cert
cert-1
cert-2

Pass Isaca AAIA Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
AAIA Exam - Verified By Experts
AAIA Premium Bundle
$14.99

AAIA Premium Bundle

$74.99
$89.98
  • Premium File 556 Questions & Answers. Last update: Nov 08, 2026
  • Training Course 110 Video Lectures
 
$89.98
$74.99
accept 22 downloads in last 7 days
block-screenshots
Purchase Isaca AAIA Exam Training Products Individually
Isaca AAIA Premium File
Premium File 556 Q&A
$76.99$69.99
Isaca AAIA Video Training Course
Training Course 110 Lectures
$21.99 $19.99
Isaca AAIA Practice Test 94

Question 930

An independent AI auditor reviews this case: A model inference service crashes repeatedly because an agent loops through its own tool calls without budget limits. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.

  1. Review label guidelines, inter-rater reliability, adjudication logs, sampled errors and retraining effects.
  2. Inspect request counts, context sizes, token or compute cost, caller attribution and saturation events.
  3. Increase the global model budget without addressing abusive requests or recursive agent loops.
  4. Contain runaway usage with quotas, timeout and backpressure, investigate access and validate recovery.
  5. Disable or restrict affected tools, preserve transaction records and verify downstream changes before re-enabling.

Explanation

Correct Answers

B:

The reason it is necessary is: Availability and financial loss from AI resource abuse require controls beyond traditional request success checks. The corrective action is: Contain runaway usage with quotas, timeout and backpressure, investigate access and validate recovery.

D:

The reason it is necessary is: Availability and financial loss from AI resource abuse require controls beyond traditional request success checks. For this situation: A model inference service crashes repeatedly because an agent loops through its own tool calls without budget limits.

Incorrect Answers

A:

This option concerns Label quality and human annotator agreement, which is a related but different AI governance concern. The decisive principle here is: Availability and financial loss from AI resource abuse require controls beyond traditional request success checks.

C:

This attractive shortcut does not resolve the AI availability and unbounded consumption incident weakness: Increase the global model budget without addressing abusive requests or recursive agent loops. For this situation: A model inference service crashes repeatedly because an agent loops through its own tool calls without budget limits.

E:

This option concerns AI agent unauthorized action incident, which is a related but different AI governance concern. For this situation: A model inference service crashes repeatedly because an agent loops through its own tool calls without budget limits.

Question 931

A governance and assurance review uncovers the following: A model inference service crashes repeatedly because an agent loops through its own tool calls without budget limits. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.

  1. Increase the global model budget without addressing abusive requests or recursive agent loops.
  2. Inspect request counts, context sizes, token or compute cost, caller attribution and saturation events.
  3. Inspect affected prompts and versions, retrieval health, distribution channels, case severity and containment record.
  4. Review label guidelines, inter-rater reliability, adjudication logs, sampled errors and retraining effects.

Explanation

Correct Answer

B:

The reason it is necessary is: Availability and financial loss from AI resource abuse require controls beyond traditional request success checks. Independent audit evidence includes: Inspect request counts, context sizes, token or compute cost, caller attribution and saturation events.

Incorrect Answers

A:

This attractive shortcut does not resolve the AI availability and unbounded consumption incident weakness: Increase the global model budget without addressing abusive requests or recursive agent loops. Contain runaway usage with quotas, timeout and backpressure, investigate access and validate recovery.

C:

This option concerns Response to harmful AI-generated advice, which is a related but different AI governance concern. For this situation: A model inference service crashes repeatedly because an agent loops through its own tool calls without budget limits.

D:

This option concerns Label quality and human annotator agreement, which is a related but different AI governance concern. For this situation: A model inference service crashes repeatedly because an agent loops through its own tool calls without budget limits.

Question 932

A risk-based audit engagement examines this operating condition: A model inference service crashes repeatedly because an agent loops through its own tool calls without budget limits. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.

