Isaca AAIA Practice Test 71
Question 700
An independent AI auditor reviews this case: A rejected applicant is told a computer made the decision and there is no channel to correct erroneous input. Which THREE elements together provide a defensible AI audit conclusion: the corrective control, the evidence to test it, and a verified outcome? Select THREE answers.
- Valid challenges produce traceable investigation and timely remedy rather than automated restatement.
- Define appeal as displaying the AI output again without an independent person or correction mechanism.
- Review appeal turnaround, reviewer authority, data correction process, overturned cases and notices.
- Design actionable challenge, human reassessment, factual correction and remediation for adverse AI decisions.
- Compare ingestion source identities, sampling patterns, hash manifests, anomaly screens and approval records.
- Define calibrated thresholds and safe defer-to-human or rule-based fallbacks for uncertain or missing-data conditions.
Explanation
Correct Answers
A:The reason it is necessary is: An appeal path is meaningful when it can correct underlying facts and change outcomes where justified. This is an observable validation result for Customer appeal and remedy for automated outcomes, not just management assurance: Valid challenges produce traceable investigation and timely remedy rather than automated restatement.
C:The reason it is necessary is: An appeal path is meaningful when it can correct underlying facts and change outcomes where justified. For this situation: A rejected applicant is told a computer made the decision and there is no channel to correct erroneous input.
D:The reason it is necessary is: An appeal path is meaningful when it can correct underlying facts and change outcomes where justified. This response fits the risk associated with Customer appeal and remedy for automated outcomes: Design actionable challenge, human reassessment, factual correction and remediation for adverse AI decisions.
Incorrect Answers
B:This attractive shortcut does not resolve the Customer appeal and remedy for automated outcomes weakness: Define appeal as displaying the AI output again without an independent person or correction mechanism. Effective closure requires: Valid challenges produce traceable investigation and timely remedy rather than automated restatement.
E:This option concerns Data poisoning prevention in automated ingestion, which is a related but different AI governance concern. The decisive principle here is: An appeal path is meaningful when it can correct underlying facts and change outcomes where justified.
F:This option concerns Threshold governance and safety fallbacks, which is a related but different AI governance concern. It does not establish control effectiveness for Customer appeal and remedy for automated outcomes.
Question 701
A governance and assurance review uncovers the following: An insurer allows appeals but the reviewer can only repeat the same model score without independent assessment. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Define appeal as displaying the AI output again without an independent person or correction mechanism.
- Define owner-led ongoing monitoring for quality, drift, safety, fairness and service impact with escalation.
- Verify feedback provenance, reviewer authority and sampling before incorporating live corrections into future models.
- Design actionable challenge, human reassessment, factual correction and remediation for adverse AI decisions.
Explanation
Correct Answer
D:The reason it is necessary is: An appeal path is meaningful when it can correct underlying facts and change outcomes where justified. In this case: An insurer allows appeals but the reviewer can only repeat the same model score without independent assessment.
Incorrect Answers
A:This attractive shortcut does not resolve the Customer appeal and remedy for automated outcomes weakness: Define appeal as displaying the AI output again without an independent person or correction mechanism. In this case: An insurer allows appeals but the reviewer can only repeat the same model score without independent assessment.
B:This option concerns AI post-deployment monitoring and KRI ownership, which is a related but different AI governance concern. It does not establish control effectiveness for Customer appeal and remedy for automated outcomes.
C:This option concerns Feedback-loop contamination from user corrections, which is a related but different AI governance concern. The decisive principle here is: An appeal path is meaningful when it can correct underlying facts and change outcomes where justified.
Question 702
A risk-based audit engagement examines this operating condition: An insurer allows appeals but the reviewer can only repeat the same model score without independent assessment. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Training-data integrity is a control boundary because malicious or flawed inputs can change model behavior persistently.
- Feedback improves models only when its quality and susceptibility to manipulation are controlled.
- An appeal path is meaningful when it can correct underlying facts and change outcomes where justified.
- Define appeal as displaying the AI output again without an independent person or correction mechanism.
Explanation
Correct Answer
C:The acceptable verified outcome is: Valid challenges produce traceable investigation and timely remedy rather than automated restatement. In this case: An insurer allows appeals but the reviewer can only repeat the same model score without independent assessment.
Incorrect Answers
A:This option concerns Data poisoning prevention in automated ingestion, which is a related but different AI governance concern. In this case: An insurer allows appeals but the reviewer can only repeat the same model score without independent assessment.
B:This option concerns Feedback-loop contamination from user corrections, which is a related but different AI governance concern. For this situation: An insurer allows appeals but the reviewer can only repeat the same model score without independent assessment.
D:This attractive shortcut does not resolve the Customer appeal and remedy for automated outcomes weakness: Define appeal as displaying the AI output again without an independent person or correction mechanism. For this situation: An insurer allows appeals but the reviewer can only repeat the same model score without independent assessment.
Question 703
An audit committee asks for a defensible assessment of this situation: An insurer allows appeals but the reviewer can only repeat the same model score without independent assessment. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Compare ingestion source identities, sampling patterns, hash manifests, anomaly screens and approval records.
