Free ISACA AAIA Practice Questions

Question 1

Which of the following key performance indicators (KPIs) are MOST important when evaluating whether an AI model meets business objectives?

1. Cost of resources required for AI model training
2. AI model accuracy in predicting actual outcomes
3. Frequency of AI model retraining
4. Number of users interacting with the AI model

Question 2

The BEST way to prevent sensitive information disclosure by large language model (LLM) chatbots is through:

1. manual monitoring.
2. data sanitization.
3. data masking.
4. access controls.

Question 3

An organization is using information gathered from customer accounts to train its AI chatbot.

Which of the following is the GREATEST risk associated with this practice?

1. Transparency
2. AI model hallucinations
3. AI bias
4. Disclosure of personal information

Question 4

An IS auditor is evaluating an organization’s incident management program to ensure it is sufficiently prepared to manage AI-related incidents.

Which of the following is MOST important for the auditor to validate?

1. The program includes processes to respond to AI model drift and data integrity attacks.
2. The program prioritizes incidents based on alignment with industry leading practices.
3. The program uses past AI-related incidents and resolutions to categorize current incidents.
4. The program mandates retraining AI systems after incidents are investigated.

Question 5

Which of the following is MOST important for an IS auditor to consider when identifying AI risk in a know your customer (KYC) application within a banking organization?

1. Business disruption and financial impact
2. Intellectual property leakage and invalidation
3. Benchmarking against peer organizations
4. Incident response plan

Question 6

A digital bank utilizes an AI system to generate credit scores.

Which of the following would BEST mitigate the risk of sudden and unexplained changes in a borrower's credit score?

1. Using only data from the last six months to one year to avoid outdated information affecting the credit score
2. Ensuring the system is periodically reviewed and calibrated by human experts to maintain stability in predictions
3. Obtaining and validating the credit scores from third-party agencies to cross-check AI-generated results
4. Allowing the AI to operate fully autonomously to prevent processing delays

Question 7

Which of the following is MOST important for an IS auditor to review during an AI system audit in order to determine compliance with intellectual property and data rights?

1. Data performance metrics
2. Use of open-source intellectual property
3. Model runtime efficiency logs
4. Data usage agreements

Question 8

Which of the following is the PRIMARY objective of AI governance?

1. Implementing compliance and ethics controls for AI initiatives
2. Promoting a positive return on investment (ROI) from AI projects
3. Defining clear roles and responsibilities for AI development, use, and oversight
4. Ensuring controls over AI are designed well and operate effectively

Question 9

A healthcare organization uses patient data to train an AI model for early disease detection.

Which of the following practices provides the BEST assurance that personal data is secure and its integrity is maintained?

1. Implementing strict data access controls and conducting security tests
2. Encrypting stored data to reduce exposure and log access
3. Updating the AI model with new data and tracking changes
4. Anonymizing patient data and performing regular quality checks

Question 10

An organization deploys an AI recruitment platform to screen job applicants. The IS auditor identifies that the platform’s decisions may be influenced by model bias.

Which of the following risk mitigation strategies is BEST for the auditor to recommend?

1. Implement a process to periodically test the AI system for biases and adjust parameters as needed.
2. Suspend the use of the AI system until the training data can be verified for fairness and compliance.
3. Require manual reviews of all AI-generated recruitment decisions before hiring is finalized.
4. Retrain the AI model using an external data set certified for inclusivity and fairness.

Question 11

A healthcare organization uses data clustering to group patients by medical history for personalized treatment recommendations.

Which of the following is the GREATEST privacy risk associated with this practice?

1. Clustering increases the complexity of the model, making data harder to anonymize.
2. The clustering requires more data, increasing the risk of a privacy breach.
3. Irrelevant features in the data may result in inaccurate or biased treatments.
4. Clusters can reveal sensitive personal information depending on how the information is presented.

Question 12

An organization is developing an AI system that integrates data from multiple external sources without clearly defined data ownership policies.

Which of the following is the GREATEST concern in this situation?

1. Deficiencies in policies and procedures validating AI model accuracy
2. Limited documentation of user access permissions
3. Excessive dependence on automated data collection and cleansing
4. Gaps in AI privacy compliance and accountability

Question 13

An IS auditor notes the combined number of records utilized within the training, validation, and testing data sets exceeds the total number of records in the original data set.

Which of the following is MOST important for the auditor to determine?

1. Whether data leakage occurred from utilizing overlapping records in the data sets
2. Whether the validation data set utilized the same number of records as the training data sets
3. Whether the training, validation, and testing data sets were created in the correct order
4. Whether a sufficient number of records were utilized in the training data set

Question 14

During an audit of a bank’s AI credit scoring system, an IS auditor discovers that applicants were not informed about automated decision-making.

Which of the following should the auditor do FIRST?

1. Evaluate transparency controls.
2. Prepare an audit report.
3. Conduct an explainability assessment.
4. Evaluate appeal processes.

Question 15

Which of the following is the MOST important key indicator to assess when auditing the deployment of AI in predictive maintenance system in manufacturing operations?

1. Percentage of AI’s predictive algorithms that are compliant with industry standards
2. Frequency of updates to AI predictive models based on equipment usage
3. Reduction in downtime and maintenance costs due to AI use
4. Total number of predictive maintenance scenarios implemented using AI

Question 16

Which use case for an AI model to be used by a food delivery service would pose ethical risk to the organization?

