Isaca AAIA Practice Test 89
Question 880
An independent AI auditor reviews this case: A customer financial assistant advises a risky unauthorized account transfer and customers begin following it. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Treat unsafe guidance as only a normal chatbot quality issue and continue distribution without containment.
- Activate an AI-specific incident plan to constrain outputs, preserve evidence, notify responsible owners and restore validated service.
- Review label guidelines, inter-rater reliability, adjudication logs, sampled errors and retraining effects.
- Inspect affected prompts and versions, retrieval health, distribution channels, case severity and containment record.
- Version and trace training, validation and inference datasets with accountable lineage, hashes and reproducible pipeline metadata.
Explanation
Correct Answers
B:The reason it is necessary is: AI incidents can harm through decisions and communication even when infrastructure is available. This response fits the risk associated with Response to harmful AI-generated advice: Activate an AI-specific incident plan to constrain outputs, preserve evidence, notify responsible owners and restore validated service.
D:The reason it is necessary is: AI incidents can harm through decisions and communication even when infrastructure is available. For this situation: A customer financial assistant advises a risky unauthorized account transfer and customers begin following it.
Incorrect Answers
A:This attractive shortcut does not resolve the Response to harmful AI-generated advice weakness: Treat unsafe guidance as only a normal chatbot quality issue and continue distribution without containment. Effective closure requires: Harmful advice is contained, affected users receive appropriate remediation and outputs pass regression tests.
C:This option concerns Label quality and human annotator agreement, which is a related but different AI governance concern. The decisive principle here is: AI incidents can harm through decisions and communication even when infrastructure is available.
E:This option concerns AI training dataset lineage and reproducibility, which is a related but different AI governance concern. For this situation: A customer financial assistant advises a risky unauthorized account transfer and customers begin following it.
Question 881
A governance and assurance review uncovers the following: A health-information bot repeatedly invents medication instructions after its retrieval system becomes unavailable. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Disable or restrict affected tools, preserve transaction records and verify downstream changes before re-enabling.
- Treat unsafe guidance as only a normal chatbot quality issue and continue distribution without containment.
- Activate an AI-specific incident plan to constrain outputs, preserve evidence, notify responsible owners and restore validated service.
- Quarantine suspicious inputs and models, preserve provenance, revert to validated artifacts and investigate contamination.
Explanation
Correct Answer
C:The reason it is necessary is: AI incidents can harm through decisions and communication even when infrastructure is available. The acceptable verified outcome is: Harmful advice is contained, affected users receive appropriate remediation and outputs pass regression tests.
Incorrect Answers
A:This option concerns AI agent unauthorized action incident, which is a related but different AI governance concern. It does not establish control effectiveness for Response to harmful AI-generated advice.
B:This attractive shortcut does not resolve the Response to harmful AI-generated advice weakness: Treat unsafe guidance as only a normal chatbot quality issue and continue distribution without containment. In this case: A health-information bot repeatedly invents medication instructions after its retrieval system becomes unavailable.
D:This option concerns Model poisoning incident response and rollback, which is a related but different AI governance concern. The audit must corroborate: Inspect affected prompts and versions, retrieval health, distribution channels, case severity and containment record.
Question 882
A risk-based audit engagement examines this operating condition: A health-information bot repeatedly invents medication instructions after its retrieval system becomes unavailable. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Agentic incidents involve real external actions; merely correcting generated text may not undo the harm.
- Treat unsafe guidance as only a normal chatbot quality issue and continue distribution without containment.
- Garbage or inconsistent ground-truth labels cap model validity even if the learning algorithm is sophisticated.
- AI incidents can harm through decisions and communication even when infrastructure is available.
Explanation
Correct Answer
D:Independent audit evidence includes: Inspect affected prompts and versions, retrieval health, distribution channels, case severity and containment record. The corrective action is: Activate an AI-specific incident plan to constrain outputs, preserve evidence, notify responsible owners and restore validated service.
