Isaca AAIA Practice Test 61
Question 600
An independent AI auditor reviews this case: An online insurer's model rollout lacks a known-good rollback artifact when conversion quality collapses. Which THREE elements together provide a defensible AI audit conclusion: the corrective control, the evidence to test it, and a verified outcome? Select THREE answers.
- Use risk-aware canary populations, guardrail metrics, stop criteria and tested rollback or kill switch.
- Inspect ingestion bursts, source identities, dataset hashes, registry links and clean restore evidence.
- Inspect canary assignment, segment KPIs, error thresholds, baseline model artifacts and rollback drill.
- Control schema, source, feature and data refreshes using integrity and semantic compatibility tests.
- Call a deployment canary controlled when traffic fraction is small but no adverse-impact trigger is monitored.
- Unacceptable changes are contained promptly and validated prior behavior is restored.
Explanation
Correct Answers
A:The reason it is necessary is: Gradual deployment reduces blast radius only if meaningful indicators and rollback decisions are predefined. For this situation: An online insurer's model rollout lacks a known-good rollback artifact when conversion quality collapses.
C:The acceptable verified outcome is: Unacceptable changes are contained promptly and validated prior behavior is restored.
F:In this case: An online insurer's model rollout lacks a known-good rollback artifact when conversion quality collapses.
Incorrect Answers
B:This option concerns Model poisoning incident response and rollback, which is a related but different AI governance concern. The decisive principle here is: Gradual deployment reduces blast radius only if meaningful indicators and rollback decisions are predefined.
D:This option concerns AI dataset refresh and feature pipeline approvals, which is a related but different AI governance concern. The decisive principle here is: Gradual deployment reduces blast radius only if meaningful indicators and rollback decisions are predefined.
E:The auditor should instead examine: Inspect canary assignment, segment KPIs, error thresholds, baseline model artifacts and rollback drill.
Question 601
A governance and assurance review uncovers the following: A hospital vendor updates its foundation model without notifying clients and a care summary changes clinical terminology. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Assume there is no production change because the client organization did not deploy new code.
- Require contractual update notifications, version observability, revalidation and compensating fallback for material supplier changes.
- Version prompt templates, permission boundaries and evaluation suites with staged approvals and rollback.
- Use risk-aware canary populations, guardrail metrics, stop criteria and tested rollback or kill switch.
Explanation
Correct Answer
B:The reason it is necessary is: Hosted AI services can change behavior outside local release cycles and require external change governance. This is the proportionate control response to External foundation-model update change notices: Require contractual update notifications, version observability, revalidation and compensating fallback for material supplier changes.
Incorrect Answers
A:This attractive shortcut does not resolve the External foundation-model update change notices weakness: Assume there is no production change because the client organization did not deploy new code.
C:This option concerns Prompt template governance and injection-resilience changes, which is a related but different AI governance concern. It does not establish control effectiveness for External foundation-model update change notices.
D:This option concerns Canary releases and model rollback thresholds, which is a related but different AI governance concern. It does not establish control effectiveness for External foundation-model update change notices.
Question 602
A risk-based audit engagement examines this operating condition: A hospital vendor updates its foundation model without notifying clients and a care summary changes clinical terminology. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- AI safety depends on configuration state as well as model artifacts; emergency bypasses need disciplined control.
- Prompts are executable behavioral configuration and can change output and risk without code deployment.
- Assume there is no production change because the client organization did not deploy new code.
- Hosted AI services can change behavior outside local release cycles and require external change governance.
Explanation
Correct Answer
D:The corrective action is: Require contractual update notifications, version observability, revalidation and compensating fallback for material supplier changes. This is the applicable AI audit principle for External foundation-model update change notices: Hosted AI services can change behavior outside local release cycles and require external change governance.
Incorrect Answers
A:This option concerns AI configuration and emergency change traceability, which is a related but different AI governance concern. It does not establish control effectiveness for External foundation-model update change notices.
B:This option concerns Prompt template governance and injection-resilience changes, which is a related but different AI governance concern. For this situation: A hospital vendor updates its foundation model without notifying clients and a care summary changes clinical terminology.
C:This attractive shortcut does not resolve the External foundation-model update change notices weakness: Assume there is no production change because the client organization did not deploy new code. For this situation: A hospital vendor updates its foundation model without notifying clients and a care summary changes clinical terminology.
Question 603
An audit committee asks for a defensible assessment of this situation: A hospital vendor updates its foundation model without notifying clients and a care summary changes clinical terminology. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Compare before-after distributions, update artifacts, critical use cases, approval rules and rollback records.
- Assume there is no production change because the client organization did not deploy new code.
- Inspect canary assignment, segment KPIs, error thresholds, baseline model artifacts and rollback drill.
- Compare provider release notes, model ID, output baselines, contractual notices and drift alerts.
