AAIA ISACA Advanced in AI Audit - Set 5 - Part 1

Correct Answer: Scalability for growth

Option a is correct because overfitting occurs when a model learns training data too perfectly, memorizing specific examples including noise rather than learning patterns that generalize to new unseen data effectively.

Option b is incorrect because data poisoning involves malicious injection of corrupt data into training sets to compromise model behavior, not poor generalization from legitimate training data.

Option d is incorrect because concept drift describes performance degradation when real-world conditions change over time, not initial failure to generalize from training to production environments.

Option b is incorrect because data poisoning involves malicious injection of corrupt data into training sets to compromise model behavior, not poor generalization from legitimate training data.

Correct Answer: Implementing controls at all locations

Option c is correct because data confidentiality must be maintained across the entire AI development lifecycle, requiring protection at every location where data exists including raw storage, lakes, and databases.

Option a is incorrect because protecting only raw data leaves sensitive information exposed at other critical points in the pipeline such as data lakes and vector databases where processing occurs.

Option b is incorrect because focusing solely on data lakes ignores other vulnerable locations where sensitive data resides, creating security gaps that attackers could exploit throughout the pipeline.

Option d is incorrect because securing only vector databases leaves raw data and data lake storage unprotected, failing to provide the comprehensive protection required for complete AI system security.

Correct Answer: Specific dataset versions linked to models

Option d is correct because linking specific dataset versions to model iterations enables precise recreation of the AI's state at any point, essential for reproducibility and understanding decisions made during incidents.

Option a is incorrect because current model parameters alone cannot recreate historical versions needed to investigate past incidents, lacking the dataset context that shaped earlier model behavior.

Option b is incorrect because training algorithms without corresponding data versions cannot reproduce the specific learned patterns that influenced the model's decisions at the time of an incident.

Option c is incorrect because recent input data does not provide the historical training context necessary to understand how earlier model versions were developed and what data influenced their behavior.

Correct Answer: Data drift

Option a is correct because data drift occurs when real-world data characteristics change over time compared to training data, causing model performance degradation as learned patterns become outdated and misaligned.

Option b is incorrect because model extraction is an adversarial attack where attackers steal model logic through repeated queries, unrelated to natural changes in customer behavior affecting model accuracy.

Option c is incorrect because prompt injection involves crafting malicious inputs to manipulate AI responses, not the gradual shift in data characteristics that causes performance decline over time.

Option d is incorrect because data poisoning refers to intentional injection of malicious data into training sets, whereas this scenario describes natural evolution of customer behavior patterns over time.

Correct Answer: Implementing synthetic data generation

Option c is correct because synthetic data mimics real patterns without containing sensitive information, enabling realistic development and testing while protecting patient privacy and proprietary formulas from exposure.

Option a is incorrect because using production data in development environments creates significant privacy, confidentiality, and regulatory compliance risks that synthetic data approaches specifically avoid.

Option b is incorrect because eliminating testing would result in unreliable AI systems being deployed to production, creating far greater risks than the challenges of protecting development data.

Option d is incorrect because removing access controls would increase exposure risk dramatically, contrary to the goal of protecting sensitive information while enabling effective development activities.

Correct Answer: Proactive not reactive approach

Option d is correct because the proactive principle requires anticipating and preventing privacy harms during design and development phases, addressing risks before they materialize rather than responding afterward.

Option a is incorrect because privacy as default focuses on automatic data protection without user action, not specifically on anticipating problems during the design phase before development begins.

Option b is incorrect because full functionality addresses achieving both privacy and operational goals simultaneously, not the timing of when privacy considerations are integrated into development processes.

Option c is incorrect because end-to-end security addresses comprehensive lifecycle protection, not specifically the proactive identification and prevention of privacy issues during initial design phases.

Correct Answer: Model extraction attack

Option b is correct because model extraction involves stealing model logic through systematic queries, allowing attackers to reconstruct decision-making processes without accessing source code or training data directly.

Option a is incorrect because data poisoning targets training data with malicious inputs to corrupt model learning, not querying production systems to understand and replicate existing model behavior.

Option c is incorrect because prompt injection manipulates inputs to bypass safety controls and produce harmful outputs, not systematically probing to understand and reconstruct model logic.