1. Using customer service metrics for service speed and food quality to predict customer retention and forecast revenue
2. Comparing total food preparation and delivery time to an industry benchmark to set key performance and risk indicators for individual restaurants
3. Basing driver retention and termination decisions on the number of delivered orders per total hours worked as compared to an industry benchmark
4. Correlating time, cost, delivery distance, and customer satisfaction metrics to issue coupons to customers receiving substandard service

Question 17

An AI-driven incident management system determines the root cause of a security event by:

1. correlating similar events across multiple systems.
2. flagging previously reported vulnerabilities.
3. automatically applying patches to all systems on the network.
4. reviewing logs and flagging the first system to report anomalous events.

Question 18

An IS auditor reviewing documentation for an AI model notes that the modeler utilized a K-means clustering algorithm, which clusters data into categories for correlations and analysis.

Which of the following is the MOST important risk for the auditor to consider?

1. K-means clustering is not a common data clustering method due to its complexity and difficulty categorizing data correctly.
2. K-means clustering algorithms are significantly sensitive to outliers and dependent on the similarity of units of measure.
3. K-means clustering determines the number of clusters for the modeler without supervision.
4. K-means clustering requires the modeler to supervise the learning analysis, which can introduce bias.

Question 19

Which of the following is the MOST important reason to establish AI governance structures that extend beyond regulatory compliance?

1. To align with global AI data privacy standards
2. To mitigate reputational risk associated with public scrutiny of AI systems
3. To ensure ethical integrity throughout the AI life cycle
4. To establish guardrails limiting AI system functionality to approved use cases

Question 20

When auditing a research agency’s use of generative AI models for analyzing scientific data which of the following is MOST critical to evaluate in order to prevent hallucinatory results and ensure the accuracy of outputs?

1. The measures in place to ensure the appropriateness and relevance of input data for generative AI models
2. The frequency of data audits verifying the integrity and accuracy of inputs
3. The algorithms for generative AI models designed to detect and correct data bias before processing
4. The effectiveness of data anonymization processes that help preserve data quality

Question 21

When an IS auditor is reviewing results from an AI system, which of the following would cause the GREATEST risk?

1. Inability to identify where an AI system is housed.
2. Difficulty of documenting AI algorithm processes.
3. System output not being checked for inconsistencies.
4. Cascading failures of AI system outputs.

Question 22

Which of the following would be of GREATEST concern to an IS auditor reviewing an organization’s AI policies and procedures?

1. The documentation of AI models does not address business resiliency and disaster recovery.
2. The AI model does not have an approval process for production changes.
3. External validation is not required for AI systems before deployment.
4. The data privacy policy has not been reviewed in the past three years.

Question 23

A car insurance company uses an AI model to determine customer premiums. To ensure the ethical use of this model, which of the following testing practices should the company consider to be MOST important?

1. Running model performance tests on randomized data to improve the model's accuracy
2. Ensuring demographic data is not used to train models outside of the defined use case
3. Testing to ensure the model’s predictions do not discriminate based on age or gender
4. Deploying the model only for a small randomly selected group of existing customers

Question 24

An organization’s system development process has been enhanced with AI.

Which of the following features presents the GREATEST risk?

1. All codes are generated by AI without human oversight.
2. Non-technical users are validating AI results.
3. The AI personalizes applications for the user.
4. The AI allocates resources for new system development projects.

Question 25

The PRIMARY objective of machine learning (ML) in data processing is to:

1. analyze data sets to identify visual patterns and trends.
2. enhance the explainability of AI model outputs.
3. draw statistical inferences for creating artificial human intelligence.
4. perform actions that would typically require human intelligence.

Question 26

During an audit of an AI solution, the modeler informs the IS auditor that data augmentation techniques were utilized.

Which of the following BEST enables the auditor to determine the effectiveness of the data augmentation?

1. Balance of data classes prior to and after augmentation
2. Performance metrics of the model prior to and after augmentation
3. Affinity and diversity of augmented data compared to original data
4. Feature importance summary of the model prior to and after augmentation

Question 27

An organization implements a neural network-based AI system for credit scoring that processes extensive input data from multiple sources.

Which of the following represents the GREATEST risk if input validation and anomaly detection controls are inadequate?

1. Biased inputs that can affect credit decisions
2. Delayed model training cycles from excessive data preprocessing
3. Overfitting caused by excessive anomaly filtering
4. Increased computational cost due to redundant input checks

Question 28

An IS auditor is assessing an AI-powered chatbot that produces inaccurate or fabricated information for customer queries.

Which of the following is the BEST recommendation when the model’s configuration emphasizes creativity over accuracy?

1. Add more randomness through external prompts.
2. Allow the AI model to self-correct its hallucinated outputs.
3. Implement stricter prompt templates to constrain the model's outputs.
4. Adjust the model’s temperature parameter to lower randomness.

Question 29

Which of the following assessments of data quality would an IS auditor use to validate relationship completeness between large data sets?

1. Counterfactual analyses
2. Drift detection algorithms
3. Referential integrity checks
4. Cross-column profiling

Question 30

An IS auditor is reviewing AI-driven processes that automate financial approvals.

Which of the following poses the GREATEST challenge to maintaining separation of duties?

1. Narrowly targeted AI awareness training
2. Lack of transparency in AI algorithms
3. Inadequate documentation for AI tools
4. Use of AI to automate routine manual tasks

Question 31

Which of the following would be the BEST recommendation for an organization that has adopted vibe coding?

1. Prompt the AI to review its own code.
2. Build the organization's own cryptography.
3. Discontinue the current practice.
4. Adopt a security checklist for code review.

