ISACA Advanced in AI Audit (AAIA) (AAIA) AAIA Questions 76–150 | Page 2/3

MCQhard

You are auditing a firm using LLMs (Large Language Models). Which risk is most specific to generative AI compared to traditional predictive models?

A.Database login credentials being shared

B.Server power consumption

C.Hallucinations and generation of misinformation

D.Missing documentation for the training code

AnswerC

Hallucination is a direct risk of the probabilistic nature of generative models.

Why this answer

Hallucination is a unique risk of generative models where they output plausible but factually incorrect information.

Full explanation →

MCQhard

An auditor is using 'CleverHans' for model auditing. What kind of vulnerability is this library designed to detect?

A.Memory leaks in model deployment

B.Infrastructure misconfiguration

C.Adversarial vulnerability

D.PII leaks in training data

AnswerC

It provides tools to test models against adversarial perturbations.

Why this answer

CleverHans is a library for benchmarking the robustness of neural networks against adversarial examples.

Full explanation →

MCQeasy

What is the purpose of an 'AI Policy' within an organization?

A.To provide a structured set of guidelines for the responsible development and use of AI

B.To list the office coffee machine settings

C.To define the company's dress code policy

D.To describe the history of computer hardware

AnswerA

Policies harmonize AI activities with organizational risk appetite and ethical values.

Why this answer

An AI policy sets the standard for responsible, secure, and compliant AI usage across the enterprise.

Full explanation →

MCQmedium

What is the function of a 'Circuit Breaker' in a microservice-based AI architecture?

A.Preventing failure propagation

B.Increasing latency

C.Training the model

D.Managing databases

AnswerA

Standard resilience pattern.

Why this answer

To stop requests to a failing AI service to prevent system-wide collapse.

Full explanation →

MCQeasy

Which component of an AI policy is most important for establishing organizational accountability?

A.Describing the history of artificial intelligence research

B.Listing the hardware specifications of the training clusters

C.Providing the contact information for the company's PR department

D.Defining the roles and responsibilities of the AI Governance Committee and model owners

AnswerD

Clear ownership ensures that someone is responsible for the performance and risk management of the AI system.

Why this answer

Accountability requires clearly defined roles and responsibilities for AI system oversight.

Full explanation →

MCQhard

An organization experiences 'Data Leakage' in a machine learning project. What is the most likely cause during the training process?

A.Using target data in training features

B.Using standard Python libraries

C.Using secure cloud storage

D.Using too many GPUs

AnswerA

Leads to artificial performance inflation.

Why this answer

Using test/validation data during feature selection or training leads to leakage.

Full explanation →

MCQeasy

What is the key difference between 'AI Ethics' and 'AI Compliance'?

A.There is no difference between the two

B.Ethics is only for AI, while compliance is for all departments

C.Compliance is only for technical roles, while ethics is for executives

D.Ethics focuses on societal values, while compliance focuses on legal and regulatory requirements

AnswerD

Compliance is rule-bound; ethics is value-bound.

Why this answer

Ethics concerns what *should* be done based on values, while compliance concerns what *must* be done based on rules.

Full explanation →

MCQeasy

What is the primary function of a 'Version Control System' (like Git) in an MLOps team?

A.Executing Python scripts

B.Managing code changes

C.Storing raw video

D.Managing databases

AnswerB

Foundation of DevOps/MLOps.

Why this answer

To manage code changes, enable collaboration, and allow rollbacks.

Full explanation →

MCQeasy

A board of directors asks you to define the 'AI Risk Appetite'. Which approach best satisfies the governance requirement?

A.Creating a repository of all AI ethical guidelines published by NGOs

B.Providing the board with a list of all AI vendors used in the organization

C.Restricting all AI development to on-premises environments

D.Defining quantitative thresholds for acceptable model performance and ethical impact

AnswerD

Quantifiable metrics are the hallmark of effective, board-level risk appetite communication.

Why this answer

Risk appetite must align with the organization's business objectives and ethical standards.

Full explanation →

MCQhard

When using DVC (Data Version Control) in an AI project, what is the best practice to ensure the 'data version' is immutable for audit purposes?

A.Use absolute file paths

B.Commit .dvc files to git

C.Disable data caching

D.Store data on local drive

AnswerB

Ensures the data state is tracked alongside code.

Why this answer

Committing the '.dvc' file (which contains a hash of the data) to Git ensures that the specific data version is locked to the code version.

Full explanation →

MCQmedium

During an audit of AI procurement, you find that the 'Vendor AI Assessment' questionnaire is missing. What is the correct next step?

A.Immediately halt the use of the vendor until a formal risk assessment is completed

B.None of the above

C.Update the office building safety guidelines

D.Ask the vendor for their marketing presentation

E.Ignore the missing document if the vendor is well-known

AnswerA

Using a vendor without a risk assessment leaves the firm vulnerable to unmanaged risks.