Incorrect Answers
A:This option concerns AI agent unauthorized action incident, which is a related but different AI governance concern. The decisive principle here is: AI incidents can harm through decisions and communication even when infrastructure is available.
B:This attractive shortcut does not resolve the Response to harmful AI-generated advice weakness: Treat unsafe guidance as only a normal chatbot quality issue and continue distribution without containment. For this situation: A health-information bot repeatedly invents medication instructions after its retrieval system becomes unavailable.
C:This option concerns Label quality and human annotator agreement, which is a related but different AI governance concern. The audit must corroborate: Inspect affected prompts and versions, retrieval health, distribution channels, case severity and containment record.
Question 883
An audit committee asks for a defensible assessment of this situation: A health-information bot repeatedly invents medication instructions after its retrieval system becomes unavailable. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Inspect affected prompts and versions, retrieval health, distribution channels, case severity and containment record.
- Treat unsafe guidance as only a normal chatbot quality issue and continue distribution without containment.
- Inspect dataset snapshots, feature pipeline commits, record counts, model registry links and training execution manifests.
- Inspect tool invocation audit, actor scopes, approval checks, external transaction state and rollback capability.
Explanation
Correct Answer
A:The reason it is necessary is: AI incidents can harm through decisions and communication even when infrastructure is available. The corrective action is: Activate an AI-specific incident plan to constrain outputs, preserve evidence, notify responsible owners and restore validated service.
Incorrect Answers
B:This attractive shortcut does not resolve the Response to harmful AI-generated advice weakness: Treat unsafe guidance as only a normal chatbot quality issue and continue distribution without containment. Activate an AI-specific incident plan to constrain outputs, preserve evidence, notify responsible owners and restore validated service.
C:This option concerns AI training dataset lineage and reproducibility, which is a related but different AI governance concern. The audit must corroborate: Inspect affected prompts and versions, retrieval health, distribution channels, case severity and containment record.
D:This option concerns AI agent unauthorized action incident, which is a related but different AI governance concern. For this situation: A health-information bot repeatedly invents medication instructions after its retrieval system becomes unavailable.
Question 884
During an AI controls assessment, the team learns that a health-information bot repeatedly invents medication instructions after its retrieval system becomes unavailable. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Legitimate workloads recover within approved service and spend limits, with abusive bursts denied.
- Validated clean versions restore approved behavior and compromised data cannot silently retrain new releases.
- Harmful advice is contained, affected users receive appropriate remediation and outputs pass regression tests.
- Treat unsafe guidance as only a normal chatbot quality issue and continue distribution without containment.
Explanation
Correct Answer
C:The reason it is necessary is: AI incidents can harm through decisions and communication even when infrastructure is available. This is an observable validation result for Response to harmful AI-generated advice, not just management assurance: Harmful advice is contained, affected users receive appropriate remediation and outputs pass regression tests.
Incorrect Answers
A:This option concerns AI availability and unbounded consumption incident, which is a related but different AI governance concern. It does not establish control effectiveness for Response to harmful AI-generated advice.
B:This option concerns Model poisoning incident response and rollback, which is a related but different AI governance concern. For this situation: A health-information bot repeatedly invents medication instructions after its retrieval system becomes unavailable.
D:It misses the key control principle: AI incidents can harm through decisions and communication even when infrastructure is available.
Question 885
An independent AI auditor reviews this case: A legal guidance tool confidently gives obsolete filing deadlines in multiple jurisdictions and complaints escalate. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Disable or restrict affected tools, preserve transaction records and verify downstream changes before re-enabling.
- Coordinate technical recovery with affected stakeholder review, corrective communication and validated post-incident controls.
- Treat unsafe guidance as only a normal chatbot quality issue and continue distribution without containment.
- Activate an AI-specific incident plan to constrain outputs, preserve evidence, notify responsible owners and restore validated service.
Explanation
Correct Answer
D:The reason it is necessary is: AI incidents can harm through decisions and communication even when infrastructure is available. In this case: A legal guidance tool confidently gives obsolete filing deadlines in multiple jurisdictions and complaints escalate.