Question 32

An AI generated photo showing a catastrophe circulated on social media, impacting the supply chain. This is an example of which type of risk?

1. Compliance risk
2. Societal risk
3. Economic risk
4. Data privacy risk

Question 33

Which of the following is the GREATEST concern when an audit team relies on generative AI to create audit reports?

1. The reports may be more likely to reflect outdated information.
2. The reports may contain misstatements resulting from hallucinations.
3. The reports may use inconsistent formatting from prior audit findings.
4. The reports may tend to use generic language for audit issues.

Question 34

An organization has deployed an AI-powered customer service chatbot trained using customer chat logs.

When reviewing AI risk assessment documentation, which of the following should be the IS auditor's GREATEST concern?

1. Limited AI model capability to incorporate and adapt to new data
2. Obsolete procedures leading to inadequate data integrity validation
3. Reputational impacts resulting from inaccurate chatbot responses
4. Insufficient access controls leading to unauthorized customer data exposure

Question 35

Which metric should an IS auditor review to evaluate issues with data collection that could impact the AI model training?

1. Percentage of epochs used
2. Percentage of missing values
3. Percentage of data in training dataset
4. Percentage of true positives on confusion matrix

Question 36

Which of the following is the MOST important course of action for an organization prior to allowing end users to utilize an AI tool?

1. Develop an AI policy with guidelines on appropriate use.
2. Determine the impact to the disaster recovery plan (DRP).
3. Implement baseline performance metrics.
4. Ensure a cybersecurity insurance clause is in place to include the use of AI.

Question 37

A company is developing an AI system to generate videos and images.

Which of the following would BEST enable the company to mitigate harm caused by deepfakes?

1. Differential privacy
2. Watermarking
3. Sanitization
4. Model encryption

Question 38

A healthcare AI tool used by a hospital recommends treatments based on patient data. The tool sometimes suggests treatments that have high success rates but significant risk. The hospital's risk management approach prioritizes patient safety over innovative solutions.

Which of the following is the hospital's BEST course of action?

1. Adjust the AI’s parameters to align with the hospital’s risk tolerance.
2. Discontinue using the AI tool and rely solely on doctor expertise.
3. Obtain patients' consent for the use of their data by the AI tool.
4. Use the AI tool only for low-risk situations.

Question 39

Which of the following types of AI can use unlabeled data sets to imitate human learning behavior?

1. Supervised learning
2. Federated learning
3. Reinforcement learning
4. Unsupervised learning

Question 40

A health organization has deployed an AI model to analyze chest X-rays. The model reports high accuracy, but thresholds for classifying results are unclear and performance is not broken down by different patient demographics.

Which of the following is the PRIMARY reason to avoid relying only on overall accuracy to evaluate this model?

1. The model may perform poorly for certain patient groups, leading to hidden fairness or safety risk.
2. Performance may vary across demographic subgroups, requiring stratified evaluation.
3. A high accuracy score always indicates low false positives and false negatives.
4. Accuracy can only be calculated on structured tabular datasets, not medical images.

Question 41

Which of the following should be an IS auditor's GREATEST concern when reviewing an anomaly detection process implemented for a high-risk AI system?

1. Failure to identify anomalies that can bias training data
2. Lack of regular quality reviews for training data
3. Infrequent updates to anomaly detection algorithms
4. Inadequate staff training on the use of the system

Question 42

An IS auditor is interviewing management about implemented controls around machine learning (ML) models deployed in the production environment.

Which of the following schedules for reviewing the performance of a deployed model would be of GREATEST concern to the auditor?

1. One time prior to migrating to production
2. On an annual recurring basis
3. After functionality changes
4. After changes to hardware and software platforms

Question 43

An IS auditor identified data quality issues as a result of insufficient availability of minority data to address diverse class representation.

Which of the following is the BEST recommendation to resolve this issue?

1. Augment the data through synthesizing.
2. Document the risk acceptance.
3. Relabel available data.
4. Change the model selection.

Question 44

For a sales promotion, an AI system sorts customer attributes into several categories by analyzing transaction history. Verifying which of the following would BEST validate the effectiveness of this process?

1. Stress tests are regularly conducted to maintain consistent AI performance.
2. The applied methodology adequately reflects business objectives.
3. Sensitive attributes are converted to other data types prior to input.
4. Sampling of AI output is conducted to identify unusual decisions.

Question 45

When converting data categories before training an AI model, which of the following scenarios represents the GREATEST risk?

1. One-hot encoding the data attribute car colors for the options red, blue, green black, white
2. Creating dummy variables for the data attribute product flavor for the options vanilla, chocolate, strawberry, banana
3. One-hot encoding the data attribute customer rewards category for the options economy, business, first class
4. Creating dummy variables for the data attribute dog breed for the options labrador, terrier, beagle

Question 46

When utilizing a machine learning (ML) model to predict whether a wind turbine electricity generator will fail, which model evaluation metric should be the PRIMARY focus?

1. Recall
2. Specificity
3. Precision
4. Accuracy

Question 47

When assessing the potential risk of implementing an AI system, it is MOST important to validate the model's:

1. processing speed and computational efficiency,
2. decision-making explanations and interpretability of its outputs,
3. number of parameters and its overall complexity,
4. compatibility with existing legacy software used by the organization.

Question 48

An organization implemented a fraud detection model for credit card transactions. After a complex neural network was trained with a large volume of transactions, the training accuracy was higher than the validation accuracy.

Which of the following is the MOST likely cause?

1. Overfitting
2. Feature scaling
3. Underfitting
4. Insufficient training data

Question 49

Which of the following BEST helps an organization manage bias in AI model decisions?

