Isaca AAIA Practice Test 8
Question 70
An independent AI auditor reviews this case: A social benefits model permits staff to override outcomes but never records the reason or who changed the result. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Label a fully automatic process human supervised simply because a person can view a dashboard.
- Design usable human review with understandable context, authority to intervene, escalation and traceable decisions.
- Conduct a documented impact assessment of purpose, necessity, proportionality, alternatives and safeguards before deployment.
- Sample user interface, override permissions, time pressure, rationale records and actual reviewer interventions.
- Review cluster validation, anomaly score distributions, seasonal control populations, downstream actions and analyst adjudications.
Explanation
Correct Answers
B:The reason it is necessary is: A human rubber stamp without information or authority does not provide effective human oversight. For this situation: A social benefits model permits staff to override outcomes but never records the reason or who changed the result.
D:This evidence directly tests the asserted control for Human oversight design for high-impact AI: Sample user interface, override permissions, time pressure, rationale records and actual reviewer interventions.
Incorrect Answers
A:This attractive shortcut does not resolve the Human oversight design for high-impact AI weakness: Label a fully automatic process human supervised simply because a person can view a dashboard. For this situation: A social benefits model permits staff to override outcomes but never records the reason or who changed the result.
C:This option concerns Privacy impact assessment for biometric AI, which is a related but different AI governance concern. For this situation: A social benefits model permits staff to override outcomes but never records the reason or who changed the result.
E:This option concerns Unsupervised anomaly detection and alert governance, which is a related but different AI governance concern. In this case: A social benefits model permits staff to override outcomes but never records the reason or who changed the result.
Question 71
A governance and assurance review uncovers the following: A social benefits model permits staff to override outcomes but never records the reason or who changed the result. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Sample user interface, override permissions, time pressure, rationale records and actual reviewer interventions.
- Label a fully automatic process human supervised simply because a person can view a dashboard.
- Compare use-case requirements, deterministic baselines, quantitative error rates, grounded outputs and exception handling.
- Review cluster validation, anomaly score distributions, seasonal control populations, downstream actions and analyst adjudications.
Explanation
Correct Answer
A:For this situation: A social benefits model permits staff to override outcomes but never records the reason or who changed the result.
Incorrect Answers
B:It misses the key control principle: A human rubber stamp without information or authority does not provide effective human oversight.
C:This option concerns Predictive versus generative model task fit, which is a related but different AI governance concern. In this case: A social benefits model permits staff to override outcomes but never records the reason or who changed the result.
D:This option concerns Unsupervised anomaly detection and alert governance, which is a related but different AI governance concern. For this situation: A social benefits model permits staff to override outcomes but never records the reason or who changed the result.
Question 72
A risk-based audit engagement examines this operating condition: A social benefits model permits staff to override outcomes but never records the reason or who changed the result. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Reviewers demonstrate independent judgment and appropriate overturns with auditable documentation.
- Sampled denials have faithful understandable reasons, reliable escalation and documented accuracy versus simpler alternatives.
- Label a fully automatic process human supervised simply because a person can view a dashboard.
- Selected components meet task-specific accuracy, controllability and auditability tests on representative work.
Explanation
Correct Answer
A:This is an observable validation result for Human oversight design for high-impact AI, not just management assurance: Reviewers demonstrate independent judgment and appropriate overturns with auditable documentation.
Incorrect Answers
B:This option concerns Explainable credit-model selection for adverse decisions, which is a related but different AI governance concern. The decisive principle here is: A human rubber stamp without information or authority does not provide effective human oversight.
C:The auditor should instead examine: Sample user interface, override permissions, time pressure, rationale records and actual reviewer interventions.
D:This option concerns Predictive versus generative model task fit, which is a related but different AI governance concern. For this situation: A social benefits model permits staff to override outcomes but never records the reason or who changed the result.
Question 73
An audit committee asks for a defensible assessment of this situation: A bank averages three credit models trained on the same mislabeled historical data and calls the ensemble independent. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Identify relevant AI Act roles, use-case classifications, jurisdictions and applicable obligations with competent legal input.
- Require traceable retrieved-source references, corpus version controls and answer checks that distinguish source evidence from inference.
- Evaluate shared data, dependencies and failure modes of model components, rather than counting models as independent assurance.
- Treat a three-model vote as independent validation without checking shared data and error patterns.
Explanation
Correct Answer
C:The reason it is necessary is: Model diversity does not eliminate common-cause errors when inputs, architectures or suppliers are correlated. This is the proportionate control response to Multi-model ensemble risk and failure correlation: Evaluate shared data, dependencies and failure modes of model components, rather than counting models as independent assurance.
Incorrect Answers
A:This option concerns EU AI Act role and risk classification, which is a related but different AI governance concern. It does not establish control effectiveness for Multi-model ensemble risk and failure correlation.
B:This option concerns Retrieval-augmented answer grounding, which is a related but different AI governance concern. It does not establish control effectiveness for Multi-model ensemble risk and failure correlation.
D:This attractive shortcut does not resolve the Multi-model ensemble risk and failure correlation weakness: Treat a three-model vote as independent validation without checking shared data and error patterns.
