cert
cert-1
cert-2

Pass Isaca AAIA Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
AAIA Exam - Verified By Experts
AAIA Premium Bundle
$14.99

AAIA Premium Bundle

$74.99
$89.98
  • Premium File 556 Questions & Answers. Last update: Nov 08, 2026
  • Training Course 110 Video Lectures
 
$89.98
$74.99
accept 22 downloads in last 7 days
block-screenshots
Purchase Isaca AAIA Exam Training Products Individually
Isaca AAIA Premium File
Premium File 556 Q&A
$76.99$69.99
Isaca AAIA Video Training Course
Training Course 110 Lectures
$21.99 $19.99
Isaca AAIA Practice Test 63

Question 620

An independent AI auditor reviews this case: A manufacturer adds a sensor to predictive maintenance without assessing missing values or distribution shift. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.

  1. Control schema, source, feature and data refreshes using integrity and semantic compatibility tests.
  2. Inspect source contracts, schema diffs, baseline distributions, feature tests and observed scoring changes.
  3. Enforce point-in-time joins and temporal cutoffs for training and evaluation features.
  4. Compare provider release notes, model ID, output baselines, contractual notices and drift alerts.
  5. Treat incoming data pipeline modifications as harmless because no model weights were altered.

Explanation

Correct Answers

A:

The reason it is necessary is: The same model weights can behave differently when feature definitions or data feeds change. For this situation: A manufacturer adds a sensor to predictive maintenance without assessing missing values or distribution shift.

B:

The reason it is necessary is: The same model weights can behave differently when feature definitions or data feeds change. The corrective action is: Control schema, source, feature and data refreshes using integrity and semantic compatibility tests.

Incorrect Answers

C:

This option concerns Feature-store time leakage in model evaluation, which is a related but different AI governance concern. It does not establish control effectiveness for AI dataset refresh and feature pipeline approvals.

D:

This option concerns External foundation-model update change notices, which is a related but different AI governance concern. The audit must corroborate: Inspect source contracts, schema diffs, baseline distributions, feature tests and observed scoring changes.

E:

This attractive shortcut does not resolve the AI dataset refresh and feature pipeline approvals weakness: Treat incoming data pipeline modifications as harmless because no model weights were altered. Effective closure requires: Unapproved data changes are blocked and approved refreshes preserve input meaning and quality.

Question 621

A governance and assurance review uncovers the following: A hiring system switches resume parsing vendors while training features change meaning without approval. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.

  1. Enforce point-in-time joins and temporal cutoffs for training and evaluation features.
  2. Treat incoming data pipeline modifications as harmless because no model weights were altered.
  3. Control schema, source, feature and data refreshes using integrity and semantic compatibility tests.
  4. Require contractual update notifications, version observability, revalidation and compensating fallback for material supplier changes.

Explanation

Correct Answer

C:

The reason it is necessary is: The same model weights can behave differently when feature definitions or data feeds change. In this case: A hiring system switches resume parsing vendors while training features change meaning without approval.

Incorrect Answers

A:

This option concerns Feature-store time leakage in model evaluation, which is a related but different AI governance concern. The decisive principle here is: The same model weights can behave differently when feature definitions or data feeds change.

B:

This attractive shortcut does not resolve the AI dataset refresh and feature pipeline approvals weakness: Treat incoming data pipeline modifications as harmless because no model weights were altered. In this case: A hiring system switches resume parsing vendors while training features change meaning without approval.

D:

This option concerns External foundation-model update change notices, which is a related but different AI governance concern. In this case: A hiring system switches resume parsing vendors while training features change meaning without approval.

Question 622

A risk-based audit engagement examines this operating condition: A hiring system switches resume parsing vendors while training features change meaning without approval. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.

  1. AI changes can alter decisions without modifying the application UI or infrastructure code.
  2. Treat incoming data pipeline modifications as harmless because no model weights were altered.
  3. Gradual deployment reduces blast radius only if meaningful indicators and rollback decisions are predefined.
  4. The same model weights can behave differently when feature definitions or data feeds change.

