Isaca AAIA Practice Test 84
Question 830
An independent AI auditor reviews this case: A chatbot with a shell tool can execute arbitrary commands after it reads attacker-controlled support tickets. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Scope tools to specific identities and approved operations with pre-execution authorization and transaction caps.
- Give an agent global tool permissions because its system prompt says it should never misuse them.
- Authenticate retrieval corpus updates, isolate tenants and test ranking anomalies and source integrity.
- Inspect tool-call traces, retrieval source trust, instruction hierarchy tests and denied action logs.
- Inspect tool manifests, service accounts, approval gates, injection tests and action receipts.
Explanation
Correct Answers
A:The reason it is necessary is: Model-generated text is untrusted as an authorization basis for real-world privileged actions. For this situation: A chatbot with a shell tool can execute arbitrary commands after it reads attacker-controlled support tickets.
E:The reason it is necessary is: Model-generated text is untrusted as an authorization basis for real-world privileged actions. This evidence directly tests the asserted control for AI tool misuse and excessive agency: Inspect tool manifests, service accounts, approval gates, injection tests and action receipts.
Incorrect Answers
B:This attractive shortcut does not resolve the AI tool misuse and excessive agency weakness: Give an agent global tool permissions because its system prompt says it should never misuse them. For this situation: A chatbot with a shell tool can execute arbitrary commands after it reads attacker-controlled support tickets.
C:This option concerns Poisoned embedding and vector retrieval index, which is a related but different AI governance concern. It does not establish control effectiveness for AI tool misuse and excessive agency.
D:This option concerns Indirect prompt injection through retrieved content, which is a related but different AI governance concern. It does not establish control effectiveness for AI tool misuse and excessive agency.
Question 831
A governance and assurance review uncovers the following: A chatbot with a shell tool can execute arbitrary commands after it reads attacker-controlled support tickets. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Inspect dataset snapshots, feature pipeline commits, record counts, model registry links and training execution manifests.
- Inspect tool manifests, service accounts, approval gates, injection tests and action receipts.
- Give an agent global tool permissions because its system prompt says it should never misuse them.
- Inspect output schemas, reconstruction probes, privacy threat model, aggregation and access restrictions.
Explanation
Correct Answer
B:The reason it is necessary is: Model-generated text is untrusted as an authorization basis for real-world privileged actions. The corrective action is: Scope tools to specific identities and approved operations with pre-execution authorization and transaction caps.
Incorrect Answers
A:This option concerns AI training dataset lineage and reproducibility, which is a related but different AI governance concern. It does not establish control effectiveness for AI tool misuse and excessive agency.
C:This attractive shortcut does not resolve the AI tool misuse and excessive agency weakness: Give an agent global tool permissions because its system prompt says it should never misuse them. It misses the key control principle: Model-generated text is untrusted as an authorization basis for real-world privileged actions.
D:This option concerns Model inversion and sensitive attribute leakage, which is a related but different AI governance concern. For this situation: A chatbot with a shell tool can execute arbitrary commands after it reads attacker-controlled support tickets.
Question 832
A risk-based audit engagement examines this operating condition: A chatbot with a shell tool can execute arbitrary commands after it reads attacker-controlled support tickets. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Give an agent global tool permissions because its system prompt says it should never misuse them.
- Requests outside approved privilege and business policy are refused before any sensitive side effect.
- Unintended sensitive inference is bounded and logged access follows approved purpose.
- Malicious document instructions cannot cause prohibited tool actions or confidential-data release.
Explanation
Correct Answer
B:The reason it is necessary is: Model-generated text is untrusted as an authorization basis for real-world privileged actions. This is an observable validation result for AI tool misuse and excessive agency, not just management assurance: Requests outside approved privilege and business policy are refused before any sensitive side effect.
Incorrect Answers
A:This attractive shortcut does not resolve the AI tool misuse and excessive agency weakness: Give an agent global tool permissions because its system prompt says it should never misuse them. The auditor should instead examine: Inspect tool manifests, service accounts, approval gates, injection tests and action receipts.
C:This option concerns Model inversion and sensitive attribute leakage, which is a related but different AI governance concern. The decisive principle here is: Model-generated text is untrusted as an authorization basis for real-world privileged actions.
D:This option concerns Indirect prompt injection through retrieved content, which is a related but different AI governance concern. For this situation: A chatbot with a shell tool can execute arbitrary commands after it reads attacker-controlled support tickets.
Question 833
An audit committee asks for a defensible assessment of this situation: An AI purchasing agent holds database-owner credentials merely to check order status. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Define annotation rubrics, representative blind review, disagreement resolution and documented quality thresholds.
- Give an agent global tool permissions because its system prompt says it should never misuse them.
- Scope tools to specific identities and approved operations with pre-execution authorization and transaction caps.