- Review appeal turnaround, reviewer authority, data correction process, overturned cases and notices.
- Define appeal as displaying the AI output again without an independent person or correction mechanism.
- Inspect logging schema, privacy redaction, identifiers, time ordering, retention and replay tests.
Explanation
Correct Answer
B:The reason it is necessary is: An appeal path is meaningful when it can correct underlying facts and change outcomes where justified. The corrective action is: Design actionable challenge, human reassessment, factual correction and remediation for adverse AI decisions.
Incorrect Answers
A:This option concerns Data poisoning prevention in automated ingestion, which is a related but different AI governance concern. For this situation: An insurer allows appeals but the reviewer can only repeat the same model score without independent assessment.
C:This attractive shortcut does not resolve the Customer appeal and remedy for automated outcomes weakness: Define appeal as displaying the AI output again without an independent person or correction mechanism. Design actionable challenge, human reassessment, factual correction and remediation for adverse AI decisions.
D:This option concerns AI decision logs and explanation traceability, which is a related but different AI governance concern. The decisive principle here is: An appeal path is meaningful when it can correct underlying facts and change outcomes where justified.
Question 704
During an AI controls assessment, the team learns that an insurer allows appeals but the reviewer can only repeat the same model score without independent assessment. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Define appeal as displaying the AI output again without an independent person or correction mechanism.
- Valid challenges produce traceable investigation and timely remedy rather than automated restatement.
- Contaminated feeds are contained and verified clean data can be restored without corrupting promoted models.
- Uncertain cases route safely and measured errors remain within approved operational and fairness limits.
Explanation
Correct Answer
B:The reason it is necessary is: An appeal path is meaningful when it can correct underlying facts and change outcomes where justified. Independent audit evidence includes: Review appeal turnaround, reviewer authority, data correction process, overturned cases and notices.
Incorrect Answers
A:For this situation: An insurer allows appeals but the reviewer can only repeat the same model score without independent assessment.
C:This option concerns Data poisoning prevention in automated ingestion, which is a related but different AI governance concern. The audit must corroborate: Review appeal turnaround, reviewer authority, data correction process, overturned cases and notices.
D:This option concerns Threshold governance and safety fallbacks, which is a related but different AI governance concern. The decisive principle here is: An appeal path is meaningful when it can correct underlying facts and change outcomes where justified.
Question 705
An independent AI auditor reviews this case: An AI benefit estimator misclassifies families and support agents cannot identify who can authorize correction. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Verify feedback provenance, reviewer authority and sampling before incorporating live corrections into future models.
- Limit agent authority by least-privilege tools, transaction ceilings, pre-action approval and post-action verification.
- Design actionable challenge, human reassessment, factual correction and remediation for adverse AI decisions.
- Define appeal as displaying the AI output again without an independent person or correction mechanism.
Explanation
Correct Answer
C:The reason it is necessary is: An appeal path is meaningful when it can correct underlying facts and change outcomes where justified. In this case: An AI benefit estimator misclassifies families and support agents cannot identify who can authorize correction.
Incorrect Answers
A:This option concerns Feedback-loop contamination from user corrections, which is a related but different AI governance concern. In this case: An AI benefit estimator misclassifies families and support agents cannot identify who can authorize correction.
B:This option concerns Autonomous agent action-limit supervision, which is a related but different AI governance concern. The decisive principle here is: An appeal path is meaningful when it can correct underlying facts and change outcomes where justified.
D:This attractive shortcut does not resolve the Customer appeal and remedy for automated outcomes weakness: Define appeal as displaying the AI output again without an independent person or correction mechanism. In this case: An AI benefit estimator misclassifies families and support agents cannot identify who can authorize correction.
Question 706
A governance and assurance review uncovers the following: An AI benefit estimator misclassifies families and support agents cannot identify who can authorize correction. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Production AI monitoring must measure harmful outcomes, not merely infrastructure availability.
- An appeal path is meaningful when it can correct underlying facts and change outcomes where justified.
- Training-data integrity is a control boundary because malicious or flawed inputs can change model behavior persistently.
- Define appeal as displaying the AI output again without an independent person or correction mechanism.
Explanation
Correct Answer
B:The acceptable verified outcome is: Valid challenges produce traceable investigation and timely remedy rather than automated restatement. In this case: An AI benefit estimator misclassifies families and support agents cannot identify who can authorize correction.
Incorrect Answers
A:This option concerns AI post-deployment monitoring and KRI ownership, which is a related but different AI governance concern. The decisive principle here is: An appeal path is meaningful when it can correct underlying facts and change outcomes where justified.
C:This option concerns Data poisoning prevention in automated ingestion, which is a related but different AI governance concern. In this case: An AI benefit estimator misclassifies families and support agents cannot identify who can authorize correction.
D:This attractive shortcut does not resolve the Customer appeal and remedy for automated outcomes weakness: Define appeal as displaying the AI output again without an independent person or correction mechanism. For this situation: An AI benefit estimator misclassifies families and support agents cannot identify who can authorize correction.
