Isaca AAIA Practice Test 36
Question 350
An independent AI auditor reviews this case: A SaaS seller and a corporate deployer both assume the other owns all AI Act obligations for a recruiting model. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Inspect system purpose, actors, changes, market placement, impact, legal analysis and current phased applicability.
- Identify relevant AI Act roles, use-case classifications, jurisdictions and applicable obligations with competent legal input.
- Inspect AI inventory, contextual risk register, model evaluations, management treatment and oversight minutes.
- Assess contextual transparency duties, affected audiences and effective disclosure mechanisms appropriate to use.
- Assume every AI application is low-risk or that buying a model eliminates deployer responsibilities.
Explanation
Correct Answers
A:The reason it is necessary is: Risk classification and provider/deployer roles affect obligations; they cannot be assumed from product branding. This evidence directly tests the asserted control for EU AI Act role and risk classification: Inspect system purpose, actors, changes, market placement, impact, legal analysis and current phased applicability.
B:The reason it is necessary is: Risk classification and provider/deployer roles affect obligations; they cannot be assumed from product branding. This response fits the risk associated with EU AI Act role and risk classification: Identify relevant AI Act roles, use-case classifications, jurisdictions and applicable obligations with competent legal input.
Incorrect Answers
C:This option concerns NIST AI RMF governance and measurement alignment, which is a related but different AI governance concern. The decisive principle here is: Risk classification and provider/deployer roles affect obligations; they cannot be assumed from product branding.
D:This option concerns AI transparency and meaningful disclosure, which is a related but different AI governance concern. It does not establish control effectiveness for EU AI Act role and risk classification.
E:This attractive shortcut does not resolve the EU AI Act role and risk classification weakness: Assume every AI application is low-risk or that buying a model eliminates deployer responsibilities. The auditor should instead examine: Inspect system purpose, actors, changes, market placement, impact, legal analysis and current phased applicability.
Question 351
A governance and assurance review uncovers the following: A SaaS seller and a corporate deployer both assume the other owns all AI Act obligations for a recruiting model. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Inspect system purpose, actors, changes, market placement, impact, legal analysis and current phased applicability.
- Assume every AI application is low-risk or that buying a model eliminates deployer responsibilities.
- Inspect architecture data flows, attacker capabilities, attack trees, abuse test coverage and limiting controls.
- Inspect AI inventory, contextual risk register, model evaluations, management treatment and oversight minutes.
Explanation
Correct Answer
A:The reason it is necessary is: Risk classification and provider/deployer roles affect obligations; they cannot be assumed from product branding. The acceptable verified outcome is: Organization documents role-specific obligations and controls for its actual use and checks changes over time.
Incorrect Answers
B:This attractive shortcut does not resolve the EU AI Act role and risk classification weakness: Assume every AI application is low-risk or that buying a model eliminates deployer responsibilities. For this situation: A SaaS seller and a corporate deployer both assume the other owns all AI Act obligations for a recruiting model.
C:This option concerns Adversarial risk and AI misuse scenarios, which is a related but different AI governance concern. It does not establish control effectiveness for EU AI Act role and risk classification.
D:This option concerns NIST AI RMF governance and measurement alignment, which is a related but different AI governance concern. For this situation: A SaaS seller and a corporate deployer both assume the other owns all AI Act obligations for a recruiting model.
Question 352
A risk-based audit engagement examines this operating condition: A SaaS seller and a corporate deployer both assume the other owns all AI Act obligations for a recruiting model. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Assume every AI application is low-risk or that buying a model eliminates deployer responsibilities.
- Organization documents role-specific obligations and controls for its actual use and checks changes over time.
- Material regulatory changes are recognized and implementation plans accurately reflect currently applicable provisions.
- Sampled AI processes show implemented controls and closed corrective actions, with any certification claims substantiated.
Explanation
Correct Answer
B:The reason it is necessary is: Risk classification and provider/deployer roles affect obligations; they cannot be assumed from product branding. Independent audit evidence includes: Inspect system purpose, actors, changes, market placement, impact, legal analysis and current phased applicability.
