AAIA ISACA Advanced in AI Audit - Set 4 - Part 1

Correct Answer: Limited memory artificial intelligence

Option d is correct because limited memory AI stores recent information temporarily to inform current decisions, making it ideal for session-based customer interactions requiring contextual awareness.

Option a is incorrect because self-aware AI possesses consciousness and subjective experience, which remains purely theoretical and unnecessary for simple conversational commerce applications today.

Option b is incorrect because theory of mind AI understands human emotions and intentions at a sophisticated level, which exceeds requirements for basic customer interaction memory needs.

Option c is incorrect because reactive machines only respond to current input without any memory capability, making them unsuitable for maintaining conversation context across multiple exchanges.

Correct Answer: Defined accountability structures

Option a is correct because clear accountability structures establish who is responsible for AI decisions and outputs, addressing the fundamental governance gap of undefined ownership identified.

Option b is incorrect because cloud hosting contracts address infrastructure and vendor management concerns rather than the core issue of internal accountability for AI-generated outputs.

Option c is incorrect because collecting additional training data addresses model performance concerns but does not resolve the identified gap regarding ownership of AI outputs.

Option d is incorrect because hyperparameter documentation supports technical reproducibility but fails to address the organizational accountability and ownership issues discovered during review.

Correct Answer: Overfitting during model training

Option b is correct because overfitting causes models to perform excellently on training data but poorly on new real-world data, exactly matching the described symptom pattern.

Option a is incorrect because hyperparameter tuning issues would typically manifest during initial testing phases rather than appearing suddenly after successful deployment into production environments.

Option c is incorrect because executive sponsorship affects strategic direction and resource allocation but does not directly cause technical performance degradation in deployed AI models.

Option d is incorrect because vendor management concerns relate to third-party AI solutions rather than the technical model behavior issue of increased false positive rates.

Correct Answer: Systemic bias from societal structures

Option c is correct because systemic bias stems from historical inequalities embedded in institutions and societal practices, which the AI learns from training data reflecting these patterns.

Option a is incorrect because human bias involves subjective judgments during AI development rather than inherited patterns from historical societal underrepresentation in research participation.

Option b is incorrect because while data collection methods matter, the root cause here is deeper systemic healthcare inequities that existed before any specific data collection occurred.

Option d is incorrect because the model architecture itself is not causing bias; rather, the bias originates from historical societal patterns encoded within the training dataset.

Correct Answer: Unacceptable risk requiring prohibition

Option d is correct because government social scoring systems that affect citizen rights and access to services are explicitly classified as unacceptable risk and generally prohibited.

Option a is incorrect because high-risk classification applies to systems like employment AI or critical infrastructure, not social scoring systems which face outright prohibition.

Option b is incorrect because limited risk classification applies to systems like chatbots requiring transparency, not government social scoring which poses fundamental rights threats.

Option c is incorrect because minimal risk covers benign applications like spam filters and video games, completely inappropriate for systems affecting citizen access to services.

Correct Answer: IT, risk, legal, operations, finance

Option a is correct because cross-functional representation from IT, risk, legal, operations, and finance ensures technical, compliance, operational, and financial perspectives are all considered.

Option b is incorrect because limiting representation to technical roles excludes critical perspectives on legal compliance, business operations, financial implications, and risk management considerations.

Option c is incorrect because relying exclusively on external parties removes internal organizational knowledge and accountability necessary for effective ongoing AI governance oversight.

Option d is incorrect because marketing and sales focus provides insufficient coverage of technical, legal, risk, and operational considerations essential for comprehensive AI governance.

Correct Answer: Shared responsibility obligations

Option c is correct because organizations cannot fully outsource accountability when using third-party AI; customers retain significant responsibility for usage, monitoring, and data governance.

Option a is incorrect because data minimization concerns limiting data collection to necessary amounts rather than the distribution of accountability between vendors and customers.

Option b is incorrect because version control addresses technical reproducibility and change management rather than the allocation of responsibility between organizations and AI vendors.

Option d is incorrect because hyperparameter documentation relates to model configuration transparency rather than contractual and accountability divisions between parties using AI.

Correct Answer: Ethical issues become harder to fix later

Option d is correct because problems identified during planning are easier to address than those discovered after significant development investment, when changes become exponentially more difficult.

Option a is incorrect because while regulatory documentation matters, the fundamental concern is that postponing ethical assessment makes remediation increasingly difficult and costly over time.

Option b is incorrect because vendor requirements are secondary to the core principle that early risk identification prevents embedded problems that become expensive to remediate later.

Option c is incorrect because training data availability is a separate logistical concern unrelated to the timing of ethical risk assessments during the project planning phase.

Correct Answer: Unintentional insider actions

Option a is correct because employees with legitimate access inadvertently exposing confidential data represents unintentional insider threats, distinct from deliberate malicious actions by insiders or outsiders.

Option b is incorrect because organized criminals actively seek to exploit systems for financial gain rather than passively benefiting from employee data handling errors.

Option c is incorrect because nation state actors pursue geopolitical objectives through targeted operations rather than benefiting from casual employee data handling mistakes with public tools.

Option d is incorrect because external hackers actively breach security controls from outside, whereas this scenario involves authorized insiders making unintentional data exposure mistakes.

Correct Answer: Privacy as the default setting

Option b is correct because privacy as default means personal data is automatically protected without requiring user action, with privacy-preserving options pre-selected by system design.

Option a is incorrect because proactive approaches focus on anticipating and preventing privacy issues before they occur rather than specifically addressing automatic protection without user action.

Option c is incorrect because end-to-end security addresses protection throughout the entire data lifecycle rather than the specific requirement for automatic default privacy settings.