Incorrect Answers
A:This option concerns AI agent unauthorized action incident, which is a related but different AI governance concern. The audit must corroborate: Inspect affected prompts and versions, retrieval health, distribution channels, case severity and containment record.
B:This option concerns AI model rollback and stakeholder communication, which is a related but different AI governance concern. It does not establish control effectiveness for Response to harmful AI-generated advice.
C:This attractive shortcut does not resolve the Response to harmful AI-generated advice weakness: Treat unsafe guidance as only a normal chatbot quality issue and continue distribution without containment. In this case: A legal guidance tool confidently gives obsolete filing deadlines in multiple jurisdictions and complaints escalate.
Question 886
A governance and assurance review uncovers the following: A legal guidance tool confidently gives obsolete filing deadlines in multiple jurisdictions and complaints escalate. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- AI incidents can harm through decisions and communication even when infrastructure is available.
- AI outputs cannot be audited reliably when their source records, transformations and model lineage cannot be reconstructed.
- Treat unsafe guidance as only a normal chatbot quality issue and continue distribution without containment.
- Garbage or inconsistent ground-truth labels cap model validity even if the learning algorithm is sophisticated.
Explanation
Correct Answer
A:Independent audit evidence includes: Inspect affected prompts and versions, retrieval health, distribution channels, case severity and containment record. The acceptable verified outcome is: Harmful advice is contained, affected users receive appropriate remediation and outputs pass regression tests.
Incorrect Answers
B:This option concerns AI training dataset lineage and reproducibility, which is a related but different AI governance concern. In this case: A legal guidance tool confidently gives obsolete filing deadlines in multiple jurisdictions and complaints escalate.
C:This attractive shortcut does not resolve the Response to harmful AI-generated advice weakness: Treat unsafe guidance as only a normal chatbot quality issue and continue distribution without containment. For this situation: A legal guidance tool confidently gives obsolete filing deadlines in multiple jurisdictions and complaints escalate.
D:This option concerns Label quality and human annotator agreement, which is a related but different AI governance concern. In this case: A legal guidance tool confidently gives obsolete filing deadlines in multiple jurisdictions and complaints escalate.
Question 887
A risk-based audit engagement examines this operating condition: A legal guidance tool confidently gives obsolete filing deadlines in multiple jurisdictions and complaints escalate. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Inspect affected prompts and versions, retrieval health, distribution channels, case severity and containment record.
- Treat unsafe guidance as only a normal chatbot quality issue and continue distribution without containment.
- Review label guidelines, inter-rater reliability, adjudication logs, sampled errors and retraining effects.
- Inspect impact inventory, rollback record, retesting, business communications and lessons-learned owners.
Explanation
Correct Answer
A:This evidence directly tests the asserted control for Response to harmful AI-generated advice: Inspect affected prompts and versions, retrieval health, distribution channels, case severity and containment record.
Incorrect Answers
B:For this situation: A legal guidance tool confidently gives obsolete filing deadlines in multiple jurisdictions and complaints escalate.
C:This option concerns Label quality and human annotator agreement, which is a related but different AI governance concern. For this situation: A legal guidance tool confidently gives obsolete filing deadlines in multiple jurisdictions and complaints escalate.
D:This option concerns AI model rollback and stakeholder communication, which is a related but different AI governance concern. The decisive principle here is: AI incidents can harm through decisions and communication even when infrastructure is available.
Question 888
An audit committee asks for a defensible assessment of this situation: A legal guidance tool confidently gives obsolete filing deadlines in multiple jurisdictions and complaints escalate. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Treat unsafe guidance as only a normal chatbot quality issue and continue distribution without containment.
- Labels are consistent against approved definitions, and model tests expose residual uncertain classes.
- Validated clean versions restore approved behavior and compromised data cannot silently retrain new releases.
- Harmful advice is contained, affected users receive appropriate remediation and outputs pass regression tests.
