ISACA Advanced in AI Audit practice questions

1. Question 1 of 25

   Which of the following key performance indicators (KPIs) are MOST important when evaluating whether an AI model meets business objectives?

   • ACost of resources required for AI model training
   • BAI model accuracy in predicting actual outcomes
   • CFrequency of AI model retraining
   • DNumber of users interacting with the AI model

   Show answer

   Correct answer: B

   How others answered

   • B100%

2. Question 2 of 25

   An organization is using information gathered from customer accounts to train its AI chatbot. Which of the following is the GREATEST risk associated with this practice?

   • ATransparency
   • BAI model hallucinations
   • CAI bias
   • DDisclosure of personal information

   Show answer

   Correct answer: D

   How others answered

   • D100%

3. Question 3 of 25

   An IS auditor is evaluating an organization’s incident management program to ensure it is sufficiently prepared to manage AI-related incidents. Which of the following is MOST important for the auditor to validate?

   • AThe program includes processes to respond to AI model drift and data integrity attacks.
   • BThe program prioritizes incidents based on alignment with industry leading practices.
   • CThe program uses past AI-related incidents and resolutions to categorize current incidents.
   • DThe program mandates retraining AI systems after incidents are investigated.

   Show answer

   Correct answer: A

   How others answered

   • A100%

4. Question 4 of 25

   The BEST way to prevent sensitive information disclosure by large language model (LLM) chatbots is through:

   • Amanual monitoring.
   • Bdata sanitization.
   • Cdata masking.
   • Daccess controls.

   Show answer

   Correct answer: B

   How others answered

   • B54%
   • C46%

   Only 54% agreed on this answer — treat it as contested rather than settled.

5. Question 5 of 25

   When an IS auditor is reviewing results from an AI system, which of the following would cause the GREATEST risk?

   • AInability to identify where an AI system is housed.
   • BDifficulty of documenting AI algorithm processes.
   • CSystem output not being checked for inconsistencies.
   • DCascading failures of AI system outputs.

   Show answer

   Correct answer: C

   How others answered

   • D100%

   Most people chose D, not C. Verify this one against the vendor documentation.

6. Question 6 of 25

   When utilizing a machine learning (ML) model to predict whether a wind turbine electricity generator will fail, which model evaluation metric should be the PRIMARY focus?

   • ARecall
   • BSpecificity
   • CPrecision
   • DAccuracy

   Show answer

   Correct answer: A

   How others answered

   • A100%

7. Question 7 of 25

   Which of the following is MOST important for an IS auditor to consider when identifying AI risk in a know your customer (KYC) application within a banking organization?

   • ABusiness disruption and financial impact
   • BIntellectual property leakage and invalidation
   • CBenchmarking against peer organizations
   • DIncident response plan

   Show answer

   Correct answer: A

   How others answered

   • A100%

8. Question 8 of 25

   An IS auditor notes that an AI model achieved significantly better results on training data than on test data. Which of the following problems with the model has the IS auditor identified?

   • AUnderfitting
   • BBias
   • COverfitting
   • DGeneralization

   Show answer

   Correct answer: C

   How others answered

   • C100%

9. Question 9 of 25

   An IS auditor is auditing an AI system that predicts inventory needs. The system recently failed to predict a stock outage for a key product. Which of the following audit tests would BEST validate the system’s accuracy?

   • ASensitivity analysis on input variables
   • BHistorical testing with past sales data
   • CUnit testing of the forecasting algorithm
   • DLoad testing during peak sales periods

   Show answer

   Correct answer: B

   How others answered

   • B100%

10. Question 10 of 25

    A digital bank utilizes an AI system to generate credit scores. Which of the following would BEST mitigate the risk of sudden and unexplained changes in a borrower's credit score?

    • AUsing only data from the last six months to one year to avoid outdated information affecting the credit score
    • BEnsuring the system is periodically reviewed and calibrated by human experts to maintain stability in predictions
    • CObtaining and validating the credit scores from third-party agencies to cross-check AI-generated results
    • DAllowing the AI to operate fully autonomously to prevent processing delays

    Show answer

    Correct answer: B

    How others answered

    • B67%
    • C33%

    Only 67% agreed on this answer — treat it as contested rather than settled.

11. Question 11 of 25

    Which of the following is MOST important for an IS auditor to review during an AI system audit in order to determine compliance with intellectual property and data rights?

    • AData performance metrics
    • BUse of open-source intellectual property
    • CModel runtime efficiency logs
    • DData usage agreements

    Show answer

    Correct answer: D

    How others answered

    • D100%

12. Question 12 of 25

    In order to streamline operations, a bank has deployed an AI application to automatically detect and prevent further fraud on accounts. However, customers have voiced concerns that their usual transactions are being rejected. Which of the following is the MOST likely cause of the false positives?

    • AConsent is not properly managed.
    • BCompute scale training was not performed.
    • CThe hyperparameters are not optimized.
    • DData versioning controls were not developed.

    Show answer

    Correct answer: C

    How others answered

    • C100%

13. Question 13 of 25

    Which of the following is the PRIMARY objective of AI governance?

    • AImplementing compliance and ethics controls for AI initiatives
    • BPromoting a positive return on investment (ROI) from AI projects
    • CDefining clear roles and responsibilities for AI development, use, and oversight
    • DEnsuring controls over AI are designed well and operate effectively

    Show answer

    Correct answer: C

    How others answered

    • C100%

14. Question 14 of 25

    Which of the following is the PRIMARY reason IS auditors must be aware that generative AI may return different investment recommendations from the same set of data?

