HikeLetter | PMP Training & Certification Online Course | Project Management Learning

Overview

Course Description

Certification: ISACA Advanced in AI Audit (AAIA)
Provider: ISACA
Exam code: AAIA (certification identifier; no separate numeric exam code listed)
Exam duration: Confirm the current duration in the official ISACA exam guide
Official question count: Confirm the current question count in the official ISACA exam guide
Passing score: Confirm the current passing score in the official ISACA exam guide
Exam fee (USD): Current fee not verified here; check ISACA registration for current pricing

Course Questions

10 Questions

During a risk-based AI audit, consider: An audit team is evaluating an AI model used to approve customer applications. What should it assess first?

A. The model’s intended use, governance, risk classification, data inputs, controls, and impact on affected people. B. Approve the system without additional evidence because the vendor owns the model. C. Review only the initial business case and ignore post-deployment behavior. D. Rely on aggregate accuracy without examining risk, governance, or affected users.

During a risk-based AI audit, consider: A business unit deploys a generative AI tool without an approved owner. What is the key governance gap?

A. Rely on aggregate accuracy without examining risk, governance, or affected users. B. Unclear accountability for the AI system and its lifecycle decisions. C. Approve the system without additional evidence because the vendor owns the model. D. Review only the initial business case and ignore post-deployment behavior.

During a risk-based AI audit, consider: A model performs well in testing but poorly for a subgroup after launch. What should auditors examine?

A. Review only the initial business case and ignore post-deployment behavior. B. Rely on aggregate accuracy without examining risk, governance, or affected users. C. Representativeness of data, subgroup performance metrics, validation design, and ongoing monitoring. D. Approve the system without additional evidence because the vendor owns the model.

During a risk-based AI audit, consider: A vendor will provide an AI service that processes sensitive information. What should be done before approval?

A. Approve the system without additional evidence because the vendor owns the model. B. Review only the initial business case and ignore post-deployment behavior. C. Rely on aggregate accuracy without examining risk, governance, or affected users. D. Conduct risk-based due diligence covering data use, security, model behavior, transparency, and contractual responsibilities.

During a risk-based AI audit, consider: A model’s training data lineage cannot be demonstrated. What is the primary concern?

A. The organization may be unable to establish data provenance, lawful use, quality, or reproducibility. B. Approve the system without additional evidence because the vendor owns the model. C. Review only the initial business case and ignore post-deployment behavior. D. Rely on aggregate accuracy without examining risk, governance, or affected users.

During a risk-based AI audit, consider: An AI system produces plausible but fabricated responses. Which control is most relevant?

A. Rely on aggregate accuracy without examining risk, governance, or affected users. B. Use risk-appropriate output validation, grounding, human review, and monitoring for hallucinations. C. Approve the system without additional evidence because the vendor owns the model. D. Review only the initial business case and ignore post-deployment behavior.

During a risk-based AI audit, consider: An audit finds that a model changed after approval without a review. What should be examined?

A. Review only the initial business case and ignore post-deployment behavior. B. Rely on aggregate accuracy without examining risk, governance, or affected users. C. Model change management, version control, revalidation criteria, approvals, and deployment records. D. Approve the system without additional evidence because the vendor owns the model.

During a risk-based AI audit, consider: A team uses customer data to fine-tune a model for a new purpose. What should the auditor verify?

A. Review only the initial business case and ignore post-deployment behavior. B. Rely on aggregate accuracy without examining risk, governance, or affected users. C. Purpose and legal-basis assessment, notices or consent where required, minimization, retention, and access controls. D. Approve the system without additional evidence because the vendor owns the model.

During a risk-based AI audit, consider: A high-impact AI system has no documented human override. What is the concern?

A. Approve the system without additional evidence because the vendor owns the model. B. Review only the initial business case and ignore post-deployment behavior. C. Rely on aggregate accuracy without examining risk, governance, or affected users. D. Insufficient ability to intervene when the system produces unsafe, erroneous, or inappropriate outcomes.

During a risk-based AI audit, consider: An AI model is assessed only for cybersecurity vulnerabilities. What else should be included?

A. A broader risk assessment covering privacy, fairness, explainability, safety, reliability, and operational impact as applicable. B. Approve the system without additional evidence because the vendor owns the model. C. Review only the initial business case and ignore post-deployment behavior. D. Rely on aggregate accuracy without examining risk, governance, or affected users.

₹4999.00 ₹1999.00

Enroll Now

AAIA