Free Isaca AAIA Actual Exam Questions

Option B also stands out since a kill chain process can actively stop disruptions before they cause total service failure, which might be more immediate than just planning in the DRP.

Maybe B makes sense because having a kill chain process can quickly isolate and stop issues during a disruption, which could prevent the worst-case scenario from escalating.

B imo since scope creep can seriously mess with audit boundaries and lead to wasted resources, which feels riskier than just costs or data gaps. Planning might get outta hand fast if AI suggests too many additions.

Maybe C here since AI’s only as good as the data it gets. If data’s missing or wrong, the whole audit plan could be off, which sounds riskier than just not knowing enough about the AI itself.

Maybe B makes sense since testing with curated data can directly show if the model treats different groups fairly, unlike metadata or interviews which might be less concrete.

C imo, interviewing developers can uncover design intentions and potential blind spots in the model that data alone might not reveal. Developers might also explain why certain biases exist or how they tried to mitigate them, which is useful context for fairness. It’s not just about numbers; understanding the human side helps too. Plus, relying purely on data or observation might miss underlying reasons behind certain behaviors. So, getting insights straight from the source can add another layer of reliable evidence during an audit.

It’s A because spotting vulnerabilities helps ensure the AI won’t derail business goals.

It’s D because a clear acceptable use policy defines how AI should support business goals, making it more direct evidence than just tracking changes or listing models. Policies guide actual behavior, which is key.

C/B? The main idea is the AI’s output changes because it’s probabilistic (C), but B could also fit if you think of varying internal activations causing output shifts. D and A seem less relevant here.

C, because the AI's probabilistic nature means outputs can vary each time.

B imo, because avoiding false alarms about failures (specificity) matters to prevent unnecessary downtime.

D. I get the concerns about precision and specificity, but in this case, missing a real failure could be way more costly or dangerous than a false alarm. So catching as many true failures as possible (recall) should be the priority. You can always tune the system later to reduce false positives if needed, but missing failures outright is riskier.

C makes the most sense here since trustworthy data is key to safe, high-risk AI. The other options are important but don’t directly support development and design.

C/B? Trustworthy data is key for design quality, but training users on privacy also directly reduces risks during development. Backups and MFA feel more about security after design.

C/D? I’m thinking data sanitization (C) is more proactive because it stops sensitive info from even getting into the system, which seems crucial. Masking data (D) is good but feels more like a patch after the fact; if data’s sanitized upfront, fewer risks later on. Manual monitoring (A) seems too reactive and resource-heavy, and access controls (B) might not stop the data from leaking if the model itself has sensitive info embedded. So, cleaning input data before training or use seems like the strongest first line of defense here.

B. Even if data is sanitized, without strict access controls, unauthorized users might still get sensitive info from the chatbot. Controlling who can interact is a critical layer of defense.

D, since F1 score really reflects the balance between precision and recall, not just true positives.

Not B, uptime isn’t mentioned or inferred from accuracy or recall here.

It’s C since protecting individual rights directly impacts trust in AI systems.

Probably B here. Ethical reviews are more than just avoiding harm to individuals; they’re about making sure the AI matches the bigger picture—the company’s values and culture. That alignment helps guide decisions beyond just legal compliance or performance tweaks, which options A and D focus on. Protecting rights is crucial, but it feels like part of the broader organizational ethics that B captures.

A imo, because filling missing data with averages actually changes the original distribution, creating bias that’s hard to detect later. D just loses some detail but doesn’t misrepresent the data as much.

D imo, bins can lose a lot of detail, but A adds artificial data that can skew results more seriously by introducing bias, not just info loss. B and C are mostly cleanup steps, so less risky overall.

I see where the risk assessment (C) angle comes from, but I'd say B makes a strong case here too. Documenting changes thoroughly ensures that updates don’t cause unexpected issues and helps keep the whole team on the same page. Without good documentation, even a solid risk assessment might not be enough to manage ongoing changes effectively. So I think B is critical for keeping control as the AI system evolves.

C feels right because spotting risks early avoids bigger issues later on.

Option D, tracing data sources directly checks if data quality is maintained end-to-end.

D imo, because tracing data sources helps catch errors early and confirms the data hasn’t been tampered with, which is crucial for AI training integrity. B feels too broad and might miss quality specifics.

Maybe B makes the most sense here. If you’re putting source data into a generative AI tool, the privacy aspect is huge. Even if the data is reliable, if the tool doesn’t handle privacy properly, it could cause big issues for an audit. So checking for a privacy notice could be key before anything else.

I think the main issue here is whether the source data itself can be trusted before feeding it into any AI tool. If the data is unreliable, then even the best AI output won't help. So D seems like the more fundamental concern here—making sure the info you start with is solid before worrying about privacy notices or model updates.

It’s B, no way they can fairly judge drivers without context like traffic or weather.

I’m also suspicious of B since it might ignore important context like route difficulty. Could A be risky too if coupons are issued unfairly or based on biased data?