  1. Affected decisions are reviewed, relevant stakeholders notified and preventive controls verified.
  2. Increase the global model budget without addressing abusive requests or recursive agent loops.
  3. Legitimate workloads recover within approved service and spend limits, with abusive bursts denied.
  4. Unauthorized changes are reversed or contained and renewed tool access passes adversarial gate tests.

Explanation

Correct Answer

C:

This is an observable validation result for AI availability and unbounded consumption incident, not just management assurance: Legitimate workloads recover within approved service and spend limits, with abusive bursts denied.

Incorrect Answers

A:

This option concerns AI model rollback and stakeholder communication, which is a related but different AI governance concern. In this case: A model inference service crashes repeatedly because an agent loops through its own tool calls without budget limits.

B:

For this situation: A model inference service crashes repeatedly because an agent loops through its own tool calls without budget limits.

D:

This option concerns AI agent unauthorized action incident, which is a related but different AI governance concern. The audit must corroborate: Inspect request counts, context sizes, token or compute cost, caller attribution and saturation events.

Question 933

An audit committee asks for a defensible assessment of this situation: An API user triggers high-cost generation bursts that starve a hospital scheduling assistant of capacity. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.

  1. Increase the global model budget without addressing abusive requests or recursive agent loops.
  2. Version and trace training, validation and inference datasets with accountable lineage, hashes and reproducible pipeline metadata.
  3. Contain runaway usage with quotas, timeout and backpressure, investigate access and validate recovery.
  4. Coordinate technical recovery with affected stakeholder review, corrective communication and validated post-incident controls.

Explanation

Correct Answer

C:

The reason it is necessary is: Availability and financial loss from AI resource abuse require controls beyond traditional request success checks. In this case: An API user triggers high-cost generation bursts that starve a hospital scheduling assistant of capacity.

Incorrect Answers

A:

This attractive shortcut does not resolve the AI availability and unbounded consumption incident weakness: Increase the global model budget without addressing abusive requests or recursive agent loops. In this case: An API user triggers high-cost generation bursts that starve a hospital scheduling assistant of capacity.

B:

This option concerns AI training dataset lineage and reproducibility, which is a related but different AI governance concern. In this case: An API user triggers high-cost generation bursts that starve a hospital scheduling assistant of capacity.

D:

This option concerns AI model rollback and stakeholder communication, which is a related but different AI governance concern. In this case: An API user triggers high-cost generation bursts that starve a hospital scheduling assistant of capacity.

Question 934

During an AI controls assessment, the team learns that an API user triggers high-cost generation bursts that starve a hospital scheduling assistant of capacity. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.

  1. Availability and financial loss from AI resource abuse require controls beyond traditional request success checks.
  2. AI outputs cannot be audited reliably when their source records, transformations and model lineage cannot be reconstructed.
  3. Garbage or inconsistent ground-truth labels cap model validity even if the learning algorithm is sophisticated.
  4. Increase the global model budget without addressing abusive requests or recursive agent loops.

Explanation

Correct Answer

A:

The acceptable verified outcome is: Legitimate workloads recover within approved service and spend limits, with abusive bursts denied. In this case: An API user triggers high-cost generation bursts that starve a hospital scheduling assistant of capacity.

Incorrect Answers

B:

This option concerns AI training dataset lineage and reproducibility, which is a related but different AI governance concern. For this situation: An API user triggers high-cost generation bursts that starve a hospital scheduling assistant of capacity.

C:

This option concerns Label quality and human annotator agreement, which is a related but different AI governance concern. In this case: An API user triggers high-cost generation bursts that starve a hospital scheduling assistant of capacity.

D:

This attractive shortcut does not resolve the AI availability and unbounded consumption incident weakness: Increase the global model budget without addressing abusive requests or recursive agent loops. For this situation: An API user triggers high-cost generation bursts that starve a hospital scheduling assistant of capacity.

Question 935

An independent AI auditor reviews this case: An API user triggers high-cost generation bursts that starve a hospital scheduling assistant of capacity. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.

