Isaca AAIA Practice Test 49
Question 480
An independent AI auditor reviews this case: A fraud lab publishes generated examples that closely replicate unique transaction records despite altered identifiers. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Validate synthetic data for utility, subgroup representation, memorization and plausible disclosure before release.
- Test extractable memorization and membership inference under authorized red-team conditions and apply data minimization.
- Label a table synthetic and distribute it publicly without any disclosure or realism assessment.
- Inspect generation method, similarity and disclosure tests, subgroup distributions and downstream use-case validation.
- Inspect index ACL propagation, chunk metadata, identity claims, denied-search tests and cached answer behavior.
Explanation
Correct Answers
A:The reason it is necessary is: Synthetic labels do not automatically eliminate privacy, bias or representativeness risk. For this situation: A fraud lab publishes generated examples that closely replicate unique transaction records despite altered identifiers.
D:This evidence directly tests the asserted control for Synthetic training data utility and privacy controls: Inspect generation method, similarity and disclosure tests, subgroup distributions and downstream use-case validation.
Incorrect Answers
B:This option concerns Membership inference and training-data memorization tests, which is a related but different AI governance concern. For this situation: A fraud lab publishes generated examples that closely replicate unique transaction records despite altered identifiers.
C:It misses the key control principle: Synthetic labels do not automatically eliminate privacy, bias or representativeness risk.
E:This option concerns RAG corpus access controls and tenant segregation, which is a related but different AI governance concern. The decisive principle here is: Synthetic labels do not automatically eliminate privacy, bias or representativeness risk.
Question 481
A governance and assurance review uncovers the following: A regulator-facing insurance model has vague fairness goals but no measurable validation criteria before procurement. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Log emergency AI configuration changes, require proportionate approval, expiry and post-change validation.
- Treat a successful prototype demonstration as complete evidence of all unspecified requirements.
- Use a decommission plan to disable endpoints, revoke access, retain required records and dispose of data appropriately.
- Create traceable business, human impact, security and quality requirements with measurable release and acceptance gates.
Explanation
Correct Answer
D:The reason it is necessary is: AI development assurance starts from explicit risk-weighted requirements rather than retrospective claims of usefulness. The acceptable verified outcome is: Each material requirement maps to a result and signoff before deploying the feature.
Incorrect Answers
A:This option concerns AI configuration and emergency change traceability, which is a related but different AI governance concern. It does not establish control effectiveness for AI requirements-to-acceptance traceability.
B:This attractive shortcut does not resolve the AI requirements-to-acceptance traceability weakness: Treat a successful prototype demonstration as complete evidence of all unspecified requirements.
C:This option concerns Controlled model retirement and data disposition, which is a related but different AI governance concern. It does not establish control effectiveness for AI requirements-to-acceptance traceability.
Question 482
A risk-based audit engagement examines this operating condition: A regulator-facing insurance model has vague fairness goals but no measurable validation criteria before procurement. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Treat a successful prototype demonstration as complete evidence of all unspecified requirements.
- AI delivery involves models, data and code, so conventional app deployment approval alone may not cover behavior changes.
- AI supply-chain risk includes pre-trained weights, code, data sources and hosted capabilities.
- AI development assurance starts from explicit risk-weighted requirements rather than retrospective claims of usefulness.
Explanation
Correct Answer
D:The acceptable verified outcome is: Each material requirement maps to a result and signoff before deploying the feature. In this case: A regulator-facing insurance model has vague fairness goals but no measurable validation criteria before procurement.
Incorrect Answers
A:This attractive shortcut does not resolve the AI requirements-to-acceptance traceability weakness: Treat a successful prototype demonstration as complete evidence of all unspecified requirements. For this situation: A regulator-facing insurance model has vague fairness goals but no measurable validation criteria before procurement.
B:This option concerns AI data and model CI/CD separation, which is a related but different AI governance concern. It does not establish control effectiveness for AI requirements-to-acceptance traceability.
C:This option concerns AI vendor component and supply chain lifecycle, which is a related but different AI governance concern. It does not establish control effectiveness for AI requirements-to-acceptance traceability.
Question 483
An audit committee asks for a defensible assessment of this situation: A regulator-facing insurance model has vague fairness goals but no measurable validation criteria before procurement. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Treat a successful prototype demonstration as complete evidence of all unspecified requirements.
- Inspect sandbox isolation, tool permissions, go-live checklist, safety test results and deployment records.
- Inspect pipeline roles, artifact signatures, dataset permissions, approval gates and production change logs.
- Inspect signed use cases, requirement trace matrix, outcome thresholds, known limitations and test cases.
Explanation
Correct Answer
D:The reason it is necessary is: AI development assurance starts from explicit risk-weighted requirements rather than retrospective claims of usefulness. In this case: A regulator-facing insurance model has vague fairness goals but no measurable validation criteria before procurement.
Incorrect Answers
A:This attractive shortcut does not resolve the AI requirements-to-acceptance traceability weakness: Treat a successful prototype demonstration as complete evidence of all unspecified requirements. The auditor should instead examine: Inspect signed use cases, requirement trace matrix, outcome thresholds, known limitations and test cases.
