cert
cert-1
cert-2

Pass Isaca AAIA Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
AAIA Exam - Verified By Experts
AAIA Premium Bundle
$14.99

AAIA Premium Bundle

$74.99
$89.98
  • Premium File 556 Questions & Answers. Last update: Nov 08, 2026
  • Training Course 110 Video Lectures
 
$89.98
$74.99
accept 22 downloads in last 7 days
block-screenshots
Purchase Isaca AAIA Exam Training Products Individually
Isaca AAIA Premium File
Premium File 556 Q&A
$76.99$69.99
Isaca AAIA Video Training Course
Training Course 110 Lectures
$21.99 $19.99
Isaca AAIA Practice Test 62

Question 610

An independent AI auditor reviews this case: An accounting team cannot establish which hosted model version generated a disputed regulatory answer. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.

  1. Assume there is no production change because the client organization did not deploy new code.
  2. Compare provider release notes, model ID, output baselines, contractual notices and drift alerts.
  3. Inspect signatures, hash attestations, artifact ACLs, dependency inventory and rebuild records.
  4. Require contractual update notifications, version observability, revalidation and compensating fallback for material supplier changes.
  5. Separate development, test and production roles with controlled promotion, scoped credentials and audit trails.

Explanation

Correct Answers

B:

The reason it is necessary is: Hosted AI services can change behavior outside local release cycles and require external change governance. This evidence directly tests the asserted control for External foundation-model update change notices: Compare provider release notes, model ID, output baselines, contractual notices and drift alerts.

D:

The reason it is necessary is: Hosted AI services can change behavior outside local release cycles and require external change governance. For this situation: An accounting team cannot establish which hosted model version generated a disputed regulatory answer.

Incorrect Answers

A:

This attractive shortcut does not resolve the External foundation-model update change notices weakness: Assume there is no production change because the client organization did not deploy new code. For this situation: An accounting team cannot establish which hosted model version generated a disputed regulatory answer.

C:

This option concerns Foundation model dependency and artifact tampering, which is a related but different AI governance concern. For this situation: An accounting team cannot establish which hosted model version generated a disputed regulatory answer.

E:

This option concerns AI data and model CI/CD separation, which is a related but different AI governance concern. In this case: An accounting team cannot establish which hosted model version generated a disputed regulatory answer.

Question 611

A governance and assurance review uncovers the following: An accounting team cannot establish which hosted model version generated a disputed regulatory answer. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.

  1. Compare before-after distributions, update artifacts, critical use cases, approval rules and rollback records.
  2. Inspect source contracts, schema diffs, baseline distributions, feature tests and observed scoring changes.
  3. Compare provider release notes, model ID, output baselines, contractual notices and drift alerts.
  4. Assume there is no production change because the client organization did not deploy new code.

Explanation

Correct Answer

C:

For this situation: An accounting team cannot establish which hosted model version generated a disputed regulatory answer.

Incorrect Answers

A:

This option concerns Model version change impact classification, which is a related but different AI governance concern. In this case: An accounting team cannot establish which hosted model version generated a disputed regulatory answer.

B:

This option concerns AI dataset refresh and feature pipeline approvals, which is a related but different AI governance concern. For this situation: An accounting team cannot establish which hosted model version generated a disputed regulatory answer.

D:

It misses the key control principle: Hosted AI services can change behavior outside local release cycles and require external change governance.

Question 612

A risk-based audit engagement examines this operating condition: An accounting team cannot establish which hosted model version generated a disputed regulatory answer. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.

  1. Assume there is no production change because the client organization did not deploy new code.
  2. Material external changes are assessed before or promptly after adoption with controlled escalation.
  3. Emergency deviations expire or receive accountable renewal and critical controls are verified restored.
  4. Unacceptable changes are contained promptly and validated prior behavior is restored.

Explanation

Correct Answer

B:

This is an observable validation result for External foundation-model update change notices, not just management assurance: Material external changes are assessed before or promptly after adoption with controlled escalation.