- Verify model provenance, storage integrity, executable dependencies and approved component changes.
Explanation
Correct Answer
C:The reason it is necessary is: Model-generated text is untrusted as an authorization basis for real-world privileged actions. This is the proportionate control response to AI tool misuse and excessive agency: Scope tools to specific identities and approved operations with pre-execution authorization and transaction caps.
Incorrect Answers
A:This option concerns Label quality and human annotator agreement, which is a related but different AI governance concern. The decisive principle here is: Model-generated text is untrusted as an authorization basis for real-world privileged actions.
B:This attractive shortcut does not resolve the AI tool misuse and excessive agency weakness: Give an agent global tool permissions because its system prompt says it should never misuse them. Effective closure requires: Requests outside approved privilege and business policy are refused before any sensitive side effect.
D:This option concerns Foundation model dependency and artifact tampering, which is a related but different AI governance concern. It does not establish control effectiveness for AI tool misuse and excessive agency.
Question 834
During an AI controls assessment, the team learns that an AI purchasing agent holds database-owner credentials merely to check order status. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Model-generated text is untrusted as an authorization basis for real-world privileged actions.
- Give an agent global tool permissions because its system prompt says it should never misuse them.
- A model can disclose information statistically through outputs even without returning underlying records verbatim.
- Garbage or inconsistent ground-truth labels cap model validity even if the learning algorithm is sophisticated.
Explanation
Correct Answer
A:Independent audit evidence includes: Inspect tool manifests, service accounts, approval gates, injection tests and action receipts. This is the applicable AI audit principle for AI tool misuse and excessive agency: Model-generated text is untrusted as an authorization basis for real-world privileged actions.
Incorrect Answers
B:This attractive shortcut does not resolve the AI tool misuse and excessive agency weakness: Give an agent global tool permissions because its system prompt says it should never misuse them. For this situation: An AI purchasing agent holds database-owner credentials merely to check order status.
C:This option concerns Model inversion and sensitive attribute leakage, which is a related but different AI governance concern. The audit must corroborate: Inspect tool manifests, service accounts, approval gates, injection tests and action receipts.
D:This option concerns Label quality and human annotator agreement, which is a related but different AI governance concern. For this situation: An AI purchasing agent holds database-owner credentials merely to check order status.
Question 835
An independent AI auditor reviews this case: An AI purchasing agent holds database-owner credentials merely to check order status. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Inspect index access, chunk hashes, ingest logs, tenant segregation and adversarial retrieval results.
- Inspect signatures, hash attestations, artifact ACLs, dependency inventory and rebuild records.
- Inspect tool manifests, service accounts, approval gates, injection tests and action receipts.
- Give an agent global tool permissions because its system prompt says it should never misuse them.
Explanation
Correct Answer
C:The reason it is necessary is: Model-generated text is untrusted as an authorization basis for real-world privileged actions. The acceptable verified outcome is: Requests outside approved privilege and business policy are refused before any sensitive side effect.
Incorrect Answers
A:This option concerns Poisoned embedding and vector retrieval index, which is a related but different AI governance concern. The decisive principle here is: Model-generated text is untrusted as an authorization basis for real-world privileged actions.
B:This option concerns Foundation model dependency and artifact tampering, which is a related but different AI governance concern. For this situation: An AI purchasing agent holds database-owner credentials merely to check order status.
D:This attractive shortcut does not resolve the AI tool misuse and excessive agency weakness: Give an agent global tool permissions because its system prompt says it should never misuse them. Scope tools to specific identities and approved operations with pre-execution authorization and transaction caps.
Question 836
A governance and assurance review uncovers the following: An AI purchasing agent holds database-owner credentials merely to check order status. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Requests outside approved privilege and business policy are refused before any sensitive side effect.
- Give an agent global tool permissions because its system prompt says it should never misuse them.
- Production loads only authenticated approved artifacts and tamper attempts are denied or alerted.
- Only approved corpus changes influence outputs, and unexpected ranking changes trigger investigation.
Explanation
Correct Answer
A:The reason it is necessary is: Model-generated text is untrusted as an authorization basis for real-world privileged actions. Independent audit evidence includes: Inspect tool manifests, service accounts, approval gates, injection tests and action receipts.
Incorrect Answers
B:For this situation: An AI purchasing agent holds database-owner credentials merely to check order status.
C:This option concerns Foundation model dependency and artifact tampering, which is a related but different AI governance concern. The decisive principle here is: Model-generated text is untrusted as an authorization basis for real-world privileged actions.
D:This option concerns Poisoned embedding and vector retrieval index, which is a related but different AI governance concern. For this situation: An AI purchasing agent holds database-owner credentials merely to check order status.
Question 837
A risk-based audit engagement examines this operating condition: A claims assistant can approve payouts based on user messages without an independent policy gate. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Give an agent global tool permissions because its system prompt says it should never misuse them.
