Free AAIA Isaca AAIA Practice Test Question - Page 3

Question 7 (Topic 2)

When auditing an AI model, an IS auditor notices that the controls over transactional processes are inadequate. Which of the following should the auditor recommend to BEST reduce these risks?

Select an option, then click Submit answer.

○ Implement model scorecards.
○ Clearly define responsibilities for AI risk.
○ Have the chief risk officer (CRO) perform a risk analysis.
○ Implement human-in-the-loop processes.

Question 8 (Topic 1)

An organization shares an AI model with external partners. One partner reports that sensitive data has been inadvertently exposed through the model's outputs. Which of the following is the IS auditor's BEST recommendation?

Select an option, then click Submit answer.

○ Retrain the model immediately and implement privacy-preserving techniques.
○ Disable the shared model and notify partners of the potential breach.
○ Limit the model's outputs to anonymized results while investigating further.
○ Audit the data pipelines of all partners to identify the source of the leak.

Reference / correct answer:

Disable the shared model and notify partners of the potential breach.

Most accepted answer: B. Disable the shared model and notify partners of the potential breach.

Community votes: B=3, C=1

Selected Answer: B In frameworks like ISACA’s AAIA, NIST AI RMF, or ISO 42001, when a data leakage incident occurs in shared AI systems, auditors emphasize: Contain the breach. Notify stakeholders. Investigate & remediate (including technical fixes like privacy techniques). Review governance/controls (data lineage, output guardrails, etc.). upvoted 1 times

Selected Answer: B When sensitive data is actively leaking through an AI model's outputs (often via "training data extraction" or "membership inference" attacks), the auditor's first priority is to stop the bleeding. The first action must be to stop the exposure Disabling the model: Prevents further leakage Protects all partners and stakeholders Notifying partners ensures: Transparency Regulatory compliance (e.g., breach notification requirements) upvoted 1 times

Selected Answer: C While option B is highly appropriate from an incident response standpoint, it does not reflect an auditor’s perspective. upvoted 1 times

Selected Answer: B Containtment first upvoted 2 times

Question 9 (Topic 3)

A deepfake video is presented as evidence in a court case, falsely implicating an individual in criminal activities. Which of the following is an IS auditor’s BEST recommendation to help ensure the authenticity of digital evidence?

Select an option, then click Submit answer.

○ Employing specialized tools designed to detect deepfake artifacts and inconsistencies
○ Storing all digital evidence on secure remote cloud servers and on local servers
○ Requiring digital watermarks for any evidence presented in legal proceedings
○ Training legal and forensic professionals to recognize deepfake characteristics in evidence

Free AAIA – Isaca AAIA Practice Test Question