Option d is incorrect because adversarial evasion creates inputs that fool models into misclassification, not sustained querying campaigns designed to steal and replicate model functionality.

Correct Answer: Privacy as the default setting

Option a is correct because privacy as default ensures personal data is automatically protected without requiring user action, with data collection minimized and privacy-preserving options pre-selected by system design.

Option b is incorrect because embedded privacy focuses on integrating protection into architecture and code, not specifically on automatic protection without user intervention or configuration changes.

Option c is incorrect because visibility and transparency address informing users about data handling practices, not the automatic application of privacy protections without user action required.

Option d is incorrect because respect for user privacy emphasizes user-centric control and empowerment, whereas default privacy specifically ensures protection without any user action needed.

Correct Answer: Comprehensive rollback plan

Option c is correct because rollback plans provide predefined, tested procedures for reverting AI systems to previous stable versions when deployment issues emerge, ensuring quick recovery to known working states.

Option a is incorrect because release management plans focus on how and when deployment occurs, not specifically on procedures for reverting to previous versions when problems emerge after launch.

Option b is incorrect because production training programs prepare users and support staff to operate the new system, not technical procedures for reverting to previous system versions if needed.

Option d is incorrect because notification processes inform stakeholders about deployment status and changes, not technical procedures for returning systems to previous stable operational states.

Correct Answer: Concept drift

Option d is correct because concept drift occurs when underlying relationships in data change over time, causing model performance degradation as real-world conditions evolve beyond what the model learned during training.

Option a is incorrect because model extraction drift is not a recognized concept; model extraction refers to adversarial attacks stealing model logic, unrelated to gradual changes in underlying data relationships.

Option b is incorrect because security posture drift relates to degradation of security controls over time, not changes in the fundamental relationships between input features and outcomes that affect model accuracy.

Option c is incorrect because configuration management drift involves changes to system settings and configurations, not the evolution of real-world conditions that affect how input data relates to correct outcomes.

Correct Answer: Comprehensive logging of key steps

Option a is correct because logging key model inferences, critical data inputs, and intermediate processing steps creates visibility into AI decisions, enabling auditors to trace outcomes back to specific inputs and logic.

Option b is incorrect because redesigning the model does not inherently provide traceability for regulatory examination; logging capabilities are needed regardless of model architecture or design approach used.

Option c is incorrect because eliminating automation defeats the purpose of implementing AI and does not address the fundamental need for traceability in whatever decision-making processes remain in use.

Option d is incorrect because reducing decision complexity does not automatically provide traceability; even simple models require proper logging to enable auditors to understand and verify decision pathways.

Correct Answer: AI observability practices

Option c is correct because observability provides practices and tools for understanding why problems occur and predicting future issues, going beyond static logging to enable proactive identification of emerging problems.

Option a is incorrect because basic event logging only records what happened without providing insight into why issues occurred or predictive capabilities for anticipating future problems before they manifest.

Option b is incorrect because static reports provide historical snapshots but lack the real-time, continuous monitoring and predictive analysis capabilities needed to understand and anticipate complex AI system behaviors.

Option d is incorrect because manual review processes cannot scale to monitor the volume of AI interactions needed and lack the analytical capabilities to identify patterns predicting future system failures.

Correct Answer: Data poisoning attack

Option b is correct because data poisoning involves injecting malicious or biased data into training sets to corrupt how the model learns, causing it to develop flawed decision-making patterns that serve attacker goals.

Option a is incorrect because prompt injection manipulates inputs during inference to bypass safety controls, not corrupting training data to fundamentally alter how the model learns and makes decisions.

Option c is incorrect because model inversion attempts to extract training data from model outputs, not introduce corrupted data during training to influence how the model develops its decision logic.

Option d is incorrect because evasion attacks craft inputs that fool trained models into misclassification during operation, not corrupting the training process that shapes model behavior from the beginning.

Correct Answer: Non-negotiable review and approval

Option d is correct because even under emergency conditions, relevant stakeholders including business owners, legal, compliance, and risk management must be involved in reviewing and approving changes to AI systems.