Explanation
Correct Answer
D:The reason it is necessary is: Hosted AI services can change behavior outside local release cycles and require external change governance. The corrective action is: Require contractual update notifications, version observability, revalidation and compensating fallback for material supplier changes.
Incorrect Answers
A:This option concerns Model version change impact classification, which is a related but different AI governance concern. It does not establish control effectiveness for External foundation-model update change notices.
B:This attractive shortcut does not resolve the External foundation-model update change notices weakness: Assume there is no production change because the client organization did not deploy new code. The auditor should instead examine: Compare provider release notes, model ID, output baselines, contractual notices and drift alerts.
C:This option concerns Canary releases and model rollback thresholds, which is a related but different AI governance concern. For this situation: A hospital vendor updates its foundation model without notifying clients and a care summary changes clinical terminology.
Question 604
During an AI controls assessment, the team learns that a hospital vendor updates its foundation model without notifying clients and a care summary changes clinical terminology. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Material external changes are assessed before or promptly after adoption with controlled escalation.
- Assume there is no production change because the client organization did not deploy new code.
- Material behavioral changes receive proportionate approvals and do not bypass previously defined controls.
- Only signed approved model-data combinations reach production and privilege tests fail closed.
Explanation
Correct Answer
A:The reason it is necessary is: Hosted AI services can change behavior outside local release cycles and require external change governance. This is an observable validation result for External foundation-model update change notices, not just management assurance: Material external changes are assessed before or promptly after adoption with controlled escalation.
Incorrect Answers
B:This attractive shortcut does not resolve the External foundation-model update change notices weakness: Assume there is no production change because the client organization did not deploy new code. Require contractual update notifications, version observability, revalidation and compensating fallback for material supplier changes.
C:This option concerns Model version change impact classification, which is a related but different AI governance concern. For this situation: A hospital vendor updates its foundation model without notifying clients and a care summary changes clinical terminology.
D:This option concerns AI data and model CI/CD separation, which is a related but different AI governance concern. It does not establish control effectiveness for External foundation-model update change notices.
Question 605
An independent AI auditor reviews this case: A law firm depends on model output format that silently shifts after an external provider rollout. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Version prompt templates, permission boundaries and evaluation suites with staged approvals and rollback.
- Assume there is no production change because the client organization did not deploy new code.
- Require contractual update notifications, version observability, revalidation and compensating fallback for material supplier changes.
- Version and trace training, validation and inference datasets with accountable lineage, hashes and reproducible pipeline metadata.
Explanation
Correct Answer
C:The reason it is necessary is: Hosted AI services can change behavior outside local release cycles and require external change governance. The acceptable verified outcome is: Material external changes are assessed before or promptly after adoption with controlled escalation.
Incorrect Answers
A:This option concerns Prompt template governance and injection-resilience changes, which is a related but different AI governance concern. The decisive principle here is: Hosted AI services can change behavior outside local release cycles and require external change governance.
B:This attractive shortcut does not resolve the External foundation-model update change notices weakness: Assume there is no production change because the client organization did not deploy new code. In this case: A law firm depends on model output format that silently shifts after an external provider rollout.
D:This option concerns AI training dataset lineage and reproducibility, which is a related but different AI governance concern. It does not establish control effectiveness for External foundation-model update change notices.
Question 606
A governance and assurance review uncovers the following: A law firm depends on model output format that silently shifts after an external provider rollout. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Hosted AI services can change behavior outside local release cycles and require external change governance.
- Prompts are executable behavioral configuration and can change output and risk without code deployment.
- Assume there is no production change because the client organization did not deploy new code.
- AI changes can alter decisions without modifying the application UI or infrastructure code.
Explanation
Correct Answer
A:The corrective action is: Require contractual update notifications, version observability, revalidation and compensating fallback for material supplier changes. The acceptable verified outcome is: Material external changes are assessed before or promptly after adoption with controlled escalation.
Incorrect Answers
B:This option concerns Prompt template governance and injection-resilience changes, which is a related but different AI governance concern. For this situation: A law firm depends on model output format that silently shifts after an external provider rollout.
C:This attractive shortcut does not resolve the External foundation-model update change notices weakness: Assume there is no production change because the client organization did not deploy new code. For this situation: A law firm depends on model output format that silently shifts after an external provider rollout.
D:This option concerns Model version change impact classification, which is a related but different AI governance concern. The decisive principle here is: Hosted AI services can change behavior outside local release cycles and require external change governance.
Question 607
A risk-based audit engagement examines this operating condition: A law firm depends on model output format that silently shifts after an external provider rollout. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Compare provider release notes, model ID, output baselines, contractual notices and drift alerts.
- Inspect canary assignment, segment KPIs, error thresholds, baseline model artifacts and rollback drill.