Question 74
During an AI controls assessment, the team learns that a bank averages three credit models trained on the same mislabeled historical data and calls the ensemble independent. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- A useful aggregate prediction may still cause disproportionate consequences for affected people and demands context-specific governance.
- Risk classification and provider/deployer roles affect obligations; they cannot be assumed from product branding.
- Model diversity does not eliminate common-cause errors when inputs, architectures or suppliers are correlated.
- Treat a three-model vote as independent validation without checking shared data and error patterns.
Explanation
Correct Answer
C:The corrective action is: Evaluate shared data, dependencies and failure modes of model components, rather than counting models as independent assurance. This is the applicable AI audit principle for Multi-model ensemble risk and failure correlation: Model diversity does not eliminate common-cause errors when inputs, architectures or suppliers are correlated.
Incorrect Answers
A:This option concerns Automated decision impact on individuals, which is a related but different AI governance concern. It does not establish control effectiveness for Multi-model ensemble risk and failure correlation.
B:This option concerns EU AI Act role and risk classification, which is a related but different AI governance concern. The decisive principle here is: Model diversity does not eliminate common-cause errors when inputs, architectures or suppliers are correlated.
D:This attractive shortcut does not resolve the Multi-model ensemble risk and failure correlation weakness: Treat a three-model vote as independent validation without checking shared data and error patterns. For this situation: A bank averages three credit models trained on the same mislabeled historical data and calls the ensemble independent.
Question 75
An independent AI auditor reviews this case: A bank averages three credit models trained on the same mislabeled historical data and calls the ensemble independent. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Treat a three-model vote as independent validation without checking shared data and error patterns.
- Examine decision map, error costs, affected populations, human override authority, complaints and impact assessment.
- Trace shared feature pipelines, benchmark provenance, model supplier relationships, correlated misses and failover tests.
- Inspect retrieval traces, passage IDs, document dates, authorization filters, answer citation fidelity and no-answer cases.
Explanation
Correct Answer
C:The reason it is necessary is: Model diversity does not eliminate common-cause errors when inputs, architectures or suppliers are correlated. This evidence directly tests the asserted control for Multi-model ensemble risk and failure correlation: Trace shared feature pipelines, benchmark provenance, model supplier relationships, correlated misses and failover tests.
Incorrect Answers
A:This attractive shortcut does not resolve the Multi-model ensemble risk and failure correlation weakness: Treat a three-model vote as independent validation without checking shared data and error patterns. The auditor should instead examine: Trace shared feature pipelines, benchmark provenance, model supplier relationships, correlated misses and failover tests.
B:This option concerns Automated decision impact on individuals, which is a related but different AI governance concern. The decisive principle here is: Model diversity does not eliminate common-cause errors when inputs, architectures or suppliers are correlated.
D:This option concerns Retrieval-augmented answer grounding, which is a related but different AI governance concern. The decisive principle here is: Model diversity does not eliminate common-cause errors when inputs, architectures or suppliers are correlated.
Question 76
A governance and assurance review uncovers the following: A bank averages three credit models trained on the same mislabeled historical data and calls the ensemble independent. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Adverse outcomes, challenge rights and corrections are monitored with approved accountable decision owners.
- Organization documents role-specific obligations and controls for its actual use and checks changes over time.
- Treat a three-model vote as independent validation without checking shared data and error patterns.
- Independent challenge tests detect correlated failure and evidence supports any reliability uplift claimed for the ensemble.
Explanation
Correct Answer
D:The reason it is necessary is: Model diversity does not eliminate common-cause errors when inputs, architectures or suppliers are correlated. The corrective action is: Evaluate shared data, dependencies and failure modes of model components, rather than counting models as independent assurance.
Incorrect Answers
A:This option concerns Automated decision impact on individuals, which is a related but different AI governance concern. For this situation: A bank averages three credit models trained on the same mislabeled historical data and calls the ensemble independent.
B:This option concerns EU AI Act role and risk classification, which is a related but different AI governance concern. For this situation: A bank averages three credit models trained on the same mislabeled historical data and calls the ensemble independent.
C:This attractive shortcut does not resolve the Multi-model ensemble risk and failure correlation weakness: Treat a three-model vote as independent validation without checking shared data and error patterns. Evaluate shared data, dependencies and failure modes of model components, rather than counting models as independent assurance.
Question 77
A risk-based audit engagement examines this operating condition: An AI fraud platform uses multiple models sharing one upstream feature store whose outage corrupts all scores simultaneously. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Design usable human review with understandable context, authority to intervene, escalation and traceable decisions.
- Evaluate shared data, dependencies and failure modes of model components, rather than counting models as independent assurance.
- Treat a three-model vote as independent validation without checking shared data and error patterns.
- Require traceable retrieved-source references, corpus version controls and answer checks that distinguish source evidence from inference.
Explanation
Correct Answer
B:The reason it is necessary is: Model diversity does not eliminate common-cause errors when inputs, architectures or suppliers are correlated. Independent audit evidence includes: Trace shared feature pipelines, benchmark provenance, model supplier relationships, correlated misses and failover tests.
