Isaca AAIA Practice Test 55
Question 540
An independent AI auditor reviews this case: A medical assistant depends on external embeddings and cannot identify vulnerable versions or contract expiration. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Inspect sandbox isolation, tool permissions, go-live checklist, safety test results and deployment records.
- Assume model weights and datasets require no provenance controls because they are not executable source code.
- Inventory and authenticate model components, third-party datasets and software dependencies throughout acquisition and updates.
- Inspect supplier attestations, component inventory, signed digests, license constraints, SBOM and update notices.
- Separate development, test and production roles with controlled promotion, scoped credentials and audit trails.
Explanation
Correct Answers
C:The reason it is necessary is: AI supply-chain risk includes pre-trained weights, code, data sources and hosted capabilities. For this situation: A medical assistant depends on external embeddings and cannot identify vulnerable versions or contract expiration.
D:This evidence directly tests the asserted control for AI vendor component and supply chain lifecycle: Inspect supplier attestations, component inventory, signed digests, license constraints, SBOM and update notices.
Incorrect Answers
A:This option concerns AI prototype experimentation versus production safety gates, which is a related but different AI governance concern. The audit must corroborate: Inspect supplier attestations, component inventory, signed digests, license constraints, SBOM and update notices.
B:The auditor should instead examine: Inspect supplier attestations, component inventory, signed digests, license constraints, SBOM and update notices.
E:This option concerns AI data and model CI/CD separation, which is a related but different AI governance concern. In this case: A medical assistant depends on external embeddings and cannot identify vulnerable versions or contract expiration.
Question 541
A governance and assurance review uncovers the following: A firm retires an AI assistant but its public API remains active with archived customer prompt history. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Leave deprecated models and credentials indefinitely available because they are no longer advertised.
- Coordinate technical recovery with affected stakeholder review, corrective communication and validated post-incident controls.
- Separate sandbox experimentation from production through constrained access, risk approval and evidence-based readiness criteria.
- Use a decommission plan to disable endpoints, revoke access, retain required records and dispose of data appropriately.
Explanation
Correct Answer
D:The reason it is necessary is: AI lifecycle controls include end-of-life risks; deleting an app icon is not an auditable retirement. This is the proportionate control response to Controlled model retirement and data disposition: Use a decommission plan to disable endpoints, revoke access, retain required records and dispose of data appropriately.
Incorrect Answers
A:This attractive shortcut does not resolve the Controlled model retirement and data disposition weakness: Leave deprecated models and credentials indefinitely available because they are no longer advertised.
B:This option concerns AI model rollback and stakeholder communication, which is a related but different AI governance concern. It does not establish control effectiveness for Controlled model retirement and data disposition.
C:This option concerns AI prototype experimentation versus production safety gates, which is a related but different AI governance concern. It does not establish control effectiveness for Controlled model retirement and data disposition.
Question 542
A risk-based audit engagement examines this operating condition: A firm retires an AI assistant but its public API remains active with archived customer prompt history. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Leave deprecated models and credentials indefinitely available because they are no longer advertised.
- An AI incident ends only after decision impacts, service restoration and recurrence risk are addressed.
- AI delivery involves models, data and code, so conventional app deployment approval alone may not cover behavior changes.
- AI lifecycle controls include end-of-life risks; deleting an app icon is not an auditable retirement.
Explanation
Correct Answer
D:The corrective action is: Use a decommission plan to disable endpoints, revoke access, retain required records and dispose of data appropriately. This is the applicable AI audit principle for Controlled model retirement and data disposition: AI lifecycle controls include end-of-life risks; deleting an app icon is not an auditable retirement.
Incorrect Answers
A:This attractive shortcut does not resolve the Controlled model retirement and data disposition weakness: Leave deprecated models and credentials indefinitely available because they are no longer advertised. For this situation: A firm retires an AI assistant but its public API remains active with archived customer prompt history.