Why this answer

An auditor must ensure that third-party AI risks are evaluated using a formal, documented process.

Full explanation →

MCQeasy

When scoping an audit for a model using SHAP values, what is the primary objective of the auditor?

A.Detecting data drift

B.Security vulnerability scanning

C.Infrastructure scaling

D.Explainability of model predictions

AnswerD

SHAP is a model-agnostic method to explain individual predictions.

Why this answer

SHAP (SHapley Additive exPlanations) is used to quantify the contribution of each feature to a specific prediction, aiding interpretability.

Full explanation →

MCQmedium

What is the primary objective of a 'Model Inventory' in an enterprise AI audit?

A.To log user feedback

B.Centralized visibility of all models

C.To optimize GPU usage

D.To store model weights

AnswerB

Ensures no 'shadow AI' exists.

Why this answer

To have a centralized, authoritative list of all models in production for compliance and risk tracking.

Full explanation →

Multi-Selectmedium

Which THREE of the following are potential risks associated with AI model 'Drift' that an auditor must account for?

Select 3 answers

A.Bias against specific demographic groups that emerged post-deployment

B.Increased electricity consumption of servers

C.Regulatory non-compliance due to divergence from approved model behavior

D.Inability to access the source code of the model

E.Decreased model accuracy over time

AnswersA, C, E

Drift can cause a model to become unfair over time.

Why this answer

Drift impacts operational accuracy, fairness, and compliance, making it a critical governance risk.

Full explanation →

MCQeasy

During an AI audit, what is a 'PII Scrubber' tool used for?

A.Cleaning up logs

B.Anonymizing sensitive data

C.Compressing images

D.Improving accuracy

AnswerB

Privacy protection is the core function of PII scrubbers.

Why this answer

PII scrubbers remove or anonymize Personally Identifiable Information from training sets to ensure privacy compliance.

Full explanation →

MCQmedium

Which AWS SageMaker feature allows auditors to verify that a model was trained on encrypted data?

A.Instance type selection

B.Model registry labels

C.Notebook instance tags

D.KMS Key Usage in CloudTrail

AnswerD

Audit trail shows key usage for training data.

Why this answer

SageMaker Training Jobs support 'Data Encryption' via KMS keys, which is logged in CloudTrail.

Full explanation →

MCQhard

During an audit of an LLM-based application, which technique is most effective for testing the robustness against 'Prompt Injection'?

A.Sentiment analysis

B.Cross-validation

C.Red Teaming

D.Tokenization audit

AnswerC

Red teaming is the industry standard for probing LLM vulnerabilities.

Why this answer

Red Teaming involves manual and automated attempts to bypass safety filters and trigger malicious outputs.

Full explanation →

MCQeasy

As part of an AI audit, you are checking the 'AI Transparency' requirement. Which documentation artifact is essential to provide to external regulators to explain the model's design, intended use, and limitations?

A.Unit testing suite

B.API Swagger documentation

C.Infrastructure-as-Code (IaC) templates

D.Model Card

AnswerD

A Model Card provides the documentation required for transparency and accountability.

Why this answer

The Model Card is a standardized, transparent document that summarizes a model's characteristics, intended use, and limitations, as recommended by AI ethics standards.

Full explanation →

MCQmedium

When an AI system utilizes a 'Feature Store', how does it ensure consistency between training and inference?

A.Deleting training data after use

B.Caching features on local disk

C.Converting features to text

D.Serving features from a unified source

AnswerD

Prevents training-serving skew.

Why this answer

The feature store ensures the exact same logic and code are used to fetch features for both training and serving.

Full explanation →

MCQeasy

In a GCP Vertex AI pipeline, you want to ensure that every model artifact is associated with the specific training data and code version used. Which component provides this lineage tracking?

A.Feature Store

B.Vertex AI Metadata

C.Vertex AI Pipelines

D.Vertex AI Experiments

AnswerB

Metadata provides the tracking for artifacts and their associations in the pipeline graph.

Why this answer

Vertex AI Metadata tracks the lineage of artifacts throughout the lifecycle.

Full explanation →

MCQhard

An auditor is evaluating the 'Safety Filter' of an LLM. Which approach is most suitable for detecting 'jailbreak' vulnerabilities?

A.Running unit tests for code

B.Reviewing server logs

C.Adversarial red teaming

D.Checking network bandwidth

AnswerC

Red teaming is necessary to uncover jailbreak pathways.

Why this answer

Red teaming with adversarial prompts (jailbreaks) is the standard method for testing safety filter resilience.

Full explanation →

MCQhard

When auditing an AI system's 'Explainability', which issue is highlighted by 'Explanation Faithfulness'?

A.Whether the model is fast enough

B.Whether the explanation accurately represents the model's logic

C.Whether the user trusts the model

D.Whether the explanation is easy to read

AnswerB

Faithfulness is about the accuracy of the explanation method itself.