Incorrect Answers
A:This attractive shortcut does not resolve the EU AI Act role and risk classification weakness: Assume every AI application is low-risk or that buying a model eliminates deployer responsibilities. Effective closure requires: Organization documents role-specific obligations and controls for its actual use and checks changes over time.
C:This option concerns Regulatory change tracking without overclaiming compliance, which is a related but different AI governance concern. It does not establish control effectiveness for EU AI Act role and risk classification.
D:This option concerns ISO IEC 42001 AI management system controls, which is a related but different AI governance concern. The decisive principle here is: Risk classification and provider/deployer roles affect obligations; they cannot be assumed from product branding.
Question 353
An audit committee asks for a defensible assessment of this situation: A multinational claims a vendor-built screening system is exempt without classifying its actual use and organizational role. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Maintain jurisdiction-specific legal mapping with version dates, accountable counsel and periodic applicability reviews.
- Map accountable GOVERN processes, context under MAP, evidence-based MEASURE and decisions under MANAGE without mischaracterizing voluntary guidance.
- Assume every AI application is low-risk or that buying a model eliminates deployer responsibilities.
- Identify relevant AI Act roles, use-case classifications, jurisdictions and applicable obligations with competent legal input.
Explanation
Correct Answer
D:The reason it is necessary is: Risk classification and provider/deployer roles affect obligations; they cannot be assumed from product branding. In this case: A multinational claims a vendor-built screening system is exempt without classifying its actual use and organizational role.
Incorrect Answers
A:This option concerns Regulatory change tracking without overclaiming compliance, which is a related but different AI governance concern. The decisive principle here is: Risk classification and provider/deployer roles affect obligations; they cannot be assumed from product branding.
B:This option concerns NIST AI RMF governance and measurement alignment, which is a related but different AI governance concern. In this case: A multinational claims a vendor-built screening system is exempt without classifying its actual use and organizational role.
C:This attractive shortcut does not resolve the EU AI Act role and risk classification weakness: Assume every AI application is low-risk or that buying a model eliminates deployer responsibilities. In this case: A multinational claims a vendor-built screening system is exempt without classifying its actual use and organizational role.
Question 354
During an AI controls assessment, the team learns that a multinational claims a vendor-built screening system is exempt without classifying its actual use and organizational role. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- NIST AI RMF 1.0 provides risk-management functions, not a universal legal compliance certificate.
- AI attack surfaces include data, models, prompts, output use and agent capabilities beyond traditional network endpoints.
- Risk classification and provider/deployer roles affect obligations; they cannot be assumed from product branding.
- Assume every AI application is low-risk or that buying a model eliminates deployer responsibilities.
Explanation
Correct Answer
C:Independent audit evidence includes: Inspect system purpose, actors, changes, market placement, impact, legal analysis and current phased applicability. The acceptable verified outcome is: Organization documents role-specific obligations and controls for its actual use and checks changes over time.
Incorrect Answers
A:This option concerns NIST AI RMF governance and measurement alignment, which is a related but different AI governance concern. For this situation: A multinational claims a vendor-built screening system is exempt without classifying its actual use and organizational role.
B:This option concerns Adversarial risk and AI misuse scenarios, which is a related but different AI governance concern. The decisive principle here is: Risk classification and provider/deployer roles affect obligations; they cannot be assumed from product branding.
D:This attractive shortcut does not resolve the EU AI Act role and risk classification weakness: Assume every AI application is low-risk or that buying a model eliminates deployer responsibilities. For this situation: A multinational claims a vendor-built screening system is exempt without classifying its actual use and organizational role.
Question 355
An independent AI auditor reviews this case: A multinational claims a vendor-built screening system is exempt without classifying its actual use and organizational role. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Inspect subgroup and accessibility tests, documented stakeholder input, complaints and corrective actions.