B:This option concerns AI prototype experimentation versus production safety gates, which is a related but different AI governance concern. It does not establish control effectiveness for AI requirements-to-acceptance traceability.
C:This option concerns AI data and model CI/CD separation, which is a related but different AI governance concern. For this situation: A regulator-facing insurance model has vague fairness goals but no measurable validation criteria before procurement.
Question 484
During an AI controls assessment, the team learns that a regulator-facing insurance model has vague fairness goals but no measurable validation criteria before procurement. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Treat a successful prototype demonstration as complete evidence of all unspecified requirements.
- Emergency deviations expire or receive accountable renewal and critical controls are verified restored.
- An independent challenger confirms specified safety and performance requirements before go-live.
- Each material requirement maps to a result and signoff before deploying the feature.
Explanation
Correct Answer
D:The reason it is necessary is: AI development assurance starts from explicit risk-weighted requirements rather than retrospective claims of usefulness. This is an observable validation result for AI requirements-to-acceptance traceability, not just management assurance: Each material requirement maps to a result and signoff before deploying the feature.
Incorrect Answers
A:This attractive shortcut does not resolve the AI requirements-to-acceptance traceability weakness: Treat a successful prototype demonstration as complete evidence of all unspecified requirements. Effective closure requires: Each material requirement maps to a result and signoff before deploying the feature.
B:This option concerns AI configuration and emergency change traceability, which is a related but different AI governance concern. For this situation: A regulator-facing insurance model has vague fairness goals but no measurable validation criteria before procurement.
C:This option concerns Independent validation before model deployment, which is a related but different AI governance concern. It does not establish control effectiveness for AI requirements-to-acceptance traceability.
Question 485
An independent AI auditor reviews this case: A call center launches an AI answer assistant with no business owner definition of acceptable wrong-answer severity. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Treat a successful prototype demonstration as complete evidence of all unspecified requirements.
- Inventory and authenticate model components, third-party datasets and software dependencies throughout acquisition and updates.
- Create traceable business, human impact, security and quality requirements with measurable release and acceptance gates.
- Require risk-proportionate independent model validation, controlled challenge samples and release acceptance.
Explanation
Correct Answer
C:The reason it is necessary is: AI development assurance starts from explicit risk-weighted requirements rather than retrospective claims of usefulness. Independent audit evidence includes: Inspect signed use cases, requirement trace matrix, outcome thresholds, known limitations and test cases.
Incorrect Answers
A:This attractive shortcut does not resolve the AI requirements-to-acceptance traceability weakness: Treat a successful prototype demonstration as complete evidence of all unspecified requirements. In this case: A call center launches an AI answer assistant with no business owner definition of acceptable wrong-answer severity.
B:This option concerns AI vendor component and supply chain lifecycle, which is a related but different AI governance concern. The decisive principle here is: AI development assurance starts from explicit risk-weighted requirements rather than retrospective claims of usefulness.
D:This option concerns Independent validation before model deployment, which is a related but different AI governance concern. The decisive principle here is: AI development assurance starts from explicit risk-weighted requirements rather than retrospective claims of usefulness.
Question 486
A governance and assurance review uncovers the following: A call center launches an AI answer assistant with no business owner definition of acceptable wrong-answer severity. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- AI delivery involves models, data and code, so conventional app deployment approval alone may not cover behavior changes.
- Treat a successful prototype demonstration as complete evidence of all unspecified requirements.
- AI development assurance starts from explicit risk-weighted requirements rather than retrospective claims of usefulness.
- AI lifecycle controls include end-of-life risks; deleting an app icon is not an auditable retirement.
Explanation
Correct Answer
C:The acceptable verified outcome is: Each material requirement maps to a result and signoff before deploying the feature. Independent audit evidence includes: Inspect signed use cases, requirement trace matrix, outcome thresholds, known limitations and test cases.
Incorrect Answers
A:This option concerns AI data and model CI/CD separation, which is a related but different AI governance concern. The decisive principle here is: AI development assurance starts from explicit risk-weighted requirements rather than retrospective claims of usefulness.
B:This attractive shortcut does not resolve the AI requirements-to-acceptance traceability weakness: Treat a successful prototype demonstration as complete evidence of all unspecified requirements. For this situation: A call center launches an AI answer assistant with no business owner definition of acceptable wrong-answer severity.
D:This option concerns Controlled model retirement and data disposition, which is a related but different AI governance concern. The decisive principle here is: AI development assurance starts from explicit risk-weighted requirements rather than retrospective claims of usefulness.
Question 487
A risk-based audit engagement examines this operating condition: A call center launches an AI answer assistant with no business owner definition of acceptable wrong-answer severity. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Inspect signed use cases, requirement trace matrix, outcome thresholds, known limitations and test cases.
- Review reviewer independence, held-out data provenance, challenge results, exceptions and signoffs.
- Inspect pipeline roles, artifact signatures, dataset permissions, approval gates and production change logs.
- Treat a successful prototype demonstration as complete evidence of all unspecified requirements.