Incorrect Answers

A:

The auditor should instead examine: Compare provider release notes, model ID, output baselines, contractual notices and drift alerts.

C:

This option concerns AI configuration and emergency change traceability, which is a related but different AI governance concern. The decisive principle here is: Hosted AI services can change behavior outside local release cycles and require external change governance.

D:

This option concerns Canary releases and model rollback thresholds, which is a related but different AI governance concern. In this case: An accounting team cannot establish which hosted model version generated a disputed regulatory answer.

Question 613

An audit committee asks for a defensible assessment of this situation: A credit model retrains nightly from a new third-party identity feed with no quality gate after schema changes. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.

  1. Control schema, source, feature and data refreshes using integrity and semantic compatibility tests.
  2. Version prompt templates, permission boundaries and evaluation suites with staged approvals and rollback.
  3. Treat incoming data pipeline modifications as harmless because no model weights were altered.
  4. Classify model, data, prompt and feature changes by potential behavior impact and require appropriate regression testing.

Explanation

Correct Answer

A:

The reason it is necessary is: The same model weights can behave differently when feature definitions or data feeds change. Independent audit evidence includes: Inspect source contracts, schema diffs, baseline distributions, feature tests and observed scoring changes.

Incorrect Answers

B:

This option concerns Prompt template governance and injection-resilience changes, which is a related but different AI governance concern. It does not establish control effectiveness for AI dataset refresh and feature pipeline approvals.

C:

This attractive shortcut does not resolve the AI dataset refresh and feature pipeline approvals weakness: Treat incoming data pipeline modifications as harmless because no model weights were altered.

D:

This option concerns Model version change impact classification, which is a related but different AI governance concern. It does not establish control effectiveness for AI dataset refresh and feature pipeline approvals.

Question 614

During an AI controls assessment, the team learns that a credit model retrains nightly from a new third-party identity feed with no quality gate after schema changes. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.

  1. Treat incoming data pipeline modifications as harmless because no model weights were altered.
  2. Prompts are executable behavioral configuration and can change output and risk without code deployment.
  3. The same model weights can behave differently when feature definitions or data feeds change.
  4. AI changes can alter decisions without modifying the application UI or infrastructure code.

Explanation

Correct Answer

C:

Independent audit evidence includes: Inspect source contracts, schema diffs, baseline distributions, feature tests and observed scoring changes. This is the applicable AI audit principle for AI dataset refresh and feature pipeline approvals: The same model weights can behave differently when feature definitions or data feeds change.

Incorrect Answers

A:

That option would treat incoming data pipeline modifications as harmless because no model weights were altered, but it addresses a different concern. This is the applicable AI audit principle for AI dataset refresh and feature pipeline approvals: The same model weights can behave differently when feature definitions or data feeds change. Control schema, source, feature and data refreshes using integrity and semantic compatibility tests.

B:

This option concerns Prompt template governance and injection-resilience changes, which is a related but different AI governance concern. For this situation: A credit model retrains nightly from a new third-party identity feed with no quality gate after schema changes.

D:

This option concerns Model version change impact classification, which is a related but different AI governance concern. For this situation: A credit model retrains nightly from a new third-party identity feed with no quality gate after schema changes.

Question 615

An independent AI auditor reviews this case: A credit model retrains nightly from a new third-party identity feed with no quality gate after schema changes. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.

  1. Inspect canary assignment, segment KPIs, error thresholds, baseline model artifacts and rollback drill.
  2. Inspect source contracts, schema diffs, baseline distributions, feature tests and observed scoring changes.
  3. Inspect config state histories, privileges, break-glass logs, time bounds and post-incident review.
  4. Treat incoming data pipeline modifications as harmless because no model weights were altered.

Explanation

Correct Answer

B:

The reason it is necessary is: The same model weights can behave differently when feature definitions or data feeds change. This evidence directly tests the asserted control for AI dataset refresh and feature pipeline approvals: Inspect source contracts, schema diffs, baseline distributions, feature tests and observed scoring changes.

