Isaca AAIA Practice Test 83
Question 820
An independent AI auditor reviews this case: A competitor repeatedly queries a proprietary prediction API to recreate its behavior and pricing decisions. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Inspect authentication, rate limits, output granularity, query anomalies and abuse response.
- Rate-limit and monitor queries, restrict unnecessary output detail and evaluate extraction risks proportionate to value.
- Assume model theft requires downloading raw parameters and leave public prediction queries unrestricted.
- Separate development, test and production roles with controlled promotion, scoped credentials and audit trails.
- Inspect tool-call traces, retrieval source trust, instruction hierarchy tests and denied action logs.
Explanation
Correct Answers
A:The reason it is necessary is: Repeated API observations can reveal model behavior or sensitive correlations even without access to the weight files. For this situation: A competitor repeatedly queries a proprietary prediction API to recreate its behavior and pricing decisions.
B:The reason it is necessary is: Repeated API observations can reveal model behavior or sensitive correlations even without access to the weight files. This response fits the risk associated with AI model extraction and excessive query access: Rate-limit and monitor queries, restrict unnecessary output detail and evaluate extraction risks proportionate to value.
Incorrect Answers
C:This attractive shortcut does not resolve the AI model extraction and excessive query access weakness: Assume model theft requires downloading raw parameters and leave public prediction queries unrestricted. Effective closure requires: Suspicious extraction patterns are detected and unauthorized systematic probing is constrained.
D:This option concerns AI data and model CI/CD separation, which is a related but different AI governance concern. It does not establish control effectiveness for AI model extraction and excessive query access.
E:This option concerns Indirect prompt injection through retrieved content, which is a related but different AI governance concern. The decisive principle here is: Repeated API observations can reveal model behavior or sensitive correlations even without access to the weight files.
Question 821
A governance and assurance review uncovers the following: A public model endpoint allows unlimited high-dimensional confidence scores without per-client monitoring. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Rate-limit and monitor queries, restrict unnecessary output detail and evaluate extraction risks proportionate to value.
- Evaluate unintended inference from model outputs and minimize observable detail and query access.
- Coordinate technical recovery with affected stakeholder review, corrective communication and validated post-incident controls.
- Assume model theft requires downloading raw parameters and leave public prediction queries unrestricted.
Explanation
Correct Answer
A:The reason it is necessary is: Repeated API observations can reveal model behavior or sensitive correlations even without access to the weight files. In this case: A public model endpoint allows unlimited high-dimensional confidence scores without per-client monitoring.
Incorrect Answers
B:This option concerns Model inversion and sensitive attribute leakage, which is a related but different AI governance concern. It does not establish control effectiveness for AI model extraction and excessive query access.
C:This option concerns AI model rollback and stakeholder communication, which is a related but different AI governance concern. In this case: A public model endpoint allows unlimited high-dimensional confidence scores without per-client monitoring.
D:This attractive shortcut does not resolve the AI model extraction and excessive query access weakness: Assume model theft requires downloading raw parameters and leave public prediction queries unrestricted. In this case: A public model endpoint allows unlimited high-dimensional confidence scores without per-client monitoring.
Question 822
A risk-based audit engagement examines this operating condition: A public model endpoint allows unlimited high-dimensional confidence scores without per-client monitoring. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- An AI incident ends only after decision impacts, service restoration and recurrence risk are addressed.
- Model-generated text is untrusted as an authorization basis for real-world privileged actions.
- Repeated API observations can reveal model behavior or sensitive correlations even without access to the weight files.
- Assume model theft requires downloading raw parameters and leave public prediction queries unrestricted.
Explanation
Correct Answer
C:Independent audit evidence includes: Inspect authentication, rate limits, output granularity, query anomalies and abuse response. In this case: A public model endpoint allows unlimited high-dimensional confidence scores without per-client monitoring.
Incorrect Answers
A:This option concerns AI model rollback and stakeholder communication, which is a related but different AI governance concern. For this situation: A public model endpoint allows unlimited high-dimensional confidence scores without per-client monitoring.
B:This option concerns AI tool misuse and excessive agency, which is a related but different AI governance concern. The decisive principle here is: Repeated API observations can reveal model behavior or sensitive correlations even without access to the weight files.
D:This attractive shortcut does not resolve the AI model extraction and excessive query access weakness: Assume model theft requires downloading raw parameters and leave public prediction queries unrestricted. For this situation: A public model endpoint allows unlimited high-dimensional confidence scores without per-client monitoring.
Question 823
An audit committee asks for a defensible assessment of this situation: A public model endpoint allows unlimited high-dimensional confidence scores without per-client monitoring. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Inspect authentication, rate limits, output granularity, query anomalies and abuse response.
- Assume model theft requires downloading raw parameters and leave public prediction queries unrestricted.
- Inspect pipeline roles, artifact signatures, dataset permissions, approval gates and production change logs.
- Inspect tool-call traces, retrieval source trust, instruction hierarchy tests and denied action logs.
Explanation
Correct Answer
A:The reason it is necessary is: Repeated API observations can reveal model behavior or sensitive correlations even without access to the weight files. The corrective action is: Rate-limit and monitor queries, restrict unnecessary output detail and evaluate extraction risks proportionate to value.