Explanation
Correct Answer
D:This is an observable validation result for Response to harmful AI-generated advice, not just management assurance: Harmful advice is contained, affected users receive appropriate remediation and outputs pass regression tests.
Incorrect Answers
A:The auditor should instead examine: Inspect affected prompts and versions, retrieval health, distribution channels, case severity and containment record.
B:This option concerns Label quality and human annotator agreement, which is a related but different AI governance concern. A proportionate response is: Activate an AI-specific incident plan to constrain outputs, preserve evidence, notify responsible owners and restore validated service.
C:This option concerns Model poisoning incident response and rollback, which is a related but different AI governance concern. In this case: A legal guidance tool confidently gives obsolete filing deadlines in multiple jurisdictions and complaints escalate.
Question 889
During an AI controls assessment, the team learns that a vendor logs reveal patient details exposed through an AI assistant to unrelated authenticated users. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Coordinate technical recovery with affected stakeholder review, corrective communication and validated post-incident controls.
- Delete all logs immediately to hide exposed data and mark the incident resolved without determining scope.
- Activate an AI-specific incident plan to constrain outputs, preserve evidence, notify responsible owners and restore validated service.
- Contain disclosure, preserve evidence safely, scope affected data and follow jurisdiction-specific notification assessment.
Explanation
Correct Answer
D:The reason it is necessary is: AI privacy incidents require ordinary breach governance plus model, retrieval and prompt-specific evidence. This is the proportionate control response to AI privacy incident preservation and escalation: Contain disclosure, preserve evidence safely, scope affected data and follow jurisdiction-specific notification assessment.
Incorrect Answers
A:This option concerns AI model rollback and stakeholder communication, which is a related but different AI governance concern. It does not establish control effectiveness for AI privacy incident preservation and escalation.
B:This attractive shortcut does not resolve the AI privacy incident preservation and escalation weakness: Delete all logs immediately to hide exposed data and mark the incident resolved without determining scope.
C:This option concerns Response to harmful AI-generated advice, which is a related but different AI governance concern. It does not establish control effectiveness for AI privacy incident preservation and escalation.
Question 890
An independent AI auditor reviews this case: A vendor logs reveal patient details exposed through an AI assistant to unrelated authenticated users. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Review access traces, affected documents, tenant identity, logs, containment steps and privacy leadership decisions.
- Delete all logs immediately to hide exposed data and mark the incident resolved without determining scope.
- Validate synthetic data for utility, subgroup representation, memorization and plausible disclosure before release.
- Contain disclosure, preserve evidence safely, scope affected data and follow jurisdiction-specific notification assessment.
- Inspect impact inventory, rollback record, retesting, business communications and lessons-learned owners.
Explanation
Correct Answers
A:The reason it is necessary is: AI privacy incidents require ordinary breach governance plus model, retrieval and prompt-specific evidence. This evidence directly tests the asserted control for AI privacy incident preservation and escalation: Review access traces, affected documents, tenant identity, logs, containment steps and privacy leadership decisions.
D:The reason it is necessary is: AI privacy incidents require ordinary breach governance plus model, retrieval and prompt-specific evidence. This response fits the risk associated with AI privacy incident preservation and escalation: Contain disclosure, preserve evidence safely, scope affected data and follow jurisdiction-specific notification assessment.
Incorrect Answers
B:This attractive shortcut does not resolve the AI privacy incident preservation and escalation weakness: Delete all logs immediately to hide exposed data and mark the incident resolved without determining scope. For this situation: A vendor logs reveal patient details exposed through an AI assistant to unrelated authenticated users.
C:This option concerns Synthetic training data utility and privacy controls, which is a related but different AI governance concern. It does not establish control effectiveness for AI privacy incident preservation and escalation.
E:This option concerns AI model rollback and stakeholder communication, which is a related but different AI governance concern. For this situation: A vendor logs reveal patient details exposed through an AI assistant to unrelated authenticated users.