Incorrect Answers

A:

This option concerns Canary releases and model rollback thresholds, which is a related but different AI governance concern. It does not establish control effectiveness for AI dataset refresh and feature pipeline approvals.

C:

This option concerns AI configuration and emergency change traceability, which is a related but different AI governance concern. It does not establish control effectiveness for AI dataset refresh and feature pipeline approvals.

D:

This attractive shortcut does not resolve the AI dataset refresh and feature pipeline approvals weakness: Treat incoming data pipeline modifications as harmless because no model weights were altered. For this situation: A credit model retrains nightly from a new third-party identity feed with no quality gate after schema changes.

Question 616

A governance and assurance review uncovers the following: A credit model retrains nightly from a new third-party identity feed with no quality gate after schema changes. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.

  1. Treat incoming data pipeline modifications as harmless because no model weights were altered.
  2. Material external changes are assessed before or promptly after adoption with controlled escalation.
  3. Unapproved data changes are blocked and approved refreshes preserve input meaning and quality.
  4. Material behavioral changes receive proportionate approvals and do not bypass previously defined controls.

Explanation

Correct Answer

C:

The reason it is necessary is: The same model weights can behave differently when feature definitions or data feeds change. This is an observable validation result for AI dataset refresh and feature pipeline approvals, not just management assurance: Unapproved data changes are blocked and approved refreshes preserve input meaning and quality.

Incorrect Answers

A:

This attractive shortcut does not resolve the AI dataset refresh and feature pipeline approvals weakness: Treat incoming data pipeline modifications as harmless because no model weights were altered. The auditor should instead examine: Inspect source contracts, schema diffs, baseline distributions, feature tests and observed scoring changes.

B:

This option concerns External foundation-model update change notices, which is a related but different AI governance concern. It does not establish control effectiveness for AI dataset refresh and feature pipeline approvals.

D:

This option concerns Model version change impact classification, which is a related but different AI governance concern. The decisive principle here is: The same model weights can behave differently when feature definitions or data feeds change.

Question 617

A risk-based audit engagement examines this operating condition: A manufacturer adds a sensor to predictive maintenance without assessing missing values or distribution shift. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.

  1. Classify model, data, prompt and feature changes by potential behavior impact and require appropriate regression testing.
  2. Treat incoming data pipeline modifications as harmless because no model weights were altered.
  3. Control schema, source, feature and data refreshes using integrity and semantic compatibility tests.
  4. Require contractual update notifications, version observability, revalidation and compensating fallback for material supplier changes.

Explanation

Correct Answer

C:

The reason it is necessary is: The same model weights can behave differently when feature definitions or data feeds change. The acceptable verified outcome is: Unapproved data changes are blocked and approved refreshes preserve input meaning and quality.

Incorrect Answers

A:

This option concerns Model version change impact classification, which is a related but different AI governance concern. In this case: A manufacturer adds a sensor to predictive maintenance without assessing missing values or distribution shift.

B:

This attractive shortcut does not resolve the AI dataset refresh and feature pipeline approvals weakness: Treat incoming data pipeline modifications as harmless because no model weights were altered. In this case: A manufacturer adds a sensor to predictive maintenance without assessing missing values or distribution shift.

D:

This option concerns External foundation-model update change notices, which is a related but different AI governance concern. The decisive principle here is: The same model weights can behave differently when feature definitions or data feeds change.

Question 618

An audit committee asks for a defensible assessment of this situation: A manufacturer adds a sensor to predictive maintenance without assessing missing values or distribution shift. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.

  1. Prompts are executable behavioral configuration and can change output and risk without code deployment.
  2. The same model weights can behave differently when feature definitions or data feeds change.
  3. Treat incoming data pipeline modifications as harmless because no model weights were altered.
  4. Gradual deployment reduces blast radius only if meaningful indicators and rollback decisions are predefined.