B:This option concerns AI model rollback and stakeholder communication, which is a related but different AI governance concern. For this situation: A firm retires an AI assistant but its public API remains active with archived customer prompt history.
C:This option concerns AI data and model CI/CD separation, which is a related but different AI governance concern. It does not establish control effectiveness for Controlled model retirement and data disposition.
Question 543
An audit committee asks for a defensible assessment of this situation: A firm retires an AI assistant but its public API remains active with archived customer prompt history. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Review endpoint inventory, credentials, retained artifacts, disposal approvals, legal holds and restoration paths.
- Review reviewer independence, held-out data provenance, challenge results, exceptions and signoffs.
- Leave deprecated models and credentials indefinitely available because they are no longer advertised.
- Inspect supplier attestations, component inventory, signed digests, license constraints, SBOM and update notices.
Explanation
Correct Answer
A:The reason it is necessary is: AI lifecycle controls include end-of-life risks; deleting an app icon is not an auditable retirement. The corrective action is: Use a decommission plan to disable endpoints, revoke access, retain required records and dispose of data appropriately.
Incorrect Answers
B:This option concerns Independent validation before model deployment, which is a related but different AI governance concern. It does not establish control effectiveness for Controlled model retirement and data disposition.
C:This attractive shortcut does not resolve the Controlled model retirement and data disposition weakness: Leave deprecated models and credentials indefinitely available because they are no longer advertised. The auditor should instead examine: Review endpoint inventory, credentials, retained artifacts, disposal approvals, legal holds and restoration paths.
D:This option concerns AI vendor component and supply chain lifecycle, which is a related but different AI governance concern. It does not establish control effectiveness for Controlled model retirement and data disposition.
Question 544
During an AI controls assessment, the team learns that a firm retires an AI assistant but its public API remains active with archived customer prompt history. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Leave deprecated models and credentials indefinitely available because they are no longer advertised.
- Production release occurs only after required controls and independent signoffs are demonstrated.
- Only signed approved model-data combinations reach production and privilege tests fail closed.
- The retired model cannot serve unauthorized predictions and remaining data is governed by approved retention.
Explanation
Correct Answer
D:The reason it is necessary is: AI lifecycle controls include end-of-life risks; deleting an app icon is not an auditable retirement. This is an observable validation result for Controlled model retirement and data disposition, not just management assurance: The retired model cannot serve unauthorized predictions and remaining data is governed by approved retention.
Incorrect Answers
A:This attractive shortcut does not resolve the Controlled model retirement and data disposition weakness: Leave deprecated models and credentials indefinitely available because they are no longer advertised. Use a decommission plan to disable endpoints, revoke access, retain required records and dispose of data appropriately.
B:This option concerns AI prototype experimentation versus production safety gates, which is a related but different AI governance concern. For this situation: A firm retires an AI assistant but its public API remains active with archived customer prompt history.
C:This option concerns AI data and model CI/CD separation, which is a related but different AI governance concern. For this situation: A firm retires an AI assistant but its public API remains active with archived customer prompt history.
Question 545
An independent AI auditor reviews this case: A financial model is replaced but old weights and scoring credentials still allow unauthorized decisions. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Leave deprecated models and credentials indefinitely available because they are no longer advertised.
- Separate sandbox experimentation from production through constrained access, risk approval and evidence-based readiness criteria.
- Version model artifacts, code, environments, hyperparameters and data references with reproducible promotion records.
- Use a decommission plan to disable endpoints, revoke access, retain required records and dispose of data appropriately.
Explanation
Correct Answer
D:The reason it is necessary is: AI lifecycle controls include end-of-life risks; deleting an app icon is not an auditable retirement. The acceptable verified outcome is: The retired model cannot serve unauthorized predictions and remaining data is governed by approved retention.