Explanation
Correct Answer
A:The reason it is necessary is: AI development assurance starts from explicit risk-weighted requirements rather than retrospective claims of usefulness. This evidence directly tests the asserted control for AI requirements-to-acceptance traceability: Inspect signed use cases, requirement trace matrix, outcome thresholds, known limitations and test cases.
Incorrect Answers
B:This option concerns Independent validation before model deployment, which is a related but different AI governance concern. For this situation: A call center launches an AI answer assistant with no business owner definition of acceptable wrong-answer severity.
C:This option concerns AI data and model CI/CD separation, which is a related but different AI governance concern. For this situation: A call center launches an AI answer assistant with no business owner definition of acceptable wrong-answer severity.
D:This attractive shortcut does not resolve the AI requirements-to-acceptance traceability weakness: Treat a successful prototype demonstration as complete evidence of all unspecified requirements. Create traceable business, human impact, security and quality requirements with measurable release and acceptance gates.
Question 488
An audit committee asks for a defensible assessment of this situation: A call center launches an AI answer assistant with no business owner definition of acceptable wrong-answer severity. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Only approved traceable versions run and vulnerable components receive monitored remediation.
- Each material requirement maps to a result and signoff before deploying the feature.
- Treat a successful prototype demonstration as complete evidence of all unspecified requirements.
- The retired model cannot serve unauthorized predictions and remaining data is governed by approved retention.
Explanation
Correct Answer
B:The reason it is necessary is: AI development assurance starts from explicit risk-weighted requirements rather than retrospective claims of usefulness. The corrective action is: Create traceable business, human impact, security and quality requirements with measurable release and acceptance gates.
Incorrect Answers
A:This option concerns AI vendor component and supply chain lifecycle, which is a related but different AI governance concern. For this situation: A call center launches an AI answer assistant with no business owner definition of acceptable wrong-answer severity.
C:It misses the key control principle: AI development assurance starts from explicit risk-weighted requirements rather than retrospective claims of usefulness.
D:This option concerns Controlled model retirement and data disposition, which is a related but different AI governance concern. For this situation: A call center launches an AI answer assistant with no business owner definition of acceptable wrong-answer severity.
Question 489
During an AI controls assessment, the team learns that a fraud project lists model accuracy as its only requirement even though it will automatically hold customer payments. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Create traceable business, human impact, security and quality requirements with measurable release and acceptance gates.
- Treat a successful prototype demonstration as complete evidence of all unspecified requirements.
- Version model artifacts, code, environments, hyperparameters and data references with reproducible promotion records.
- Inventory and authenticate model components, third-party datasets and software dependencies throughout acquisition and updates.
Explanation
Correct Answer
A:The reason it is necessary is: AI development assurance starts from explicit risk-weighted requirements rather than retrospective claims of usefulness. In this case: A fraud project lists model accuracy as its only requirement even though it will automatically hold customer payments.
Incorrect Answers
B:This attractive shortcut does not resolve the AI requirements-to-acceptance traceability weakness: Treat a successful prototype demonstration as complete evidence of all unspecified requirements. In this case: A fraud project lists model accuracy as its only requirement even though it will automatically hold customer payments.
C:This option concerns Reproducible model training and configuration management, which is a related but different AI governance concern. It does not establish control effectiveness for AI requirements-to-acceptance traceability.
D:This option concerns AI vendor component and supply chain lifecycle, which is a related but different AI governance concern. In this case: A fraud project lists model accuracy as its only requirement even though it will automatically hold customer payments.
Question 490
An independent AI auditor reviews this case: A fraud project lists model accuracy as its only requirement even though it will automatically hold customer payments. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Inspect config state histories, privileges, break-glass logs, time bounds and post-incident review.
- Version model artifacts, code, environments, hyperparameters and data references with reproducible promotion records.
- Inspect signed use cases, requirement trace matrix, outcome thresholds, known limitations and test cases.
- Create traceable business, human impact, security and quality requirements with measurable release and acceptance gates.
- Treat a successful prototype demonstration as complete evidence of all unspecified requirements.
Explanation
Correct Answers
C:The acceptable verified outcome is: Each material requirement maps to a result and signoff before deploying the feature.
D:The reason it is necessary is: AI development assurance starts from explicit risk-weighted requirements rather than retrospective claims of usefulness. For this situation: A fraud project lists model accuracy as its only requirement even though it will automatically hold customer payments.
Incorrect Answers
A:This option concerns AI configuration and emergency change traceability, which is a related but different AI governance concern. The decisive principle here is: AI development assurance starts from explicit risk-weighted requirements rather than retrospective claims of usefulness.
B:This option concerns Reproducible model training and configuration management, which is a related but different AI governance concern. For this situation: A fraud project lists model accuracy as its only requirement even though it will automatically hold customer payments.
E:This attractive shortcut does not resolve the AI requirements-to-acceptance traceability weakness: Treat a successful prototype demonstration as complete evidence of all unspecified requirements. For this situation: A fraud project lists model accuracy as its only requirement even though it will automatically hold customer payments.