- Scope tools to specific identities and approved operations with pre-execution authorization and transaction caps.
- Verify model provenance, storage integrity, executable dependencies and approved component changes.
- Version and trace training, validation and inference datasets with accountable lineage, hashes and reproducible pipeline metadata.
Explanation
Correct Answer
B:The reason it is necessary is: Model-generated text is untrusted as an authorization basis for real-world privileged actions. In this case: A claims assistant can approve payouts based on user messages without an independent policy gate.
Incorrect Answers
A:This attractive shortcut does not resolve the AI tool misuse and excessive agency weakness: Give an agent global tool permissions because its system prompt says it should never misuse them. In this case: A claims assistant can approve payouts based on user messages without an independent policy gate.
C:This option concerns Foundation model dependency and artifact tampering, which is a related but different AI governance concern. In this case: A claims assistant can approve payouts based on user messages without an independent policy gate.
D:This option concerns AI training dataset lineage and reproducibility, which is a related but different AI governance concern. In this case: A claims assistant can approve payouts based on user messages without an independent policy gate.
Question 838
An audit committee asks for a defensible assessment of this situation: A claims assistant can approve payouts based on user messages without an independent policy gate. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Embedding and retrieval layers are separate data-integrity surfaces that can manipulate downstream model answers.
- Model-generated text is untrusted as an authorization basis for real-world privileged actions.
- A model can disclose information statistically through outputs even without returning underlying records verbatim.
- Give an agent global tool permissions because its system prompt says it should never misuse them.
Explanation
Correct Answer
B:Independent audit evidence includes: Inspect tool manifests, service accounts, approval gates, injection tests and action receipts. In this case: A claims assistant can approve payouts based on user messages without an independent policy gate.
Incorrect Answers
A:This option concerns Poisoned embedding and vector retrieval index, which is a related but different AI governance concern. In this case: A claims assistant can approve payouts based on user messages without an independent policy gate.
C:This option concerns Model inversion and sensitive attribute leakage, which is a related but different AI governance concern. In this case: A claims assistant can approve payouts based on user messages without an independent policy gate.
D:This attractive shortcut does not resolve the AI tool misuse and excessive agency weakness: Give an agent global tool permissions because its system prompt says it should never misuse them. For this situation: A claims assistant can approve payouts based on user messages without an independent policy gate.
Question 839
During an AI controls assessment, the team learns that a claims assistant can approve payouts based on user messages without an independent policy gate. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Give an agent global tool permissions because its system prompt says it should never misuse them.
- Review label guidelines, inter-rater reliability, adjudication logs, sampled errors and retraining effects.
- Inspect signatures, hash attestations, artifact ACLs, dependency inventory and rebuild records.
- Inspect tool manifests, service accounts, approval gates, injection tests and action receipts.
Explanation
Correct Answer
D:In this case: A claims assistant can approve payouts based on user messages without an independent policy gate.
Incorrect Answers
A:For this situation: A claims assistant can approve payouts based on user messages without an independent policy gate.
B:This option concerns Label quality and human annotator agreement, which is a related but different AI governance concern. In this case: A claims assistant can approve payouts based on user messages without an independent policy gate.
C:This option concerns Foundation model dependency and artifact tampering, which is a related but different AI governance concern. For this situation: A claims assistant can approve payouts based on user messages without an independent policy gate.
Question 840
An independent AI auditor reviews this case: A claims assistant can approve payouts based on user messages without an independent policy gate. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Inspect signatures, hash attestations, artifact ACLs, dependency inventory and rebuild records.
- Give an agent global tool permissions because its system prompt says it should never misuse them.
- Scope tools to specific identities and approved operations with pre-execution authorization and transaction caps.
- Inspect tool manifests, service accounts, approval gates, injection tests and action receipts.
- Rate-limit and monitor queries, restrict unnecessary output detail and evaluate extraction risks proportionate to value.
Explanation
Correct Answers
C:The reason it is necessary is: Model-generated text is untrusted as an authorization basis for real-world privileged actions. For this situation: A claims assistant can approve payouts based on user messages without an independent policy gate.
D:This evidence directly tests the asserted control for AI tool misuse and excessive agency: Inspect tool manifests, service accounts, approval gates, injection tests and action receipts.
Incorrect Answers
A:This option concerns Foundation model dependency and artifact tampering, which is a related but different AI governance concern. The audit must corroborate: Inspect tool manifests, service accounts, approval gates, injection tests and action receipts.
B:It misses the key control principle: Model-generated text is untrusted as an authorization basis for real-world privileged actions.
E:This option concerns AI model extraction and excessive query access, which is a related but different AI governance concern. It does not establish control effectiveness for AI tool misuse and excessive agency.