Explanation

Correct Answer

B:

Independent audit evidence includes: Inspect source contracts, schema diffs, baseline distributions, feature tests and observed scoring changes. The acceptable verified outcome is: Unapproved data changes are blocked and approved refreshes preserve input meaning and quality.

Incorrect Answers

A:

This option concerns Prompt template governance and injection-resilience changes, which is a related but different AI governance concern. The decisive principle here is: The same model weights can behave differently when feature definitions or data feeds change.

C:

That option would treat incoming data pipeline modifications as harmless because no model weights were altered, but it addresses a different concern. This is the applicable AI audit principle for AI dataset refresh and feature pipeline approvals: The same model weights can behave differently when feature definitions or data feeds change. For this situation: A manufacturer adds a sensor to predictive maintenance without assessing missing values or distribution shift.

D:

This option concerns Canary releases and model rollback thresholds, which is a related but different AI governance concern. The decisive principle here is: The same model weights can behave differently when feature definitions or data feeds change.

Question 619

During an AI controls assessment, the team learns that a manufacturer adds a sensor to predictive maintenance without assessing missing values or distribution shift. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.

  1. Inspect prompt history, version diffs, tested attack cases, tool allowlists and release tickets.
  2. Treat incoming data pipeline modifications as harmless because no model weights were altered.
  3. Compare provider release notes, model ID, output baselines, contractual notices and drift alerts.
  4. Inspect source contracts, schema diffs, baseline distributions, feature tests and observed scoring changes.

Explanation

Correct Answer

D:

The reason it is necessary is: The same model weights can behave differently when feature definitions or data feeds change. In this case: A manufacturer adds a sensor to predictive maintenance without assessing missing values or distribution shift.

Incorrect Answers

A:

This option concerns Prompt template governance and injection-resilience changes, which is a related but different AI governance concern. For this situation: A manufacturer adds a sensor to predictive maintenance without assessing missing values or distribution shift.

B:

This attractive shortcut does not resolve the AI dataset refresh and feature pipeline approvals weakness: Treat incoming data pipeline modifications as harmless because no model weights were altered. For this situation: A manufacturer adds a sensor to predictive maintenance without assessing missing values or distribution shift.

C:

This option concerns External foundation-model update change notices, which is a related but different AI governance concern. For this situation: A manufacturer adds a sensor to predictive maintenance without assessing missing values or distribution shift.

Question 620

An independent AI auditor reviews this case: A manufacturer adds a sensor to predictive maintenance without assessing missing values or distribution shift. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.

  1. Control schema, source, feature and data refreshes using integrity and semantic compatibility tests.
  2. Inspect source contracts, schema diffs, baseline distributions, feature tests and observed scoring changes.
  3. Enforce point-in-time joins and temporal cutoffs for training and evaluation features.
  4. Compare provider release notes, model ID, output baselines, contractual notices and drift alerts.
  5. Treat incoming data pipeline modifications as harmless because no model weights were altered.

Explanation

Correct Answers

A:

The reason it is necessary is: The same model weights can behave differently when feature definitions or data feeds change. For this situation: A manufacturer adds a sensor to predictive maintenance without assessing missing values or distribution shift.

B:

The reason it is necessary is: The same model weights can behave differently when feature definitions or data feeds change. The corrective action is: Control schema, source, feature and data refreshes using integrity and semantic compatibility tests.

Incorrect Answers

C:

This option concerns Feature-store time leakage in model evaluation, which is a related but different AI governance concern. It does not establish control effectiveness for AI dataset refresh and feature pipeline approvals.

D:

This option concerns External foundation-model update change notices, which is a related but different AI governance concern. The audit must corroborate: Inspect source contracts, schema diffs, baseline distributions, feature tests and observed scoring changes.

E:

This attractive shortcut does not resolve the AI dataset refresh and feature pipeline approvals weakness: Treat incoming data pipeline modifications as harmless because no model weights were altered. Effective closure requires: Unapproved data changes are blocked and approved refreshes preserve input meaning and quality.

ISACA Advanced in AI Audit (AAIA) Practice Tests