Explanation

Correct Answer

D:

Independent audit evidence includes: Inspect source contracts, schema diffs, baseline distributions, feature tests and observed scoring changes. In this case: A hiring system switches resume parsing vendors while training features change meaning without approval.

Incorrect Answers

A:

This option concerns Model version change impact classification, which is a related but different AI governance concern. In this case: A hiring system switches resume parsing vendors while training features change meaning without approval.

B:

That option would treat incoming data pipeline modifications as harmless because no model weights were altered, but it addresses a different concern. This is the applicable AI audit principle for AI dataset refresh and feature pipeline approvals: The same model weights can behave differently when feature definitions or data feeds change. For this situation: A hiring system switches resume parsing vendors while training features change meaning without approval.

C:

This option concerns Canary releases and model rollback thresholds, which is a related but different AI governance concern. In this case: A hiring system switches resume parsing vendors while training features change meaning without approval.

Question 623

An audit committee asks for a defensible assessment of this situation: A hiring system switches resume parsing vendors while training features change meaning without approval. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.

  1. Inspect dataset snapshots, feature pipeline commits, record counts, model registry links and training execution manifests.
  2. Inspect source contracts, schema diffs, baseline distributions, feature tests and observed scoring changes.
  3. Treat incoming data pipeline modifications as harmless because no model weights were altered.
  4. Inspect config state histories, privileges, break-glass logs, time bounds and post-incident review.

Explanation

Correct Answer

B:

This evidence directly tests the asserted control for AI dataset refresh and feature pipeline approvals: Inspect source contracts, schema diffs, baseline distributions, feature tests and observed scoring changes.

Incorrect Answers

A:

This option concerns AI training dataset lineage and reproducibility, which is a related but different AI governance concern. It does not establish control effectiveness for AI dataset refresh and feature pipeline approvals.

C:

This attractive shortcut does not resolve the AI dataset refresh and feature pipeline approvals weakness: Treat incoming data pipeline modifications as harmless because no model weights were altered. For this situation: A hiring system switches resume parsing vendors while training features change meaning without approval.

D:

This option concerns AI configuration and emergency change traceability, which is a related but different AI governance concern. The decisive principle here is: The same model weights can behave differently when feature definitions or data feeds change.

Question 624

During an AI controls assessment, the team learns that a hiring system switches resume parsing vendors while training features change meaning without approval. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.

  1. Material behavioral changes receive proportionate approvals and do not bypass previously defined controls.
  2. Unapproved data changes are blocked and approved refreshes preserve input meaning and quality.
  3. Held-out evaluation uses only information available at the decision time and predicts realistic production performance.
  4. Treat incoming data pipeline modifications as harmless because no model weights were altered.

Explanation

Correct Answer

B:

This is an observable validation result for AI dataset refresh and feature pipeline approvals, not just management assurance: Unapproved data changes are blocked and approved refreshes preserve input meaning and quality.

Incorrect Answers

A:

This option concerns Model version change impact classification, which is a related but different AI governance concern. For this situation: A hiring system switches resume parsing vendors while training features change meaning without approval.

C:

This option concerns Feature-store time leakage in model evaluation, which is a related but different AI governance concern. For this situation: A hiring system switches resume parsing vendors while training features change meaning without approval.

D:

This attractive shortcut does not resolve the AI dataset refresh and feature pipeline approvals weakness: Treat incoming data pipeline modifications as harmless because no model weights were altered. Control schema, source, feature and data refreshes using integrity and semantic compatibility tests.

Question 625

An independent AI auditor reviews this case: A fraud service changes threshold values during an incident without recording who approved the change. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.