1. Data anonymization and classification
2. Standardization of fairness criteria
3. Human oversight and feedback mechanisms
4. Periodic model retraining

Question 50

An IS auditor has discovered that an organization's AI system is less accurate than the required threshold and recommends management implement cross-referencing multiple models in order to produce more accurate results. This is an example of which type of risk response?

1. Avoidance
2. Transfer
3. Mitigation
4. Acceptance

Question 51

When evaluating whether an AI algorithm deployed by an organization aligns with its business objectives, it is MOST important to:

1. review algorithm documentation for completeness.
2. confirm the outcomes from using the algorithm support strategic goals.
3. validate that data sources are identified in the business strategy.
4. verify the algorithm’s ability to process transactions accurately.

Question 52

Which of the following is the MOST important risk for an IS auditor to consider when reviewing the adoption of an AI system?

1. Immaturity of AI systems in the industry
2. Resistance to the use of AI technology
3. Costs associated with AI system maintenance
4. Bias in AI system decision making

Question 53

Which of the following is MOST important to consider when deciding whether to implement an AI solution?

1. The space required for AI hardware
2. The cost of AI implementation
3. The speed of AI implementation
4. The ethical implications of AI

Question 54

After AI training data has been tested for biases, which of the following is MOST important to check in order to validate the effectiveness of the testing?

1. Feedback on data validation is obtained from key stakeholders.
2. Possible impacts from AI outputs remain within the acceptable risk level.
3. AI processes will meet expected service turnaround time.
4. Sensitive information from users is securely masked before input.

Question 55

Which of the following metrics are the BEST indication of a mature and effective approach to an organization’s data governance program for its AI systems?

1. Total budget allocated to AI initiatives across all departments
2. Number of AI projects completed within the last fiscal year
3. Percentage of AI models with documented data lineage
4. Frequency of data quality audits on the organization's data sets

Question 56

Which type of attack involves users inputting malicious text in AI models to disclose private information?

1. Data drift
2. Prompt injection
3. Data poisoning
4. Brute force

Question 57

From an audit perspective, which of the following BEST supports the objectives of an AI governance program?

1. Establishing an AI ethics committee or responsible AI review board
2. Defining AI policies for model interpretability, transparency, and resiliency
3. Defining roles, responsibilities, and training for all stakeholders on AI ethics
4. Developing an AI risk register to record potential algorithmic bias

Question 58

An organization uses an AI image generation platform to create promotional materials. An IS auditor identifies that the platform includes copyrighted images in its training data.

Which of the following is the auditor’s BEST recommendation to address this issue?

1. Suspend the use of the platform until the training data is sanitized.
2. Label all AI-generated images to disclaim the possibility of third-party content.
3. Implement a manual review process to ensure no copyrighted images are used in generated outputs.
4. Use a platform that certifies the provenance and licensing of its training data.

Question 59

Which control is MOST important to verify in order to ensure proper data management with AI systems?

1. Data has been labeled according to sensitivity.
2. Appropriate data metrics have been developed.
3. A data inventory has been determined.
4. A data governance framework has been established.

Question 60

Which of the following should be done FIRST when an attacker exfiltrates sensitive information from an AI model?

1. Inform regulators and affected stakeholders of a potential data breach.
2. Implement rate limiting and query restrictions to reduce exploitation attempts.
3. Isolate impacted systems until the attack vector is identified.
4. Rebuild the AI model using a more secure architecture.

Question 61

Which of the following is the MOST important purpose of conducting a risk assessment for AI models within an organization?

1. Determining whether AI model outputs align with established use cases
2. Categorizing data used by the AI model
3. Defining mitigation strategies for AI deployment
4. Monitoring AI model performance on an ongoing basis

Question 62

Which of the following controls MOST effectively helps to ensure an AI model is resilient against external threats?

1. Monitoring of AI access logs
2. AI model configuration testing
3. AI data set anonymization
4. Monitoring of AI model developers

Question 63

An IS auditor learns that the training data for an AI solution has insufficient representation.

Which of the following would be the GREATEST risk in this situation?

1. Imbalance
2. Underfitting
3. Overfitting
4. Clustering

Question 64

An investment advisory system is supported by a generative AI algorithm, and there is concern that opposing recommendations are returned from the same prompt.

Which of the following is the MOST likely reason that this would happen?

1. A new set of training and configuration data is fed to the AI model for each execution.
2. Discriminatory results are removed prior to the AI model's output.
3. AI output is the product of dynamic data and statistical methods.
4. AI systems perform a high volume of computation to reflect large variances.

Question 65

An organization using AI to create digital content faces challenges in protecting its intellectual property. The content is often shared online or used by clients in various digital platforms.

Which of the following is the BEST way to mitigate this risk?

1. Separate training and production data.
2. Implement watermarking.
3. Implement a firewall.
4. Apply adversarial training.

Question 66

Which of the following is the MOST important consideration when auditing the data used for training an AI model?

1. Representativeness
2. Understandability
3. Predictability
4. Timeliness

Question 67

A newly deployed fraud detection model is misclassifying transactions due to inconsistent formatting in the data stream.

Which of the following is the IS auditor's BEST recommendation to ensure consistent model performance?

1. Define and document the technical specifications for incoming data
2. Enable real-time monitoring of transaction volumes
3. Train staff on fraud patterns and post-deployment alert handling
4. Increase model complexity to handle more types of data input

Question 68

Which of the following is the MOST important consideration when preparing training data for a supervised learning model?