Option a is incorrect because automated deployment without proper stakeholder review creates unacceptable governance risks, particularly for AI systems that can have significant business and compliance impacts.

Option b is incorrect because prioritizing speed over governance undermines the controls necessary to ensure AI changes do not introduce unintended risks or violate regulatory and compliance requirements.

Option c is incorrect because technical team autonomy without stakeholder oversight removes essential checks and balances that ensure AI system changes align with organizational policies and regulatory requirements.

Correct Answer: Accountability measures

Option a is correct because accountability measures establish clear responsibility for AI decisions and outcomes, documenting who is liable when systems make errors and ensuring someone is answerable for consequences.

Option b is incorrect because technical performance metrics measure how well the AI performs its functions, not who bears responsibility when decisions cause harm to affected individuals or organizations.

Option c is incorrect because availability targets specify uptime requirements for system access, not the assignment of responsibility and liability for decision outcomes that impact stakeholders.

Option d is incorrect because processing speed requirements define how quickly the system should respond, unrelated to establishing accountability frameworks for consequences of AI decisions.

Correct Answer: Edge case testing

Option c is correct because edge case testing specifically examines AI behavior with unusual, rare, or boundary condition inputs that may be underrepresented in training data, revealing failures that standard testing misses.

Option a is incorrect because benchmarking compares performance against baselines or competitors using typical scenarios, not specifically targeting unusual or rare conditions that expose model limitations.

Option b is incorrect because compliance verification checks adherence to regulations and policies, not the technical ability of models to handle unusual inputs or rare conditions effectively.

Option d is incorrect because standard performance testing evaluates typical operating conditions and may miss failures that only occur with unusual inputs or rare scenarios outside normal parameters.

Correct Answer: Training and awareness programs

Option d is correct because training and awareness programs ensure users, operators, and support teams understand AI capabilities and limitations before deployment, enabling proper system utilization and issue identification.

Option a is incorrect because rollback plans address technical procedures for reverting to previous versions, not preparing human users to understand and properly interact with the deployed AI system.

Option b is incorrect because release schedules coordinate deployment timing and sequencing, not educating users about system capabilities and limitations they need to understand for effective operation.

Option c is incorrect because technical configuration guides address system setup and parameters, not building user understanding of what the AI can and cannot do effectively.

Correct Answer: Plan and design stage

Option a is correct because the plan and design stage involves defining concepts, outlining measurable goals, setting success metrics, and identifying risks including ethical and bias concerns before technical development begins.

Option b is incorrect because the build stage focuses on model creation, calibration, and training activities that occur after planning has established clear goals, requirements, and risk considerations.

Option c is incorrect because testing occurs after development to verify the AI meets requirements, not during initial phases when goals and success criteria are being established.

Option d is incorrect because operation happens after deployment when the system is live, far beyond the initial planning phase where objectives and risk considerations are first defined.

Correct Answer: Shielding technique implementation

Option b is correct because shielding creates an intelligent buffer layer around the core model that intercepts problematic inputs before reaching the model and filters flawed outputs before reaching users temporarily.

Option a is incorrect because complete shutdown eliminates all functionality rather than maintaining service while addressing specific problems, causing unnecessary business disruption during the remediation period.

Option c is incorrect because immediate retraining requires significant time and expert effort that cannot address urgent production issues, whereas shielding provides temporary protection while permanent fixes are developed.

Option d is incorrect because eliminating user access removes system availability entirely rather than addressing specific problematic behaviors while maintaining useful functionality for legitimate interactions.

Correct Answer: Probabilistic and subtle failures

Option c is correct because AI incidents often involve gradual degradation, probabilistic outputs, and subtle failures that are difficult to detect and diagnose compared to deterministic traditional IT system failures.

Option a is incorrect because AI incidents typically require longer resolution times due to their complexity, involving model retraining or extensive diagnosis rather than straightforward fixes common in traditional IT.

Option b is incorrect because AI root cause analysis is significantly more complex than traditional IT, often involving black box diagnosis of learned behaviors rather than tracing through explicit programmed logic.

Option d is incorrect because AI failures are often unpredictable and emerge from complex interactions between data, learned patterns, and environmental conditions rather than following predictable failure modes.