  1. Control schema, source, feature and data refreshes using integrity and semantic compatibility tests.
  2. Log emergency AI configuration changes, require proportionate approval, expiry and post-change validation.
  3. Classify model, data, prompt and feature changes by potential behavior impact and require appropriate regression testing.
  4. Permit permanent undocumented exceptions after an urgent model outage.

Explanation

Correct Answer

B:

The reason it is necessary is: AI safety depends on configuration state as well as model artifacts; emergency bypasses need disciplined control. In this case: A fraud service changes threshold values during an incident without recording who approved the change.

Incorrect Answers

A:

This option concerns AI dataset refresh and feature pipeline approvals, which is a related but different AI governance concern. It does not establish control effectiveness for AI configuration and emergency change traceability.

C:

This option concerns Model version change impact classification, which is a related but different AI governance concern. It does not establish control effectiveness for AI configuration and emergency change traceability.

D:

This attractive shortcut does not resolve the AI configuration and emergency change traceability weakness: Permit permanent undocumented exceptions after an urgent model outage.

Question 626

A governance and assurance review uncovers the following: A fraud service changes threshold values during an incident without recording who approved the change. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.

  1. AI changes can alter decisions without modifying the application UI or infrastructure code.
  2. AI safety depends on configuration state as well as model artifacts; emergency bypasses need disciplined control.
  3. Permit permanent undocumented exceptions after an urgent model outage.
  4. Hosted AI services can change behavior outside local release cycles and require external change governance.

Explanation

Correct Answer

B:

The corrective action is: Log emergency AI configuration changes, require proportionate approval, expiry and post-change validation. In this case: A fraud service changes threshold values during an incident without recording who approved the change.

Incorrect Answers

A:

This option concerns Model version change impact classification, which is a related but different AI governance concern. For this situation: A fraud service changes threshold values during an incident without recording who approved the change.

C:

This attractive shortcut does not resolve the AI configuration and emergency change traceability weakness: Permit permanent undocumented exceptions after an urgent model outage. For this situation: A fraud service changes threshold values during an incident without recording who approved the change.

D:

This option concerns External foundation-model update change notices, which is a related but different AI governance concern. It does not establish control effectiveness for AI configuration and emergency change traceability.

Question 627

A risk-based audit engagement examines this operating condition: A fraud service changes threshold values during an incident without recording who approved the change. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.

  1. Inspect source contracts, schema diffs, baseline distributions, feature tests and observed scoring changes.
  2. Permit permanent undocumented exceptions after an urgent model outage.
  3. Inspect signed use cases, requirement trace matrix, outcome thresholds, known limitations and test cases.
  4. Inspect config state histories, privileges, break-glass logs, time bounds and post-incident review.

Explanation

Correct Answer

D:

The reason it is necessary is: AI safety depends on configuration state as well as model artifacts; emergency bypasses need disciplined control. The corrective action is: Log emergency AI configuration changes, require proportionate approval, expiry and post-change validation.

Incorrect Answers

A:

This option concerns AI dataset refresh and feature pipeline approvals, which is a related but different AI governance concern. For this situation: A fraud service changes threshold values during an incident without recording who approved the change.

B:

This attractive shortcut does not resolve the AI configuration and emergency change traceability weakness: Permit permanent undocumented exceptions after an urgent model outage. The auditor should instead examine: Inspect config state histories, privileges, break-glass logs, time bounds and post-incident review.

C:

This option concerns AI requirements-to-acceptance traceability, which is a related but different AI governance concern. It does not establish control effectiveness for AI configuration and emergency change traceability.

Question 628

An audit committee asks for a defensible assessment of this situation: A fraud service changes threshold values during an incident without recording who approved the change. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.

  1. Permit permanent undocumented exceptions after an urgent model outage.
  2. Each material requirement maps to a result and signoff before deploying the feature.
  3. Emergency deviations expire or receive accountable renewal and critical controls are verified restored.
  4. Unacceptable changes are contained promptly and validated prior behavior is restored.