1. The data should be preprocessed using the same resources available during inference.
2. The data should have appropriate sign-off from management.
3. The data should be following standard distribution.
4. The data should contain only examples labeled with high confidence.

Question 69

Which of the following should be an IS auditor’s GREATEST concern if class imbalance is identified in training data for an AI model?

1. Data drift
2. Data quality
3. Model bias
4. Model overfitting

Question 70

An organization plans to deploy an AI model for real-time fraud detection in financial transactions.

Which of the following is the BEST approach to manage risk associated with false negatives?

1. Increase the frequency of manual reviews for flagged transactions.
2. Define clear business requirements for acceptable false negative rates.
3. Train the AI model using previously identified false negatives.
4. Limit the system initially to only real-time and low-value transactions.

Question 71

Which of the following should be done FIRST when an AI chatbot has been identified as giving harmful advice?

1. Implement prompt sanitization filters.
2. Segment user access based on risk profiles.
3. Enable real-time auditing.
4. Enable content output filters.

Question 72

Which of the following is the BEST approach to mitigate the risk of AI model degradation?

1. Increase the use of synthetic data for model training purposes
2. Implementing periodic human reviews of model outputs and recommendations
3. Ensuring models are trained on both model-generated and human-generated data
4. Introducing continuous monitoring to identify adversarial inputs

Question 73

An organization developed an AI model trained on its monthly data.

Which of the following would be the BEST validation method to avoid data drift?

1. Grouped split by customer ID
2. Random split across all months
3. Time series cross-validation
4. Tenfold cross-validation

Question 74

The internal audit department of a large global organization is evaluating the use of an AI-based voice-to-speech tool to document interviews during audits. The tool uploads all recordings to a cloud service provider for transcription.

Which of the following is the GREATEST risk?

1. Inaccurate transcriptions impacting reliability of audit records
2. Potential data loss resulting from service downtime or failures
3. Privacy concerns arising from data storage in the cloud
4. Unauthorized access to sensitive data by the cloud vendor

Question 75

Which of the following is MOST important for an IS auditor to assess when reviewing logs of prompts and corresponding AI responses?

1. Employee use of the AI model outside of business hours
2. Disclosure of confidential information in response to queries
3. Volume of storage utilized and length of retention periods
4. Inadequate AI model training prior to being migrated to production

Question 76

In order to ensure effective alignment with organizational priorities, which of the following is MOST important for an IS auditor to address when developing an audit plan for an AI-based tool?

1. Cost-benefit strategy for AI adoption
2. AI users’ understanding of ethical standards
3. The AI tool’s security alignment with governance policies
4. Management practices for AI oversight

Question 77

A bank's fraud detection model achieves high accuracy on its initial data set but performs poorly in production. The data science team needs to tune hyperparameters and select the best model architecture before final deployment.

Which dataset is BEST to use for this model selection process?

1. Training dataset
2. Holdout dataset
3. Validation dataset
4. Testing dataset

Question 78

When auditing the transparency of an AI system, which of the following would be the MOST effective way to understand the model's decision-making process?

1. Evaluating the diversity of the training data set
2. Assessing the computational cost of the model
3. Reviewing the explainability of AI outputs
4. Analyzing the complexity of the algorithms used

Question 79

An IS auditor notes that an AI model achieved significantly better results on training data than on test data.

Which of the following problems with the model has the IS auditor identified?

1. Underfitting
2. Bias
3. Overfitting
4. Generalization

Question 80

An AI team is developing a natural language processing (NLP) chatbot to assist customers with troubleshooting technical issues. The collected data includes informal and multiple languages.

Which of the following preprocessing steps is MOST important to ensure effective model training?

1. Remove all informal and multiple languages to train the model only on English data to avoid complexity.
2. Apply tokenization and stemming to break down the informal language into manageable components and reduce complexity.
3. Standardize informal language using dictionaries and incorporate language translation for multiple-language handling.
4. Perform entity recognition to extract key information from the informal language for better contextual understanding.

Question 81

Which of the following is the MOST critical consideration for incident response in AI systems?

1. Developing a process to monitor and correct biased outputs in AI models
2. Assigning accountability for managing and resolving AI -related incidents
3. Deploying automated incident response systems to flag unusual patterns in AI model behavior
4. Conducting regular training to enhance understanding of AI troubleshooting

Question 82

An IS auditor is reviewing an AI application that uses customer data to refine the organization's marketing outreach strategies.

Which of the following should be the auditor's PRIMARY focus during this review?

1. Alignment with organizational AI strategies
2. Access control design and effectiveness
3. Compliance with applicable privacy regulations
4. Escalation protocols for sensitive data breaches

Question 83

During a pre-implementation risk assessment, an AI model is determined to present a significant risk of bias and potential harm in excess of the organization’s risk tolerance.

Which of the following is the MOST appropriate response?

1. Obtain board approval for an exception.
2. Enhance the data that the model is trained on.
3. Revisit the risk tolerance to ensure it is appropriate.
4. Postpone deployment until the risk can be safely managed.

Question 84

The PRIMARY objective of auditing AI systems is to:

1. optimize user experience and interface satisfaction.
2. identify biases and decision transparency.
3. minimize algorithm latency and information storage impacts.
4. maximize system efficiency and throughput.

Question 85

The PRIMARY objective of conducting a red team simulation to test the security of an AI model is to:

1. verify the availability of the infrastructure under adverse conditions.
2. validate the accuracy of the model's outputs across multiple data sets.
3. test the robustness of the model’s predictions under unexpected conditions.
4. identify weaknesses in the model's ability to resist adversarial inputs.