  1. Increase the global model budget without addressing abusive requests or recursive agent loops.
  2. Inspect request counts, context sizes, token or compute cost, caller attribution and saturation events.
  3. Inspect ingestion bursts, source identities, dataset hashes, registry links and clean restore evidence.
  4. Inspect affected prompts and versions, retrieval health, distribution channels, case severity and containment record.

Explanation

Correct Answer

B:

The acceptable verified outcome is: Legitimate workloads recover within approved service and spend limits, with abusive bursts denied.

Incorrect Answers

A:

For this situation: An API user triggers high-cost generation bursts that starve a hospital scheduling assistant of capacity.

C:

This option concerns Model poisoning incident response and rollback, which is a related but different AI governance concern. The decisive principle here is: Availability and financial loss from AI resource abuse require controls beyond traditional request success checks.

D:

This option concerns Response to harmful AI-generated advice, which is a related but different AI governance concern. In this case: An API user triggers high-cost generation bursts that starve a hospital scheduling assistant of capacity.

Question 936

A governance and assurance review uncovers the following: An API user triggers high-cost generation bursts that starve a hospital scheduling assistant of capacity. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.

  1. Legitimate workloads recover within approved service and spend limits, with abusive bursts denied.
  2. An independent rerun can identify the exact source data and material transformation decisions for a sampled model version.
  3. Unauthorized changes are reversed or contained and renewed tool access passes adversarial gate tests.
  4. Increase the global model budget without addressing abusive requests or recursive agent loops.

Explanation

Correct Answer

A:

In this case: An API user triggers high-cost generation bursts that starve a hospital scheduling assistant of capacity.

Incorrect Answers

B:

This option concerns AI training dataset lineage and reproducibility, which is a related but different AI governance concern. The audit must corroborate: Inspect request counts, context sizes, token or compute cost, caller attribution and saturation events.

C:

This option concerns AI agent unauthorized action incident, which is a related but different AI governance concern. In this case: An API user triggers high-cost generation bursts that starve a hospital scheduling assistant of capacity.

D:

It misses the key control principle: Availability and financial loss from AI resource abuse require controls beyond traditional request success checks.

Question 937

A risk-based audit engagement examines this operating condition: A risky model update is rolled back but public customer guidance still cites invalid automated decisions made earlier. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.

  1. Declare incident closure when the model endpoint is healthy even if earlier wrong actions remain unresolved.
  2. Activate an AI-specific incident plan to constrain outputs, preserve evidence, notify responsible owners and restore validated service.
  3. Coordinate technical recovery with affected stakeholder review, corrective communication and validated post-incident controls.
  4. Use risk-aware canary populations, guardrail metrics, stop criteria and tested rollback or kill switch.

Explanation

Correct Answer

C:

The reason it is necessary is: An AI incident ends only after decision impacts, service restoration and recurrence risk are addressed. In this case: A risky model update is rolled back but public customer guidance still cites invalid automated decisions made earlier.

Incorrect Answers

A:

This attractive shortcut does not resolve the AI model rollback and stakeholder communication weakness: Declare incident closure when the model endpoint is healthy even if earlier wrong actions remain unresolved.

B:

This option concerns Response to harmful AI-generated advice, which is a related but different AI governance concern. It does not establish control effectiveness for AI model rollback and stakeholder communication.

D:

This option concerns Canary releases and model rollback thresholds, which is a related but different AI governance concern. It does not establish control effectiveness for AI model rollback and stakeholder communication.

Question 938

An audit committee asks for a defensible assessment of this situation: A risky model update is rolled back but public customer guidance still cites invalid automated decisions made earlier. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.

  1. An AI incident ends only after decision impacts, service restoration and recurrence risk are addressed.
  2. Poisoning response must address both malicious input and any model or derived features trained on it.
  3. Availability and financial loss from AI resource abuse require controls beyond traditional request success checks.
  4. Declare incident closure when the model endpoint is healthy even if earlier wrong actions remain unresolved.

Explanation

Correct Answer

A:

Independent audit evidence includes: Inspect impact inventory, rollback record, retesting, business communications and lessons-learned owners. This is the applicable AI audit principle for AI model rollback and stakeholder communication: An AI incident ends only after decision impacts, service restoration and recurrence risk are addressed.