Option d is incorrect because respect for user privacy encompasses empowering users with control, which is broader than the specific requirement for automatic default protections.

Correct Answer: Predictive AI for forecasting events

Option c is correct because predictive AI analyzes historical data patterns to forecast future events, making it ideal for anticipating equipment failures based on sensor readings.

Option a is incorrect because generative AI creates new content like text and images rather than analyzing patterns to predict when specific future events will occur.

Option b is incorrect because reactive machines only respond to current inputs without learning from historical patterns needed to forecast future equipment maintenance requirements.

Option d is incorrect because theory of mind AI focuses on understanding human emotions and intentions, which is irrelevant to mechanical equipment failure prediction needs.

Correct Answer: The black-box problem

Option a is correct because black-box refers to AI systems where internal decision-making processes are opaque and not human-interpretable, creating transparency and audit challenges.

Option b is incorrect because sampling bias relates to unrepresentative data selection during collection rather than the inability to interpret how models reach specific decisions.

Option c is incorrect because drift detection concerns monitoring performance degradation over time rather than the fundamental challenge of understanding model decision-making logic.

Option d is incorrect because overfitting describes models that memorize training data rather than learning generalizable patterns, unrelated to explainability of decision-making processes.

Correct Answer: Data drift occurrence

Option d is correct because data drift specifically describes when real-world data characteristics diverge from training data over time, requiring monitoring mechanisms to detect and address.

Option a is incorrect because hyperparameter errors occur during initial configuration and training rather than emerging from changes in production data characteristics over time.

Option b is incorrect because algorithm selection mistakes happen during development phases rather than manifesting as evolving differences between training and production data characteristics.

Option c is incorrect because model architecture degradation would involve structural changes to the model itself rather than changes in the characteristics of incoming data.

Correct Answer: Limited memory AI

Option c is correct because limited memory AI stores recent information temporarily to inform current responses, perfectly matching chatbot requirements for within-session context awareness.

Option a is incorrect because self-aware AI possesses consciousness and subjective experience, representing theoretical concepts far beyond requirements for simple conversational context tracking.

Option b is incorrect because theory of mind AI would understand complex human emotions and beliefs, exceeding the basic requirement of tracking conversation context within sessions.

Option d is incorrect because artificial general intelligence represents human-equivalent cognitive ability across all domains, vastly exceeding simple conversation context tracking requirements.

Correct Answer: Ongoing maintenance and remediation

Option a is correct because organizations commonly underestimate hidden costs including data sourcing, problem remediation, and ongoing maintenance that emerge after initial AI deployment.

Option b is incorrect because hardware procurement expenses are typically visible and quantifiable during initial planning phases rather than being commonly overlooked hidden costs.

Option c is incorrect because initial software licensing fees are generally transparent and included in project budgets rather than emerging as unexpected hidden costs later.

Option d is incorrect because executive time investment, while important, is not typically categorized among the commonly underestimated ongoing operational cost categories for AI.

Correct Answer: Accepting residual risk formally

Option b is correct because risk acceptance must be a conscious, informed, documented decision rather than simply ignoring risks, requiring explicit acknowledgment and justification.

Option a is incorrect because while mitigation requires documentation, acceptance specifically requires formal acknowledgment that risks will be tolerated without additional controls being implemented.

Option c is incorrect because transferring risk through insurance shifts financial burden but does not specifically require the conscious documented decision-making unique to formal acceptance.

Option d is incorrect because avoidance eliminates the risk entirely rather than requiring the specific documentation and conscious decision-making involved in accepting known residual risks.

Correct Answer: Environmental inconsistency

Option c is correct because using different tokenization versions between training and production creates environmental inconsistency, causing the model to receive fundamentally different input representations.

Option a is incorrect because data backup concerns preserving information for recovery purposes rather than maintaining consistency between development and production environment configurations.

Option b is incorrect because access control violations involve unauthorized system entry rather than inconsistent configuration between training and production processing environments.

Option d is incorrect because stakeholder communication gaps involve information sharing failures rather than technical inconsistencies in environment configuration between system stages.

Correct Answer: Supervised learning methodology

Option a is correct because supervised learning trains models using labeled data where inputs are paired with correct outputs, enabling the model to learn mappings for classification and regression.

Option b is incorrect because reinforcement learning uses trial and error with rewards and penalties rather than labeled input-output pairs for training model behavior.

Option c is incorrect because unsupervised learning finds patterns in unlabeled data without predefined correct outputs, making it unsuitable for tasks requiring known answer labels.

Option d is incorrect because transfer learning adapts pre-trained models to new tasks rather than specifically describing the use of labeled input-output pairs during training.

Correct Answer: Unsupervised clustering methods

Option d is correct because unsupervised clustering finds patterns and groups similar data points without requiring predefined labels, ideal for discovering hidden customer segments.

Option a is incorrect because supervised classification requires predefined categories and labeled examples, which contradicts the objective of discovering unknown segments without predetermined groupings.

Option b is incorrect because regression predicts continuous numerical values rather than grouping similar items together for segment discovery without predefined categories.

Option c is incorrect because reinforcement learning optimizes sequential decision-making through rewards rather than discovering natural groupings within existing customer data.

Correct Answer: Statistical bias from sampling

Option c is correct because statistical bias arises from data collection and sampling issues that create unrepresentative datasets, directly matching the described demographic underrepresentation problem.

Option a is incorrect because human bias involves subjective judgments during labeling or development rather than proportional representation issues in the underlying sample population.

Option b is incorrect because systemic bias originates from broader societal and institutional patterns rather than specific sampling methodology choices during data collection processes.

Option d is incorrect because algorithmic bias relates to model architecture decisions rather than the composition and representativeness of the training data sample itself.