Incorrect Answers
B:This attractive shortcut does not resolve the AI model extraction and excessive query access weakness: Assume model theft requires downloading raw parameters and leave public prediction queries unrestricted. Rate-limit and monitor queries, restrict unnecessary output detail and evaluate extraction risks proportionate to value.
C:This option concerns AI data and model CI/CD separation, which is a related but different AI governance concern. The decisive principle here is: Repeated API observations can reveal model behavior or sensitive correlations even without access to the weight files.
D:This option concerns Indirect prompt injection through retrieved content, which is a related but different AI governance concern. In this case: A public model endpoint allows unlimited high-dimensional confidence scores without per-client monitoring.
Question 824
During an AI controls assessment, the team learns that a public model endpoint allows unlimited high-dimensional confidence scores without per-client monitoring. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Unintended sensitive inference is bounded and logged access follows approved purpose.
- Assume model theft requires downloading raw parameters and leave public prediction queries unrestricted.
- Production loads only authenticated approved artifacts and tamper attempts are denied or alerted.
- Suspicious extraction patterns are detected and unauthorized systematic probing is constrained.
Explanation
Correct Answer
D:The reason it is necessary is: Repeated API observations can reveal model behavior or sensitive correlations even without access to the weight files. This is an observable validation result for AI model extraction and excessive query access, not just management assurance: Suspicious extraction patterns are detected and unauthorized systematic probing is constrained.
Incorrect Answers
A:This option concerns Model inversion and sensitive attribute leakage, which is a related but different AI governance concern. For this situation: A public model endpoint allows unlimited high-dimensional confidence scores without per-client monitoring.
B:For this situation: A public model endpoint allows unlimited high-dimensional confidence scores without per-client monitoring.
C:This option concerns Foundation model dependency and artifact tampering, which is a related but different AI governance concern. The decisive principle here is: Repeated API observations can reveal model behavior or sensitive correlations even without access to the weight files.
Question 825
An independent AI auditor reviews this case: A sensitive fraud-scoring service exposes detailed logits to anonymous callers and ignores scraping patterns. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Separate development, test and production roles with controlled promotion, scoped credentials and audit trails.
- Treat retrieved text as untrusted data, separate instruction authority and constrain downstream tool access.
- Assume model theft requires downloading raw parameters and leave public prediction queries unrestricted.
- Rate-limit and monitor queries, restrict unnecessary output detail and evaluate extraction risks proportionate to value.
Explanation
Correct Answer
D:The reason it is necessary is: Repeated API observations can reveal model behavior or sensitive correlations even without access to the weight files. In this case: A sensitive fraud-scoring service exposes detailed logits to anonymous callers and ignores scraping patterns.
Incorrect Answers
A:This option concerns AI data and model CI/CD separation, which is a related but different AI governance concern. In this case: A sensitive fraud-scoring service exposes detailed logits to anonymous callers and ignores scraping patterns.
B:This option concerns Indirect prompt injection through retrieved content, which is a related but different AI governance concern. In this case: A sensitive fraud-scoring service exposes detailed logits to anonymous callers and ignores scraping patterns.
C:This attractive shortcut does not resolve the AI model extraction and excessive query access weakness: Assume model theft requires downloading raw parameters and leave public prediction queries unrestricted. In this case: A sensitive fraud-scoring service exposes detailed logits to anonymous callers and ignores scraping patterns.
Question 826
A governance and assurance review uncovers the following: A sensitive fraud-scoring service exposes detailed logits to anonymous callers and ignores scraping patterns. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Repeated API observations can reveal model behavior or sensitive correlations even without access to the weight files.
- Assume model theft requires downloading raw parameters and leave public prediction queries unrestricted.
- Embedding and retrieval layers are separate data-integrity surfaces that can manipulate downstream model answers.
- Model weights, parsers and surrounding runtime code belong in the software and data supply-chain threat model.
Explanation
Correct Answer
A:Independent audit evidence includes: Inspect authentication, rate limits, output granularity, query anomalies and abuse response. In this case: A sensitive fraud-scoring service exposes detailed logits to anonymous callers and ignores scraping patterns.
Incorrect Answers
B:This attractive shortcut does not resolve the AI model extraction and excessive query access weakness: Assume model theft requires downloading raw parameters and leave public prediction queries unrestricted. For this situation: A sensitive fraud-scoring service exposes detailed logits to anonymous callers and ignores scraping patterns.
C:This option concerns Poisoned embedding and vector retrieval index, which is a related but different AI governance concern. The decisive principle here is: Repeated API observations can reveal model behavior or sensitive correlations even without access to the weight files.
D:This option concerns Foundation model dependency and artifact tampering, which is a related but different AI governance concern. In this case: A sensitive fraud-scoring service exposes detailed logits to anonymous callers and ignores scraping patterns.
Question 827
A risk-based audit engagement examines this operating condition: A sensitive fraud-scoring service exposes detailed logits to anonymous callers and ignores scraping patterns. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Assume model theft requires downloading raw parameters and leave public prediction queries unrestricted.