Question 707
A risk-based audit engagement examines this operating condition: An AI benefit estimator misclassifies families and support agents cannot identify who can authorize correction. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Inspect reviewer workload, UI, explanations, override log and interviews on actual cases.
- Inspect dataset snapshots, feature pipeline commits, record counts, model registry links and training execution manifests.
- Define appeal as displaying the AI output again without an independent person or correction mechanism.
- Review appeal turnaround, reviewer authority, data correction process, overturned cases and notices.
Explanation
Correct Answer
D:The acceptable verified outcome is: Valid challenges produce traceable investigation and timely remedy rather than automated restatement.
Incorrect Answers
A:This option concerns Effective human oversight of AI recommendations, which is a related but different AI governance concern. In this case: An AI benefit estimator misclassifies families and support agents cannot identify who can authorize correction.
B:This option concerns AI training dataset lineage and reproducibility, which is a related but different AI governance concern. It does not establish control effectiveness for Customer appeal and remedy for automated outcomes.
C:For this situation: An AI benefit estimator misclassifies families and support agents cannot identify who can authorize correction.
Question 708
An audit committee asks for a defensible assessment of this situation: An AI benefit estimator misclassifies families and support agents cannot identify who can authorize correction. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Uncertain cases route safely and measured errors remain within approved operational and fairness limits.
- Unapproved high-impact actions are blocked before execution, and approved actions are attributable.
- Valid challenges produce traceable investigation and timely remedy rather than automated restatement.
- Define appeal as displaying the AI output again without an independent person or correction mechanism.
Explanation
Correct Answer
C:This is an observable validation result for Customer appeal and remedy for automated outcomes, not just management assurance: Valid challenges produce traceable investigation and timely remedy rather than automated restatement.
Incorrect Answers
A:This option concerns Threshold governance and safety fallbacks, which is a related but different AI governance concern. In this case: An AI benefit estimator misclassifies families and support agents cannot identify who can authorize correction.
B:This option concerns Autonomous agent action-limit supervision, which is a related but different AI governance concern. For this situation: An AI benefit estimator misclassifies families and support agents cannot identify who can authorize correction.
D:It misses the key control principle: An appeal path is meaningful when it can correct underlying facts and change outcomes where justified.
Question 709
During an AI controls assessment, the team learns that a procurement agent can create vendor payments beyond its approval limit because tool scopes mirror an administrator account. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Limit agent authority by least-privilege tools, transaction ceilings, pre-action approval and post-action verification.
- Provide reviewers timely context, override authority, training and auditable independent decision space.
- Give an AI agent full administrator rights and rely on a natural-language instruction to act carefully.
- Disable or restrict affected tools, preserve transaction records and verify downstream changes before re-enabling.
Explanation
Correct Answer
A:The reason it is necessary is: Autonomous action risk is driven by actual tool permissions and decision gates, not chatbot prompt wording alone. Independent audit evidence includes: Inspect service identities, tool-call logs, policy checks, denial tests and human approval traces.
Incorrect Answers
B:This option concerns Effective human oversight of AI recommendations, which is a related but different AI governance concern. It does not establish control effectiveness for Autonomous agent action-limit supervision.
C:This attractive shortcut does not resolve the Autonomous agent action-limit supervision weakness: Give an AI agent full administrator rights and rely on a natural-language instruction to act carefully.
D:This option concerns AI agent unauthorized action incident, which is a related but different AI governance concern. It does not establish control effectiveness for Autonomous agent action-limit supervision.
Question 710
An independent AI auditor reviews this case: A procurement agent can create vendor payments beyond its approval limit because tool scopes mirror an administrator account. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Inspect service identities, tool-call logs, policy checks, denial tests and human approval traces.
- Inspect reviewer workload, UI, explanations, override log and interviews on actual cases.
- Limit agent authority by least-privilege tools, transaction ceilings, pre-action approval and post-action verification.
- Give an AI agent full administrator rights and rely on a natural-language instruction to act carefully.
- Design actionable challenge, human reassessment, factual correction and remediation for adverse AI decisions.
Explanation
Correct Answers
A:The reason it is necessary is: Autonomous action risk is driven by actual tool permissions and decision gates, not chatbot prompt wording alone. This evidence directly tests the asserted control for Autonomous agent action-limit supervision: Inspect service identities, tool-call logs, policy checks, denial tests and human approval traces.
C:The reason it is necessary is: Autonomous action risk is driven by actual tool permissions and decision gates, not chatbot prompt wording alone. For this situation: A procurement agent can create vendor payments beyond its approval limit because tool scopes mirror an administrator account.
Incorrect Answers
B:This option concerns Effective human oversight of AI recommendations, which is a related but different AI governance concern. For this situation: A procurement agent can create vendor payments beyond its approval limit because tool scopes mirror an administrator account.
D:This attractive shortcut does not resolve the Autonomous agent action-limit supervision weakness: Give an AI agent full administrator rights and rely on a natural-language instruction to act carefully. For this situation: A procurement agent can create vendor payments beyond its approval limit because tool scopes mirror an administrator account.
E:This option concerns Customer appeal and remedy for automated outcomes, which is a related but different AI governance concern. It does not establish control effectiveness for Autonomous agent action-limit supervision.