- Inspect system purpose, actors, changes, market placement, impact, legal analysis and current phased applicability.
- Review use-case map, stakeholders, failure modes, risk register, impact assumptions and challenge workshops.
- Assume every AI application is low-risk or that buying a model eliminates deployer responsibilities.
Explanation
Correct Answer
B:The reason it is necessary is: Risk classification and provider/deployer roles affect obligations; they cannot be assumed from product branding. The corrective action is: Identify relevant AI Act roles, use-case classifications, jurisdictions and applicable obligations with competent legal input.
Incorrect Answers
A:This option concerns Fairness and accessibility ethical governance, which is a related but different AI governance concern. It does not establish control effectiveness for EU AI Act role and risk classification.
C:This option concerns AI use-case risk scenario identification, which is a related but different AI governance concern. It does not establish control effectiveness for EU AI Act role and risk classification.
D:This attractive shortcut does not resolve the EU AI Act role and risk classification weakness: Assume every AI application is low-risk or that buying a model eliminates deployer responsibilities. Identify relevant AI Act roles, use-case classifications, jurisdictions and applicable obligations with competent legal input.
Question 356
A governance and assurance review uncovers the following: A multinational claims a vendor-built screening system is exempt without classifying its actual use and organizational role. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Organization documents role-specific obligations and controls for its actual use and checks changes over time.
- The documented risk cycle links context, measurement, ownership and treatment for sampled systems.
- Assume every AI application is low-risk or that buying a model eliminates deployer responsibilities.
- Risk register and tests cover plausible exploitation paths, and high-impact gaps are prioritized.
Explanation
Correct Answer
A:The reason it is necessary is: Risk classification and provider/deployer roles affect obligations; they cannot be assumed from product branding. This is an observable validation result for EU AI Act role and risk classification, not just management assurance: Organization documents role-specific obligations and controls for its actual use and checks changes over time.
Incorrect Answers
B:This option concerns NIST AI RMF governance and measurement alignment, which is a related but different AI governance concern. The audit must corroborate: Inspect system purpose, actors, changes, market placement, impact, legal analysis and current phased applicability.
C:For this situation: A multinational claims a vendor-built screening system is exempt without classifying its actual use and organizational role.
D:This option concerns Adversarial risk and AI misuse scenarios, which is a related but different AI governance concern. For this situation: A multinational claims a vendor-built screening system is exempt without classifying its actual use and organizational role.
Question 357
A risk-based audit engagement examines this operating condition: A service provider changes a model's intended purpose yet never revisits provider versus deployer responsibilities. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Threat-model model-specific abuse paths, adversary access, safeguards and residual exposure.
- Map accountable GOVERN processes, context under MAP, evidence-based MEASURE and decisions under MANAGE without mischaracterizing voluntary guidance.
- Assume every AI application is low-risk or that buying a model eliminates deployer responsibilities.
- Identify relevant AI Act roles, use-case classifications, jurisdictions and applicable obligations with competent legal input.
Explanation
Correct Answer
D:The reason it is necessary is: Risk classification and provider/deployer roles affect obligations; they cannot be assumed from product branding. In this case: A service provider changes a model's intended purpose yet never revisits provider versus deployer responsibilities.
Incorrect Answers
A:This option concerns Adversarial risk and AI misuse scenarios, which is a related but different AI governance concern. In this case: A service provider changes a model's intended purpose yet never revisits provider versus deployer responsibilities.
B:This option concerns NIST AI RMF governance and measurement alignment, which is a related but different AI governance concern. In this case: A service provider changes a model's intended purpose yet never revisits provider versus deployer responsibilities.
C:This attractive shortcut does not resolve the EU AI Act role and risk classification weakness: Assume every AI application is low-risk or that buying a model eliminates deployer responsibilities. In this case: A service provider changes a model's intended purpose yet never revisits provider versus deployer responsibilities.
Question 358
An audit committee asks for a defensible assessment of this situation: A service provider changes a model's intended purpose yet never revisits provider versus deployer responsibilities. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Risk classification and provider/deployer roles affect obligations; they cannot be assumed from product branding.