Question 86

Which of the following data management practices poses the GREATEST risk?

1. Converting categorical variables to numerical formatting and encodings
2. Changing the total transaction amount data type from object to integer
3. Deleting duplicate entries because all attributes in the record match
4. Deleting outlier data values outside of the 5th and 95th percentiles from source data

Question 87

An organization is training a skin cancer recognition model. Photographs collected from which of the following sources would present the GREATEST risk associated with data integrity?

1. Research facility receiving grants for cancer research
2. Open-source data augmentation file
3. Social media platform with images from all over the world
4. Cohort of dermatologists with signed patient consent forms

Question 88

An organization is conducting an audit of an AI decision-making system being used for talent recruitment.

Which of the following is MOST critical to evaluate in order to ensure the system meets stakeholder needs?

1. Decision timeliness
2. Decision fairness
3. Predictive accuracy
4. Input validation

Question 89

Which of the following is the BEST key performance indicator (KPI) to measure a model’s performance on imbalanced datasets?

1. Recall
2. F1 score
3. Error rate
4. Precision

Question 90

Which of the following is the GREATEST risk associated with using facial recognition authentication for opening bank accounts?

1. Inconsistent image quality across devices can reduce the accuracy of identity verification algorithms.
2. AI-generated deepfake or synthetic images can fool the authentication system.
3. Authentication may fail if the user is wearing sunglasses or a mask.
4. The system may incorrectly reject valid facial images due to strict thresholds.

Question 91

Which of the following techniques is BEST to use when there is a limited dataset of detailed images available to train a convolutional neural network (CNN) model?

1. Duplication of current dataset
2. Splitting the dataset 50/50 between training and testing sets
3. Transfer learning from an open-source model
4. Minority class undersampling augmentation

Question 92

An organization shares an AI model with external partners. One partner reports that sensitive data has been inadvertently exposed through the model's outputs.

Which of the following is the IS auditor's BEST recommendation?

1. Retrain the model immediately and implement privacy-preserving techniques.
2. Disable the shared model and notify partners of the potential breach.
3. Limit the model's outputs to anonymized results while investigating further.
4. Audit the data pipelines of all partners to identify the source of the leak.

Question 93

Which of the following should be done FIRST when developing an incident management process for AI threats?

1. Establish incident classification procedures.
2. Define clear roles and responsibilities.
3. Configure SIEM for security alerts.
4. Develop incident escalation procedures.

Question 94

A financial institution's internal audit team discovers that an employee in the financial control department frequently uploads the company's financial data to a public generative AI platform for analysis and reporting.

Which of the following is the MOST significant risk posed by this action?

1. System integration issues with the enterprise resource planning (ERP) system
2. Data privacy and confidentiality breaches
3. Theft of intellectual property and trade secrets
4. Inaccurate financial analysis caused by biases

Question 95

Which of the following is the GREATEST risk when an organization uses publicly available social media data to train its AI model without obtaining explicit user consent?

1. Data with questionable labelling
2. Introduction of inaccurate and incomplete data
3. User distrust caused by lack of transparency in AI model training
4. Violation of data privacy regulations leading to legal penalties

Question 96

An anti-fraud team in a financial organization is building a machine learning (ML) model to detect online fraud, and an internal audit team has been engaged to audit the model.

When auditing the model training stage, which of the following is MOST important to include in the scope of the audit?

1. Data schema
2. Data fairness
3. Training staff expertise
4. Training procedure

Question 97

Which of the following is the MOST important reason for applying regular software updates to AI systems operating in high-risk environments?

1. To safeguard the systems against AI-powered zero-day exploits
2. To accelerate model training cycles and enhance processing speed
3. To reduce the need for human oversight of model outputs
4. To address vulnerabilities and reduce the risk of output integrity attacks

Question 98

To ensure stakeholders are adequately prepared to address workforce impacts, which of the following is an IS auditor’s BEST recommendation for an organization’s AI incident response plan?

1. Review the frequency of AI security incidents and updates to the response plan.
2. Verify that the organization has an AI ethics committee to discuss potential workforce impacts.
3. Validate that regular cross-functional AI incident drills and skill gap assessments are performed.
4. Confirm that all employees have completed a standardized online AI awareness course within the last year.

Question 99

Which of the following processes is MOST important for an organization to have in place to ensure the credibility of AI outputs?

1. User consent
2. Model alignment
3. Data governance
4. Data analytics

Question 100

Which of the following is the MOST important reason to conduct regular threat modeling exercises for AI systems and data?

1. To proactively identify potential vulnerabilities in AI systems
2. To assess the performance of AI algorithms
3. To comply with AI regulatory requirements
4. To prevent instances of AI model drift

Question 101

An IS auditor for a veterinary clinic was informed that the dog breed categorical variable within the data set is necessary for the predictive machine learning (ML) model conclusions.

Which of the following introduces the MOST risk in this situation?

1. Data scaling was not utilized.
2. Clustering was not utilized.
3. Ordinal label encoding was utilized.
4. One-hot encoding was utilized.

Question 102

Which of the following roles is BEST suited to define the implementation roadmaps for adopting AI solutions?

1. Risk management committee
2. Steering committee
3. Product management
4. Internal audit

Question 103

An IS auditor is reviewing a data set used by a university to train a predictive machine learning (ML) model.

Which of the following MOST likely indicates risk that the model could not process all data and make necessary correlations?