Incorrect Answers
A:This attractive shortcut does not resolve the Controlled model retirement and data disposition weakness: Leave deprecated models and credentials indefinitely available because they are no longer advertised. In this case: A financial model is replaced but old weights and scoring credentials still allow unauthorized decisions.
B:This option concerns AI prototype experimentation versus production safety gates, which is a related but different AI governance concern. The decisive principle here is: AI lifecycle controls include end-of-life risks; deleting an app icon is not an auditable retirement.
C:This option concerns Reproducible model training and configuration management, which is a related but different AI governance concern. It does not establish control effectiveness for Controlled model retirement and data disposition.
Question 546
A governance and assurance review uncovers the following: A financial model is replaced but old weights and scoring credentials still allow unauthorized decisions. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Leave deprecated models and credentials indefinitely available because they are no longer advertised.
- AI supply-chain risk includes pre-trained weights, code, data sources and hosted capabilities.
- AI lifecycle controls include end-of-life risks; deleting an app icon is not an auditable retirement.
- AI development assurance starts from explicit risk-weighted requirements rather than retrospective claims of usefulness.
Explanation
Correct Answer
C:The corrective action is: Use a decommission plan to disable endpoints, revoke access, retain required records and dispose of data appropriately. The acceptable verified outcome is: The retired model cannot serve unauthorized predictions and remaining data is governed by approved retention.
Incorrect Answers
A:This attractive shortcut does not resolve the Controlled model retirement and data disposition weakness: Leave deprecated models and credentials indefinitely available because they are no longer advertised. For this situation: A financial model is replaced but old weights and scoring credentials still allow unauthorized decisions.
B:This option concerns AI vendor component and supply chain lifecycle, which is a related but different AI governance concern. The decisive principle here is: AI lifecycle controls include end-of-life risks; deleting an app icon is not an auditable retirement.
D:This option concerns AI requirements-to-acceptance traceability, which is a related but different AI governance concern. It does not establish control effectiveness for Controlled model retirement and data disposition.
Question 547
A risk-based audit engagement examines this operating condition: A financial model is replaced but old weights and scoring credentials still allow unauthorized decisions. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Inspect signed use cases, requirement trace matrix, outcome thresholds, known limitations and test cases.
- Leave deprecated models and credentials indefinitely available because they are no longer advertised.
- Inspect pipeline roles, artifact signatures, dataset permissions, approval gates and production change logs.
- Review endpoint inventory, credentials, retained artifacts, disposal approvals, legal holds and restoration paths.
Explanation
Correct Answer
D:The reason it is necessary is: AI lifecycle controls include end-of-life risks; deleting an app icon is not an auditable retirement. In this case: A financial model is replaced but old weights and scoring credentials still allow unauthorized decisions.
Incorrect Answers
A:This option concerns AI requirements-to-acceptance traceability, which is a related but different AI governance concern. For this situation: A financial model is replaced but old weights and scoring credentials still allow unauthorized decisions.
B:This attractive shortcut does not resolve the Controlled model retirement and data disposition weakness: Leave deprecated models and credentials indefinitely available because they are no longer advertised. Effective closure requires: The retired model cannot serve unauthorized predictions and remaining data is governed by approved retention.
C:This option concerns AI data and model CI/CD separation, which is a related but different AI governance concern. The decisive principle here is: AI lifecycle controls include end-of-life risks; deleting an app icon is not an auditable retirement.
Question 548
An audit committee asks for a defensible assessment of this situation: A financial model is replaced but old weights and scoring credentials still allow unauthorized decisions. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- The retired model cannot serve unauthorized predictions and remaining data is governed by approved retention.
- An independent challenger confirms specified safety and performance requirements before go-live.
- Production release occurs only after required controls and independent signoffs are demonstrated.
- Leave deprecated models and credentials indefinitely available because they are no longer advertised.
Explanation
Correct Answer
A:The reason it is necessary is: AI lifecycle controls include end-of-life risks; deleting an app icon is not an auditable retirement. Independent audit evidence includes: Review endpoint inventory, credentials, retained artifacts, disposal approvals, legal holds and restoration paths.