Incorrect Answers

B:

This option concerns Model poisoning incident response and rollback, which is a related but different AI governance concern. It does not establish control effectiveness for AI model rollback and stakeholder communication.

C:

This option concerns AI availability and unbounded consumption incident, which is a related but different AI governance concern. It does not establish control effectiveness for AI model rollback and stakeholder communication.

D:

This attractive shortcut does not resolve the AI model rollback and stakeholder communication weakness: Declare incident closure when the model endpoint is healthy even if earlier wrong actions remain unresolved. For this situation: A risky model update is rolled back but public customer guidance still cites invalid automated decisions made earlier.

Question 939

During an AI controls assessment, the team learns that a risky model update is rolled back but public customer guidance still cites invalid automated decisions made earlier. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.

  1. Inspect impact inventory, rollback record, retesting, business communications and lessons-learned owners.
  2. Inspect pipeline roles, artifact signatures, dataset permissions, approval gates and production change logs.
  3. Declare incident closure when the model endpoint is healthy even if earlier wrong actions remain unresolved.
  4. Review access traces, affected documents, tenant identity, logs, containment steps and privacy leadership decisions.

Explanation

Correct Answer

A:

The reason it is necessary is: An AI incident ends only after decision impacts, service restoration and recurrence risk are addressed. This evidence directly tests the asserted control for AI model rollback and stakeholder communication: Inspect impact inventory, rollback record, retesting, business communications and lessons-learned owners.

Incorrect Answers

B:

This option concerns AI data and model CI/CD separation, which is a related but different AI governance concern. It does not establish control effectiveness for AI model rollback and stakeholder communication.

C:

This attractive shortcut does not resolve the AI model rollback and stakeholder communication weakness: Declare incident closure when the model endpoint is healthy even if earlier wrong actions remain unresolved. The auditor should instead examine: Inspect impact inventory, rollback record, retesting, business communications and lessons-learned owners.

D:

This option concerns AI privacy incident preservation and escalation, which is a related but different AI governance concern. It does not establish control effectiveness for AI model rollback and stakeholder communication.

Question 940

An independent AI auditor reviews this case: A risky model update is rolled back but public customer guidance still cites invalid automated decisions made earlier. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.

  1. Separate development, test and production roles with controlled promotion, scoped credentials and audit trails.
  2. Declare incident closure when the model endpoint is healthy even if earlier wrong actions remain unresolved.
  3. Coordinate technical recovery with affected stakeholder review, corrective communication and validated post-incident controls.
  4. Inspect request counts, context sizes, token or compute cost, caller attribution and saturation events.
  5. Inspect impact inventory, rollback record, retesting, business communications and lessons-learned owners.

Explanation

Correct Answers

C:

The reason it is necessary is: An AI incident ends only after decision impacts, service restoration and recurrence risk are addressed. For this situation: A risky model update is rolled back but public customer guidance still cites invalid automated decisions made earlier.

E:

The reason it is necessary is: An AI incident ends only after decision impacts, service restoration and recurrence risk are addressed. The corrective action is: Coordinate technical recovery with affected stakeholder review, corrective communication and validated post-incident controls.

Incorrect Answers

A:

This option concerns AI data and model CI/CD separation, which is a related but different AI governance concern. For this situation: A risky model update is rolled back but public customer guidance still cites invalid automated decisions made earlier.

B:

This attractive shortcut does not resolve the AI model rollback and stakeholder communication weakness: Declare incident closure when the model endpoint is healthy even if earlier wrong actions remain unresolved. Effective closure requires: Affected decisions are reviewed, relevant stakeholders notified and preventive controls verified.

D:

This option concerns AI availability and unbounded consumption incident, which is a related but different AI governance concern. For this situation: A risky model update is rolled back but public customer guidance still cites invalid automated decisions made earlier.

ISACA Advanced in AI Audit (AAIA) Practice Tests