1. Student Number field in integer format
2. Grade Level field in float format
3. Final Grade Percent field in object format
4. Having an undergraduate degree in Boolean format

Question 104

Which of the following BEST ensures representativeness in AI systems when assessing training data periodically?

1. Training data is manually reviewed for bias.
2. Data validation processes are automated and consistently performed.
3. Training data remains relevant and reflects evolving real-world conditions.
4. Synthetic data is used to train the AI systems.

Question 105

An AI healthcare diagnostic tool requires large volumes of patient data, raising concerns about privacy and data breaches.

Which of the following is the MOST effective strategy to mitigate this risk?

1. Encrypt the data and transmit it through a secure channel.
2. Limit the tool's access to only publicly available data sets.
3. Collect data from all patients to use for data analysis.
4. Use synthetic data or anonymized data sets for model training.

Question 106

Which of the following is the BEST way to ensure data fed into an AI model aligns with business objectives?

1. Normalize the data within expected tolerances.
2. Change to new data sources.
3. Document the data input requirements.
4. Define new data attributes.

Question 107

An IS auditor is auditing a financial system in which a generative AI tool is used to identify trends in batches of 4,000 rows while the generative AI tool has a limit of 3,000 tokens.

Which of the following is the GREATEST concern?

1. The AI will prioritize high-value entries.
2. The AI will process only a portion of the data set.
3. The AI output will be biased toward the first 3,000 tokens.
4. The AI will reject the data set and not analyze the data.

Question 108

A logistics company uses an AI model to optimize delivery routes.

Which of the following methods would BEST verify the model’s accuracy?

1. Using advanced outlier detection techniques to identify anomalies in route length
2. Running bias tests to confirm that the model does not favor certain delivery areas
3. Comparing the AI-generated routes with routes generated using traditional methods
4. Testing the model on the most recent data for the latest conditions

Question 109

Which of the following should be of GREATEST concern to an IS auditor when reviewing ethical considerations for an AI solution?

1. The decision-making process is unexplainable.
2. The solution is hosted on a shared cloud environment.
3. The model has not been retrained recently.
4. The solution documentation is still in draft.

Question 110

Which of the following is MOST important to have in place when initially populating data into a data frame for an AI model?

1. An approved risk assessment for including, excluding, or subsequently dropping data attributes from the model
2. The code for separating data into training and testing data sets
3. An analysis of exploratory data that checks for incorrect data types, null values, and duplicate entries
4. The box charts histograms, scatterplots, and Venn diagrams that identify correlations and outliers

Question 111

Which of the following controls BEST helps reduce the risk of hallucinations in an AI model?

1. Requiring model output explanations
2. Implementing a human-in-the-loop approach
3. Improving model transparency
4. Reducing the model’s creativity score

Question 112

A bank uses a video-based know your customer (KYC) verification process. Cybercriminals exploit this process by using deepfake technology to impersonate bank customers.

Which of the following countermeasures is the BEST way for the bank to mitigate this risk?

1. Discontinuing the use of the video-based verification process
2. Encrypting all customer data and communication
3. Requesting additional identity and address documents for verification
4. Leveraging AI-based liveness detection during video verification

Question 113

After the development of an AI model, a quality assurance (QA) team checks that all input variables, model parameters, and training scripts match the approved technical design documents before deployment.

Which of the following BEST describes this activity?

1. Model verification
2. Model tuning
3. Model validation
4. Model testing

Question 114

Which of the following BEST enables an AI model to solve complex problems involving the analysis of large volumes of data?

1. Support vector machines
2. Reinforcement learning (RL)
3. Natural language processing (NLP)
4. Deep learning

Question 115

Which of the following BEST ensures that an AI system complies with user data ownership rights under privacy regulations?

1. Applying data clustering techniques to anonymize data sets
2. Regularly conducting AI system performance testing for accuracy
3. Implementing a transparent data consent management process
4. Enforcing strict data retention policies to limit storage duration

Question 116

Which of the following testing techniques would BEST validate whether an organization’s data governance program effectively ensures data quality and integrity for AI model training and deployment?

1. Reviewing the organization’s AI software development life cycle documentation
2. Assessing data lineage to verify the traceability of data sources
3. Conducting a penetration test to identify vulnerabilities in the model
4. Performing a business impact analysis (BIA) to assess the consequences of AI model failure

Question 117

Which of the following is the MOST significant benefit of performing frequent AI model testing and retraining?

1. Removing unnecessary model features
2. Ensuring the model is updated with current data
3. Ensuring model scalability
4. Assessing the impact of attacks

Question 118

When reviewing contracts or other lengthy documentation in the planning phase, which of the following tools would BEST extract relevant information?

1. Predictive analytics
2. Robotic process automation (RPA)
3. Autoregressive sequencing model
4. Natural language processing

Question 119

An organization is reviewing its existing data governance framework after implementing an AI-based document repository solution.

Which of the following should be the PRIMARY consideration for the organization?

1. Data retention policy
2. Data classification
3. Data enrichment
4. Qualitative data collection

Question 120

An organization uses an AI-based chatbot that collects customer data during interactions.

Which of the following is MOST important to ensure compliance with data consent requirements?

1. Obtaining consent each time queries are processed by the chatbot
2. Deleting data immediately following customer interactions with the chatbot
3. Anonymizing user interaction data after three months
4. Embedding a consent mechanism that provides clear options before data collection begins

Question 121

An IS auditor learns that the organization’s AI solution is configured with web integration enabled.

Which of the following is the MOST important control for the auditor to validate?