Explanation

Correct Answer

C:

The reason it is necessary is: AI safety depends on configuration state as well as model artifacts; emergency bypasses need disciplined control. This is an observable validation result for AI configuration and emergency change traceability, not just management assurance: Emergency deviations expire or receive accountable renewal and critical controls are verified restored.

Incorrect Answers

A:

This attractive shortcut does not resolve the AI configuration and emergency change traceability weakness: Permit permanent undocumented exceptions after an urgent model outage. Log emergency AI configuration changes, require proportionate approval, expiry and post-change validation.

B:

This option concerns AI requirements-to-acceptance traceability, which is a related but different AI governance concern. For this situation: A fraud service changes threshold values during an incident without recording who approved the change.

D:

This option concerns Canary releases and model rollback thresholds, which is a related but different AI governance concern. It does not establish control effectiveness for AI configuration and emergency change traceability.

Question 629

During an AI controls assessment, the team learns that an AI agent's external tool permissions are widened temporarily but never rolled back after testing. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.

  1. Log emergency AI configuration changes, require proportionate approval, expiry and post-change validation.
  2. Control schema, source, feature and data refreshes using integrity and semantic compatibility tests.
  3. Create traceable business, human impact, security and quality requirements with measurable release and acceptance gates.
  4. Permit permanent undocumented exceptions after an urgent model outage.

Explanation

Correct Answer

A:

The reason it is necessary is: AI safety depends on configuration state as well as model artifacts; emergency bypasses need disciplined control. In this case: An AI agent's external tool permissions are widened temporarily but never rolled back after testing.

Incorrect Answers

B:

This option concerns AI dataset refresh and feature pipeline approvals, which is a related but different AI governance concern. The decisive principle here is: AI safety depends on configuration state as well as model artifacts; emergency bypasses need disciplined control.

C:

This option concerns AI requirements-to-acceptance traceability, which is a related but different AI governance concern. The decisive principle here is: AI safety depends on configuration state as well as model artifacts; emergency bypasses need disciplined control.

D:

This attractive shortcut does not resolve the AI configuration and emergency change traceability weakness: Permit permanent undocumented exceptions after an urgent model outage. In this case: An AI agent's external tool permissions are widened temporarily but never rolled back after testing.

Question 630

An independent AI auditor reviews this case: An AI agent's external tool permissions are widened temporarily but never rolled back after testing. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.

  1. Classify model, data, prompt and feature changes by potential behavior impact and require appropriate regression testing.
  2. Permit permanent undocumented exceptions after an urgent model outage.
  3. Inspect config state histories, privileges, break-glass logs, time bounds and post-incident review.
  4. Log emergency AI configuration changes, require proportionate approval, expiry and post-change validation.
  5. Inspect prompt history, version diffs, tested attack cases, tool allowlists and release tickets.

Explanation

Correct Answers

C:

The reason it is necessary is: AI safety depends on configuration state as well as model artifacts; emergency bypasses need disciplined control. This evidence directly tests the asserted control for AI configuration and emergency change traceability: Inspect config state histories, privileges, break-glass logs, time bounds and post-incident review.

D:

The reason it is necessary is: AI safety depends on configuration state as well as model artifacts; emergency bypasses need disciplined control. For this situation: An AI agent's external tool permissions are widened temporarily but never rolled back after testing.

Incorrect Answers

A:

This option concerns Model version change impact classification, which is a related but different AI governance concern. The decisive principle here is: AI safety depends on configuration state as well as model artifacts; emergency bypasses need disciplined control.

B:

This attractive shortcut does not resolve the AI configuration and emergency change traceability weakness: Permit permanent undocumented exceptions after an urgent model outage. For this situation: An AI agent's external tool permissions are widened temporarily but never rolled back after testing.

E:

This option concerns Prompt template governance and injection-resilience changes, which is a related but different AI governance concern. It does not establish control effectiveness for AI configuration and emergency change traceability.

ISACA Advanced in AI Audit (AAIA) Practice Tests