Incorrect Answers
B:This option concerns Independent validation before model deployment, which is a related but different AI governance concern. The decisive principle here is: AI lifecycle controls include end-of-life risks; deleting an app icon is not an auditable retirement.
C:This option concerns AI prototype experimentation versus production safety gates, which is a related but different AI governance concern. For this situation: A financial model is replaced but old weights and scoring credentials still allow unauthorized decisions.
D:For this situation: A financial model is replaced but old weights and scoring credentials still allow unauthorized decisions.
Question 549
During an AI controls assessment, the team learns that a medical dataset stays accessible to ex-vendors after the associated model project is decommissioned. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Coordinate technical recovery with affected stakeholder review, corrective communication and validated post-incident controls.
- Separate development, test and production roles with controlled promotion, scoped credentials and audit trails.
- Use a decommission plan to disable endpoints, revoke access, retain required records and dispose of data appropriately.
- Leave deprecated models and credentials indefinitely available because they are no longer advertised.
Explanation
Correct Answer
C:The reason it is necessary is: AI lifecycle controls include end-of-life risks; deleting an app icon is not an auditable retirement. In this case: A medical dataset stays accessible to ex-vendors after the associated model project is decommissioned.
Incorrect Answers
A:This option concerns AI model rollback and stakeholder communication, which is a related but different AI governance concern. The decisive principle here is: AI lifecycle controls include end-of-life risks; deleting an app icon is not an auditable retirement.
B:This option concerns AI data and model CI/CD separation, which is a related but different AI governance concern. The audit must corroborate: Review endpoint inventory, credentials, retained artifacts, disposal approvals, legal holds and restoration paths.
D:This attractive shortcut does not resolve the Controlled model retirement and data disposition weakness: Leave deprecated models and credentials indefinitely available because they are no longer advertised. In this case: A medical dataset stays accessible to ex-vendors after the associated model project is decommissioned.
Question 550
An independent AI auditor reviews this case: A medical dataset stays accessible to ex-vendors after the associated model project is decommissioned. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Leave deprecated models and credentials indefinitely available because they are no longer advertised.
- Inventory and authenticate model components, third-party datasets and software dependencies throughout acquisition and updates.
- Use a decommission plan to disable endpoints, revoke access, retain required records and dispose of data appropriately.
- Inspect signed use cases, requirement trace matrix, outcome thresholds, known limitations and test cases.
- Review endpoint inventory, credentials, retained artifacts, disposal approvals, legal holds and restoration paths.
Explanation
Correct Answers
C:The reason it is necessary is: AI lifecycle controls include end-of-life risks; deleting an app icon is not an auditable retirement. This response fits the risk associated with Controlled model retirement and data disposition: Use a decommission plan to disable endpoints, revoke access, retain required records and dispose of data appropriately.
E:The reason it is necessary is: AI lifecycle controls include end-of-life risks; deleting an app icon is not an auditable retirement. This evidence directly tests the asserted control for Controlled model retirement and data disposition: Review endpoint inventory, credentials, retained artifacts, disposal approvals, legal holds and restoration paths.
Incorrect Answers
A:This attractive shortcut does not resolve the Controlled model retirement and data disposition weakness: Leave deprecated models and credentials indefinitely available because they are no longer advertised. For this situation: A medical dataset stays accessible to ex-vendors after the associated model project is decommissioned.
B:This option concerns AI vendor component and supply chain lifecycle, which is a related but different AI governance concern. The audit must corroborate: Review endpoint inventory, credentials, retained artifacts, disposal approvals, legal holds and restoration paths.
D:This option concerns AI requirements-to-acceptance traceability, which is a related but different AI governance concern. The decisive principle here is: AI lifecycle controls include end-of-life risks; deleting an app icon is not an auditable retirement.