- Inspect pipeline roles, artifact signatures, dataset permissions, approval gates and production change logs.
- Assume there is no production change because the client organization did not deploy new code.
Explanation
Correct Answer
A:The reason it is necessary is: Hosted AI services can change behavior outside local release cycles and require external change governance. In this case: A law firm depends on model output format that silently shifts after an external provider rollout.
Incorrect Answers
B:This option concerns Canary releases and model rollback thresholds, which is a related but different AI governance concern. The decisive principle here is: Hosted AI services can change behavior outside local release cycles and require external change governance.
C:This option concerns AI data and model CI/CD separation, which is a related but different AI governance concern. The decisive principle here is: Hosted AI services can change behavior outside local release cycles and require external change governance.
D:This attractive shortcut does not resolve the External foundation-model update change notices weakness: Assume there is no production change because the client organization did not deploy new code. Effective closure requires: Material external changes are assessed before or promptly after adoption with controlled escalation.
Question 608
An audit committee asks for a defensible assessment of this situation: A law firm depends on model output format that silently shifts after an external provider rollout. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Unapproved data changes are blocked and approved refreshes preserve input meaning and quality.
- Material external changes are assessed before or promptly after adoption with controlled escalation.
- Unacceptable changes are contained promptly and validated prior behavior is restored.
- Assume there is no production change because the client organization did not deploy new code.
Explanation
Correct Answer
B:The reason it is necessary is: Hosted AI services can change behavior outside local release cycles and require external change governance. Independent audit evidence includes: Compare provider release notes, model ID, output baselines, contractual notices and drift alerts.
Incorrect Answers
A:This option concerns AI dataset refresh and feature pipeline approvals, which is a related but different AI governance concern. It does not establish control effectiveness for External foundation-model update change notices.
C:This option concerns Canary releases and model rollback thresholds, which is a related but different AI governance concern. For this situation: A law firm depends on model output format that silently shifts after an external provider rollout.
D:For this situation: A law firm depends on model output format that silently shifts after an external provider rollout.
Question 609
During an AI controls assessment, the team learns that an accounting team cannot establish which hosted model version generated a disputed regulatory answer. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Require contractual update notifications, version observability, revalidation and compensating fallback for material supplier changes.
- Control schema, source, feature and data refreshes using integrity and semantic compatibility tests.
- Assume there is no production change because the client organization did not deploy new code.
- Verify model provenance, storage integrity, executable dependencies and approved component changes.
Explanation
Correct Answer
A:The reason it is necessary is: Hosted AI services can change behavior outside local release cycles and require external change governance. In this case: An accounting team cannot establish which hosted model version generated a disputed regulatory answer.
Incorrect Answers
B:This option concerns AI dataset refresh and feature pipeline approvals, which is a related but different AI governance concern. The decisive principle here is: Hosted AI services can change behavior outside local release cycles and require external change governance.
C:This attractive shortcut does not resolve the External foundation-model update change notices weakness: Assume there is no production change because the client organization did not deploy new code. In this case: An accounting team cannot establish which hosted model version generated a disputed regulatory answer.
D:This option concerns Foundation model dependency and artifact tampering, which is a related but different AI governance concern. It does not establish control effectiveness for External foundation-model update change notices.
Question 610
An independent AI auditor reviews this case: An accounting team cannot establish which hosted model version generated a disputed regulatory answer. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Assume there is no production change because the client organization did not deploy new code.
- Compare provider release notes, model ID, output baselines, contractual notices and drift alerts.
- Inspect signatures, hash attestations, artifact ACLs, dependency inventory and rebuild records.
- Require contractual update notifications, version observability, revalidation and compensating fallback for material supplier changes.
- Separate development, test and production roles with controlled promotion, scoped credentials and audit trails.
Explanation
Correct Answers
B:The reason it is necessary is: Hosted AI services can change behavior outside local release cycles and require external change governance. This evidence directly tests the asserted control for External foundation-model update change notices: Compare provider release notes, model ID, output baselines, contractual notices and drift alerts.
D:The reason it is necessary is: Hosted AI services can change behavior outside local release cycles and require external change governance. For this situation: An accounting team cannot establish which hosted model version generated a disputed regulatory answer.
Incorrect Answers
A:This attractive shortcut does not resolve the External foundation-model update change notices weakness: Assume there is no production change because the client organization did not deploy new code. For this situation: An accounting team cannot establish which hosted model version generated a disputed regulatory answer.
C:This option concerns Foundation model dependency and artifact tampering, which is a related but different AI governance concern. For this situation: An accounting team cannot establish which hosted model version generated a disputed regulatory answer.
E:This option concerns AI data and model CI/CD separation, which is a related but different AI governance concern. In this case: An accounting team cannot establish which hosted model version generated a disputed regulatory answer.