- Inspect signatures, hash attestations, artifact ACLs, dependency inventory and rebuild records.
- Inspect authentication, rate limits, output granularity, query anomalies and abuse response.
- Inspect dataset snapshots, feature pipeline commits, record counts, model registry links and training execution manifests.
Explanation
Correct Answer
C:The reason it is necessary is: Repeated API observations can reveal model behavior or sensitive correlations even without access to the weight files. The acceptable verified outcome is: Suspicious extraction patterns are detected and unauthorized systematic probing is constrained.
Incorrect Answers
A:For this situation: A sensitive fraud-scoring service exposes detailed logits to anonymous callers and ignores scraping patterns.
B:This option concerns Foundation model dependency and artifact tampering, which is a related but different AI governance concern. For this situation: A sensitive fraud-scoring service exposes detailed logits to anonymous callers and ignores scraping patterns.
D:This option concerns AI training dataset lineage and reproducibility, which is a related but different AI governance concern. It does not establish control effectiveness for AI model extraction and excessive query access.
Question 828
An audit committee asks for a defensible assessment of this situation: A sensitive fraud-scoring service exposes detailed logits to anonymous callers and ignores scraping patterns. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Only signed approved model-data combinations reach production and privilege tests fail closed.
- Assume model theft requires downloading raw parameters and leave public prediction queries unrestricted.
- Suspicious extraction patterns are detected and unauthorized systematic probing is constrained.
- Only approved corpus changes influence outputs, and unexpected ranking changes trigger investigation.
Explanation
Correct Answer
C:This is an observable validation result for AI model extraction and excessive query access, not just management assurance: Suspicious extraction patterns are detected and unauthorized systematic probing is constrained.
Incorrect Answers
A:This option concerns AI data and model CI/CD separation, which is a related but different AI governance concern. For this situation: A sensitive fraud-scoring service exposes detailed logits to anonymous callers and ignores scraping patterns.
B:It misses the key control principle: Repeated API observations can reveal model behavior or sensitive correlations even without access to the weight files.
D:This option concerns Poisoned embedding and vector retrieval index, which is a related but different AI governance concern. For this situation: A sensitive fraud-scoring service exposes detailed logits to anonymous callers and ignores scraping patterns.
Question 829
During an AI controls assessment, the team learns that a chatbot with a shell tool can execute arbitrary commands after it reads attacker-controlled support tickets. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Evaluate unintended inference from model outputs and minimize observable detail and query access.
- Give an agent global tool permissions because its system prompt says it should never misuse them.
- Define annotation rubrics, representative blind review, disagreement resolution and documented quality thresholds.
- Scope tools to specific identities and approved operations with pre-execution authorization and transaction caps.
Explanation
Correct Answer
D:The reason it is necessary is: Model-generated text is untrusted as an authorization basis for real-world privileged actions. In this case: A chatbot with a shell tool can execute arbitrary commands after it reads attacker-controlled support tickets.
Incorrect Answers
A:This option concerns Model inversion and sensitive attribute leakage, which is a related but different AI governance concern. It does not establish control effectiveness for AI tool misuse and excessive agency.
B:This attractive shortcut does not resolve the AI tool misuse and excessive agency weakness: Give an agent global tool permissions because its system prompt says it should never misuse them.
C:This option concerns Label quality and human annotator agreement, which is a related but different AI governance concern. It does not establish control effectiveness for AI tool misuse and excessive agency.
Question 830
An independent AI auditor reviews this case: A chatbot with a shell tool can execute arbitrary commands after it reads attacker-controlled support tickets. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Scope tools to specific identities and approved operations with pre-execution authorization and transaction caps.
- Give an agent global tool permissions because its system prompt says it should never misuse them.
- Authenticate retrieval corpus updates, isolate tenants and test ranking anomalies and source integrity.
- Inspect tool-call traces, retrieval source trust, instruction hierarchy tests and denied action logs.
- Inspect tool manifests, service accounts, approval gates, injection tests and action receipts.
Explanation
Correct Answers
A:The reason it is necessary is: Model-generated text is untrusted as an authorization basis for real-world privileged actions. For this situation: A chatbot with a shell tool can execute arbitrary commands after it reads attacker-controlled support tickets.
E:The reason it is necessary is: Model-generated text is untrusted as an authorization basis for real-world privileged actions. This evidence directly tests the asserted control for AI tool misuse and excessive agency: Inspect tool manifests, service accounts, approval gates, injection tests and action receipts.
Incorrect Answers
B:This attractive shortcut does not resolve the AI tool misuse and excessive agency weakness: Give an agent global tool permissions because its system prompt says it should never misuse them. For this situation: A chatbot with a shell tool can execute arbitrary commands after it reads attacker-controlled support tickets.
C:This option concerns Poisoned embedding and vector retrieval index, which is a related but different AI governance concern. It does not establish control effectiveness for AI tool misuse and excessive agency.
D:This option concerns Indirect prompt injection through retrieved content, which is a related but different AI governance concern. It does not establish control effectiveness for AI tool misuse and excessive agency.
