training-set membership.
- Assume a strong encryption cipher alone establishes proportionality of invasive biometric collection.
Explanation
Correct Answer
B:The acceptable verified outcome is: Use case proceeds only with documented lawful purpose and proportionate risk treatment or is stopped.
Incorrect Answers
A:This option concerns AI inference retention and right-to-erasure handling, which is a related but different AI governance concern. For this situation: A campus introduces voice-emotion analytics for counseling appointments without examining false inference and privacy risk.
C:This option concerns Purpose limitation in AI training data reuse, which is a related but different AI governance concern. For this situation: A campus introduces voice-emotion analytics for counseling appointments without examining false inference and privacy risk.
D:For this situation: A campus introduces voice-emotion analytics for counseling appointments without examining false inference and privacy risk.
Question 300
An independent AI auditor reviews this case: A campus introduces voice-emotion analytics for counseling appointments without examining false inference and privacy risk. Which THREE elements together provide a defensible AI audit conclusion: the corrective control, the evidence to test it, and a verified outcome? Select THREE answers.
- Inspect data flows, prompt logs, retrieval chunks, masking controls and representative least-data tests.
- Test whether less identifying features or on-premises transformations satisfy the business purpose.
- Assume a strong encryption cipher alone establishes proportionality of invasive biometric collection.
- Conduct a documented impact assessment of purpose, necessity, proportionality, alternatives and safeguards before deployment.
- Review data categories, stakeholder impacts, alternatives, lawful basis, accuracy and mitigation decisions.
- Use case proceeds only with documented lawful purpose and proportionate risk treatment or is stopped.
Explanation
Correct Answers
D:The reason it is necessary is: High-impact monitoring of people can cause harm even when encryption and access controls are sound. For this situation: A campus introduces voice-emotion analytics for counseling appointments without examining false inference and privacy risk.
E:This evidence directly tests the asserted control for Privacy impact assessment for biometric AI: Review data categories, stakeholder impacts, alternatives, lawful basis, accuracy and mitigation decisions.
F:This is an observable validation result for Privacy impact assessment for biometric AI, not just management assurance: Use case proceeds only with documented lawful purpose and proportionate risk treatment or is stopped.
Incorrect Answers
A:This option concerns Data minimization and PII in prompts, which is a related but different AI governance concern. In this case: A campus introduces voice-emotion analytics for counseling appointments without examining false inference and privacy risk.
B:This option concerns Privacy by design for model features, which is a related but different AI governance concern. In this case: A campus introduces voice-emotion analytics for counseling appointments without examining false inference and privacy risk.
C:It misses the key control principle: High-impact monitoring of people can cause harm even when encryption and access controls are sound.