1. Data augmentation activities prior to model building
2. Key performance indicator (KPI) metrics for model inference time
3. Activity logging with integration to the organization’s SIEM system
4. Separation of duties between the model creator and the model tester

Question 122

Which of the following BEST helps in detecting AI model drift?

1. Establishing a model performance baseline and implementing continuous monitoring
2. Evaluating model accuracy rates for stability and performing qualitative data analysis
3. Engaging periodic external reviews of model outputs and identifying root causes
4. Using linear regression techniques and conducting cluster analysis

Question 123

When reviewing an organization's AI data governance program, which of the following is MOST important to validate to ensure compliance with privacy regulations?

1. Implementation of privacy techniques in AI models
2. Security of private cloud deployment of AI models
3. Feasibility of AI model retraining to incorporate new privacy data
4. Avoidance of AI models that are based on open-source algorithms

Question 124

An organization has deployed a generative AI system for customer support that includes frequent updates to the AI model after deployment.

Which of the following represents the GREATEST risk?

1. Lack of a change management policy specific to AI
2. Overreliance on manual review of AI model outputs
3. Lack of continuous monitoring for model changes
4. Lack of a dedicated AI governance committee

Question 125

An IS auditor identifies that an organization is mixing AI-generated content into training data without labeling.

Which of the following presents the GREATEST risk in this scenario?

1. The model loses alignment safeguards.
2. The model propagates outdated information.
3. The model outputs become inconsistent across similar queries.
4. The model reinforces its own mistakes as if they were facts.

Question 126

Which of the following is the MOST important task when gathering data during the AI system development process?

1. Isolating the system
2. Stratifying the data
3. Training the system
4. Cleaning the data

Question 127

A manufacturing company installs an AI system to control robotic arms on its assembly line. The system learns over time, adjusting its movements based on production results to improve accuracy and efficiency.

What type of learning is the robot MOST likely using in this scenario?

1. Reinforcement learning
2. Supervised learning
3. Unsupervised learning
4. Deep learning

Question 128

Which of the following is the GREATEST risk associated with using AI in audit planning?

1. Scope creep
2. Limited knowledge
3. Increased planning costs
4. Incomplete data

Question 129

When evaluating the process flowchart of an AI machine learning (ML) model, which task should be performed FIRST to provide assurance that the model will function as intended?

1. Scale and standardize numerical variables.
2. Split the data set into training and test sets.
3. Apply the model algorithm.
4. Address imbalances in the data.

Question 130

In the context of an AI implementation, which of the following actions is MOST critical for an organization's change management program?

1. Conducting a comprehensive risk assessment specific to AI-related changes
2. Reviewing documentation for AI system changes, updates, and patches
3. Verifying that all employees have completed mandatory AI ethics training
4. Ensuring the organization has a dedicated AI governance committee

Question 131

Which of the following is the MOST frequent cause of generative AI model hallucinations?

1. Inconsistent change management
2. Weak access controls
3. Outdated model cards
4. Inadequate data quality

Question 132

Which key performance indicator (KPI) BEST indicates the quality of the data used in AI model training?

1. The difference between the mean and median of the data set
2. Number of features within the data set
3. Linearity of patterns within the data set when a log-transformed scale is applied
4. Percentage of missing values removed from the data set

Question 133

An AI system is misclassifying images after a routine model update. An IS auditor discovers that the updated model file was replaced by an unauthorized version.

Which of the following is the auditor’s BEST recommendation?

1. Notify all users of potential inaccuracies and deactivate the system.
2. Immediately retrain the model from scratch using a secure data set.
3. Disable the automated update process to prevent future issues.
4. Revert to the last verified model version and initiate a root cause analysis.

Question 134

An audit reveals inconsistencies in the retention period of data used for AI training.

What is the BEST recommendation to mitigate this risk?

1. Enhance licensing agreements to include retention clauses.
2. Establish a dedicated data clustering team for ongoing oversight.
3. Implement automated data cleansing tools to enforce retention policies.
4. Assign data ownership roles to the AI model development team.

Question 135

An IS auditor is testing an AI-based fraud detection system that flags suspicious transactions and finds that the system has a high false positive rate.

Which of the following testing methods should be prioritized to BEST optimize the detection rate?

1. Cross-validation testing
2. Benford's Law analysis
3. Substantive testing
4. Regression testing

Question 136

Which of the following is the GREATEST risk associated with deploying an AI system with ineffective anomaly detection?

1. Inconsistent AI system configuration management
2. Undetected data poisoning that impacts AI decision quality
3. Delayed incident response to AI model drift
4. Failure to comply with AI reporting standards

Question 137

Which of the following is the MOST effective control to safeguard a model’s architecture, weights, and hyperparameters?

1. Provide training to employees on best practices for AI technical security.
2. Require users to sign a confidentiality agreement before making services and data available.
3. Maintain detailed data audit logs of identified deviations within model training data.
4. Implement strict access controls and encryption for model components.

Question 138

Which of the following techniques would be MOST effective as part of incident management procedures for a prompt injection attack?

1. Fine-tune the AI model.
2. Scan inputs for code-like structure of text.
3. Deploy input validation to sanitize abuse prompts.
4. Monitor the prompts for excessive special characters.

Question 139

A model developer is looking to mitigate the risk of information loss within an imbalanced data set that contains majority and minority classes.

Which of the following strategies would an IS auditor consider to be MOST appropriate?

1. Undersampling to remove excess data points
2. Splitting data into к-folds with cross-validation
3. Tuning the model’s hyperparameters
4. Oversampling to create new data points