    • ANeural node access varies each time the process is executed.
    • BServers are reconfigured periodically.
    • CLimitations can arise in the quantification of risk profiles.
    • DComputational logic is based on probabilities.

    Show answer

    Correct answer: D

    How others answered

    • D100%

15. Question 15 of 25

    A healthcare organization uses patient data to train an AI model for early disease detection. Which of the following practices provides the BEST assurance that personal data is secure and its integrity is maintained?

    • AImplementing strict data access controls and conducting security tests
    • BEncrypting stored data to reduce exposure and log access
    • CUpdating the AI model with new data and tracking changes
    • DAnonymizing patient data and performing regular quality checks

    Show answer

    Correct answer: D

    How others answered

    • D75%
    • B25%

16. Question 16 of 25

    Which of the following strategies used by modelers to enhance data accuracy has the GREATEST risk of bias and information loss?

    • AFilling blank attributes in records with the mean, median, or mode within a grouping
    • BPlacing numerical data into bins or buckets for a manageable quantity of correlations and result analyses
    • CSeparating multiple data attributes within one field into individual attribute columns
    • DIdentifying and deleting duplicate entries in the data set

    Show answer

    Correct answer: B

    How others answered

    • B75%
    • A25%

17. Question 17 of 25

    For a sales promotion, an AI system sorts customer attributes into several categories by analyzing transaction history. Verifying which of the following would BEST validate the effectiveness of this process?

    • AStress tests are regularly conducted to maintain consistent AI performance.
    • BThe applied methodology adequately reflects business objectives.
    • CSensitive attributes are converted to other data types prior to input.
    • DSampling of AI output is conducted to identify unusual decisions.

    Show answer

    Correct answer: B

    How others answered

    • B50%
    • D50%

    Only 50% agreed on this answer — treat it as contested rather than settled.

18. Question 18 of 25

    An organization deploys an AI recruitment platform to screen job applicants. The IS auditor identifies that the platform’s decisions may be influenced by model bias. Which of the following risk mitigation strategies is BEST for the auditor to recommend?

    • AImplement a process to periodically test the AI system for biases and adjust parameters as needed.
    • BSuspend the use of the AI system until the training data can be verified for fairness and compliance.
    • CRequire manual reviews of all AI-generated recruitment decisions before hiring is finalized.
    • DRetrain the AI model using an external data set certified for inclusivity and fairness.

    Show answer

    Correct answer: A

    How others answered

    • A100%

19. Question 19 of 25

    Which of the following is MOST important to consider when deciding whether to implement an AI solution?

    • AThe space required for AI hardware
    • BThe cost of AI implementation
    • CThe speed of AI implementation
    • DThe ethical implications of AI

    Show answer

    Correct answer: D

    How others answered

    • D100%

20. Question 20 of 25

    Which of the following is the PRIMARY purpose of an AI acceptable use policy?

    • AEstablishing guidance on the ethical use of AI
    • BExplaining the distinction between different types of AI
    • COutlining AI usage monitoring procedures
    • DEducating employees on where to find and how to use AI tools

    Show answer

    Correct answer: A

    How others answered

    • A100%

21. Question 21 of 25

    Which of the following is the MOST important task when gathering data during the AI system development process?

    • AIsolating the system
    • BStratifying the data
    • CTraining the system
    • DCleaning the data

    Show answer

    Correct answer: D

    How others answered

    • D100%

22. Question 22 of 25

    Which of the following controls MOST effectively helps to ensure an AI model is resilient against external threats?

    • AMonitoring of AI access logs
    • BAI model configuration testing
    • CAI data set anonymization
    • DMonitoring of AI model developers

    Show answer

    Correct answer: B

    How others answered

    • B100%

23. Question 23 of 25

    The PRIMARY objective of machine learning (ML) in data processing is to:

    • Aanalyze data sets to identify visual patterns and trends.
    • Benhance the explainability of AI model outputs.
    • Cdraw statistical inferences for creating artificial human intelligence.
    • Dperform actions that would typically require human intelligence.

    Show answer

    Correct answer: D

    How others answered

    • D67%
    • C33%

    Only 67% agreed on this answer — treat it as contested rather than settled.

24. Question 24 of 25

    A retail organization uses an AI model to forecast inventory based on customer purchasing trends and updates the model quarterly. The model recently failed to recognize a surge in demand during a popular shopping season. Which of the following issues does this situation BEST demonstrate?

    • AData drift impacting system forecasting
    • BOverfitting issues due to a small training data set
    • CLack of outlier checks in data affecting forecast accuracy
    • DLimited data set diversity impacting model training

    Show answer

    Correct answer: A

    How others answered

    • A100%

25. Question 25 of 25

    When auditing an AI model, an IS auditor notices that the controls over transactional processes are inadequate. Which of the following should the auditor recommend to BEST reduce these risks?

    • AImplement model scorecards.
    • BClearly define responsibilities for AI risk.
    • CHave the chief risk officer (CRO) perform a risk analysis.
    • DImplement human-in-the-loop processes.

    Show answer

    Correct answer: D

    How others answered

    • D100%

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AAIA practice, question 1 of 25