- Assume every AI application is low-risk or that buying a model eliminates deployer responsibilities.
- Disclosing AI involvement and limitations supports informed human interaction but is not a substitute for other controls.
- AI risk assessment must consider intended context and foreseeable misuse, not only traditional IT incidents.
Explanation
Correct Answer
A:Independent audit evidence includes: Inspect system purpose, actors, changes, market placement, impact, legal analysis and current phased applicability. In this case: A service provider changes a model's intended purpose yet never revisits provider versus deployer responsibilities.
Incorrect Answers
B:This attractive shortcut does not resolve the EU AI Act role and risk classification weakness: Assume every AI application is low-risk or that buying a model eliminates deployer responsibilities. For this situation: A service provider changes a model's intended purpose yet never revisits provider versus deployer responsibilities.
C:This option concerns AI transparency and meaningful disclosure, which is a related but different AI governance concern. The decisive principle here is: Risk classification and provider/deployer roles affect obligations; they cannot be assumed from product branding.
D:This option concerns AI use-case risk scenario identification, which is a related but different AI governance concern. The decisive principle here is: Risk classification and provider/deployer roles affect obligations; they cannot be assumed from product branding.
Question 359
During an AI controls assessment, the team learns that a service provider changes a model's intended purpose yet never revisits provider versus deployer responsibilities. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Assume every AI application is low-risk or that buying a model eliminates deployer responsibilities.
- Inspect system purpose, actors, changes, market placement, impact, legal analysis and current phased applicability.
- Inspect AIMS scope, roles, risk treatment, audit outcomes, nonconformities and management reviews.
- Inspect architecture data flows, attacker capabilities, attack trees, abuse test coverage and limiting controls.
Explanation
Correct Answer
B:This evidence directly tests the asserted control for EU AI Act role and risk classification: Inspect system purpose, actors, changes, market placement, impact, legal analysis and current phased applicability.
Incorrect Answers
A:For this situation: A service provider changes a model's intended purpose yet never revisits provider versus deployer responsibilities.
C:This option concerns ISO IEC 42001 AI management system controls, which is a related but different AI governance concern. In this case: A service provider changes a model's intended purpose yet never revisits provider versus deployer responsibilities.
D:This option concerns Adversarial risk and AI misuse scenarios, which is a related but different AI governance concern. For this situation: A service provider changes a model's intended purpose yet never revisits provider versus deployer responsibilities.
Question 360
An independent AI auditor reviews this case: A service provider changes a model's intended purpose yet never revisits provider versus deployer responsibilities. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Identify relevant AI Act roles, use-case classifications, jurisdictions and applicable obligations with competent legal input.
- Assess contextual transparency duties, affected audiences and effective disclosure mechanisms appropriate to use.
- Assume every AI application is low-risk or that buying a model eliminates deployer responsibilities.
- Inspect system purpose, actors, changes, market placement, impact, legal analysis and current phased applicability.
- Review use-case map, stakeholders, failure modes, risk register, impact assumptions and challenge workshops.
Explanation
Correct Answers
A:The reason it is necessary is: Risk classification and provider/deployer roles affect obligations; they cannot be assumed from product branding. For this situation: A service provider changes a model's intended purpose yet never revisits provider versus deployer responsibilities.
D:The acceptable verified outcome is: Organization documents role-specific obligations and controls for its actual use and checks changes over time.
Incorrect Answers
B:This option concerns AI transparency and meaningful disclosure, which is a related but different AI governance concern. For this situation: A service provider changes a model's intended purpose yet never revisits provider versus deployer responsibilities.
C:It misses the key control principle: Risk classification and provider/deployer roles affect obligations; they cannot be assumed from product branding.
E:This option concerns AI use-case risk scenario identification, which is a related but different AI governance concern. For this situation: A service provider changes a model's intended purpose yet never revisits provider versus deployer responsibilities.