Incorrect Answers
A:This option concerns Human oversight design for high-impact AI, which is a related but different AI governance concern. It does not establish control effectiveness for Multi-model ensemble risk and failure correlation.
C:This attractive shortcut does not resolve the Multi-model ensemble risk and failure correlation weakness: Treat a three-model vote as independent validation without checking shared data and error patterns. Effective closure requires: Independent challenge tests detect correlated failure and evidence supports any reliability uplift claimed for the ensemble.
D:This option concerns Retrieval-augmented answer grounding, which is a related but different AI governance concern. The audit must corroborate: Trace shared feature pipelines, benchmark provenance, model supplier relationships, correlated misses and failover tests.
Question 78
An audit committee asks for a defensible assessment of this situation: An AI fraud platform uses multiple models sharing one upstream feature store whose outage corrupts all scores simultaneously. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Treat a three-model vote as independent validation without checking shared data and error patterns.
- Retrieval can reduce unsupported answers only if accessible current material is relevant and citations actually support claims.
- A useful aggregate prediction may still cause disproportionate consequences for affected people and demands context-specific governance.
- Model diversity does not eliminate common-cause errors when inputs, architectures or suppliers are correlated.
Explanation
Correct Answer
D:The corrective action is: Evaluate shared data, dependencies and failure modes of model components, rather than counting models as independent assurance. Independent audit evidence includes: Trace shared feature pipelines, benchmark provenance, model supplier relationships, correlated misses and failover tests.
Incorrect Answers
A:This attractive shortcut does not resolve the Multi-model ensemble risk and failure correlation weakness: Treat a three-model vote as independent validation without checking shared data and error patterns. For this situation: An AI fraud platform uses multiple models sharing one upstream feature store whose outage corrupts all scores simultaneously.
B:This option concerns Retrieval-augmented answer grounding, which is a related but different AI governance concern. For this situation: An AI fraud platform uses multiple models sharing one upstream feature store whose outage corrupts all scores simultaneously.
C:This option concerns Automated decision impact on individuals, which is a related but different AI governance concern. The audit must corroborate: Trace shared feature pipelines, benchmark provenance, model supplier relationships, correlated misses and failover tests.
Question 79
During an AI controls assessment, the team learns that an AI fraud platform uses multiple models sharing one upstream feature store whose outage corrupts all scores simultaneously. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Compare use-case requirements, deterministic baselines, quantitative error rates, grounded outputs and exception handling.
- Treat a three-model vote as independent validation without checking shared data and error patterns.
- Trace shared feature pipelines, benchmark provenance, model supplier relationships, correlated misses and failover tests.
- Inspect use-case criticality, model comparison, reason-code fidelity, feature lineage, adverse-decision samples and appeal test results.
Explanation
Correct Answer
C:The reason it is necessary is: Model diversity does not eliminate common-cause errors when inputs, architectures or suppliers are correlated. The acceptable verified outcome is: Independent challenge tests detect correlated failure and evidence supports any reliability uplift claimed for the ensemble.
Incorrect Answers
A:This option concerns Predictive versus generative model task fit, which is a related but different AI governance concern. It does not establish control effectiveness for Multi-model ensemble risk and failure correlation.
B:It misses the key control principle: Model diversity does not eliminate common-cause errors when inputs, architectures or suppliers are correlated.
D:This option concerns Explainable credit-model selection for adverse decisions, which is a related but different AI governance concern. It does not establish control effectiveness for Multi-model ensemble risk and failure correlation.
Question 80
An independent AI auditor reviews this case: An AI fraud platform uses multiple models sharing one upstream feature store whose outage corrupts all scores simultaneously. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Treat a three-model vote as independent validation without checking shared data and error patterns.
- Evaluate shared data, dependencies and failure modes of model components, rather than counting models as independent assurance.
- Design usable human review with understandable context, authority to intervene, escalation and traceable decisions.
- Trace shared feature pipelines, benchmark provenance, model supplier relationships, correlated misses and failover tests.
- Inspect system purpose, actors, changes, market placement, impact, legal analysis and current phased applicability.
Explanation
Correct Answers
B:The reason it is necessary is: Model diversity does not eliminate common-cause errors when inputs, architectures or suppliers are correlated. This response fits the risk associated with Multi-model ensemble risk and failure correlation: Evaluate shared data, dependencies and failure modes of model components, rather than counting models as independent assurance.
D:The reason it is necessary is: Model diversity does not eliminate common-cause errors when inputs, architectures or suppliers are correlated. For this situation: An AI fraud platform uses multiple models sharing one upstream feature store whose outage corrupts all scores simultaneously.
Incorrect Answers
A:For this situation: An AI fraud platform uses multiple models sharing one upstream feature store whose outage corrupts all scores simultaneously.
C:This option concerns Human oversight design for high-impact AI, which is a related but different AI governance concern. The decisive principle here is: Model diversity does not eliminate common-cause errors when inputs, architectures or suppliers are correlated.
E:This option concerns EU AI Act role and risk classification, which is a related but different AI governance concern. The audit must corroborate: Trace shared feature pipelines, benchmark provenance, model supplier relationships, correlated misses and failover tests.