Why this answer

Faithfulness measures whether the explanation accurately reflects the model's internal decision process rather than just being a plausible simplification.

Full explanation →

MCQmedium

You are assessing the risk of 'Data Poisoning' in a retail AI model. Which control should you implement during the data ingestion pipeline to mitigate this risk?

A.Input data validation and sanitization

B.Model version control

C.Increasing the GPU compute capacity

D.Enabling Multi-Factor Authentication (MFA) on the model registry

AnswerA

This prevents poisoned data samples from entering the model training pipeline.

Why this answer

Data validation and sanitization during the ingestion pipeline ensure that malicious or corrupted data samples are blocked before entering the training set.

Full explanation →

Multi-Selecthard

When auditing a model deployment pipeline, which TWO aspects are critical to verify to ensure compliance with AI governance frameworks?

Select 2 answers

A.Whether the team uses a specific cloud provider

B.Validation of data processing against privacy policies

C.Existence of a complete audit trail of model lineage

D.The speed of the training job

E.Usage of proprietary algorithms only

AnswersB, C

Verifying data handling is essential for legal and ethical compliance.

Why this answer

Governance requires both reproducibility and data privacy/security checks.

Full explanation →

100

MCQhard

When deploying an AI model on a public cloud, what is the best practice for 'Secret Management' of API keys?

A.Using a dedicated Secret Vault service

B.Printing to logs

C.Hardcoding in the script

D.Storing in a Git repo

AnswerA

Secures credentials from code/logs.

Why this answer

Secrets must be stored in a dedicated vault (e.g., AWS Secrets Manager, Azure Key Vault) and injected at runtime.

Full explanation →

101

MCQeasy

When drafting an AI policy, you need to define the 'Human-in-the-Loop' (HITL) requirement. Which of the following represents a best-practice control for HITL?

A.Logging all model interactions for post-mortem analysis

B.Setting all model confidence thresholds to 100%

C.Manual review of high-risk model outputs prior to execution

D.Automated approval for all decisions

AnswerC

This ensures a human validates the model's output before it impacts the business.

Why this answer

A requirement for human intervention in high-risk decisions ensures oversight and accountability.

Full explanation →

102

MCQmedium

Which 'AI Risk Mitigation' strategy is most effective for reducing 'Data Leakage' in training sets?

A.Using more colorful charts in the report

B.Implementing strict data partitioning and feature selection protocols

C.Increasing the number of servers

D.Changing the office seating arrangement

AnswerB

Ensuring the training set does not contain information from the future or target reduces leakage.

Why this answer

Data leakage occurs when information from the target variable leaks into the training features; strict separation and testing prevent this.

Full explanation →

103

Multi-Selecthard

When documenting findings, which THREE elements should be included for each finding?

Select 3 answers

A.The root cause

B.A recommendation for improvement

C.The condition (what the auditor found)

D.The font size used in the report

E.The names of all employees who disagreed

AnswersA, B, C

Explains why the finding occurred.

Why this answer

The condition, the root cause, and the recommendation are essential components of an audit finding.

Full explanation →

104

MCQmedium

What is the most effective way to audit 'Data Lineage' in a complex AI ecosystem?

A.Automated Metadata Tracking

B.Asking developers

C.Manual spreadsheet tracking

D.Checking project folder names

AnswerA

Provides a trail of data provenance.

Why this answer

Using metadata tracking tools that record the transformations from source to final model input.

Full explanation →

105

Multi-Selectmedium

When scoping an AI audit engagement, which TWO of the following documents should the auditor request to understand the AI model's governance structure?

Select 2 answers

A.Public social media posts

B.Company marketing brochures

C.Developer salary structures

D.Technical system architecture documentation

E.Model Card

AnswersD, E

Describes how the model is integrated and governed.

Why this answer

Model Cards and technical documentation provide the necessary governance and implementation context for an auditor.

Full explanation →

106

MCQhard

You are performing an audit on an ML project utilizing Kubeflow. The team is using Katib for hyperparameter tuning. Which configuration step is critical to ensure that individual trials do not starve the production inference service of resources?

A.Increasing node count on the master node

B.Disabling auto-scaling on the cluster

C.Setting the Katib algorithm to random search

D.Implementing Kubernetes ResourceQuotas

AnswerD

ResourceQuotas enforce usage limits on namespaces, preventing trial pods from exhausting cluster resources.

Why this answer

Resource quotas in Kubernetes prevent training trials from consuming resources allocated to production services.

Full explanation →

107

MCQmedium

In an AI Audit, what does 'Model Fairness' assessment typically involve?

A.Counting model parameters

B.Checking model speed

C.Disparity analysis across segments

D.Verifying code documentation

AnswerC

Identifies if the model treats groups differently.

Why this answer

Checking for bias across protected groups (e.g., race, gender) in model performance metrics.

Full explanation →

108

MCQmedium

You are auditing a deployment on Kubernetes using Kubeflow. Which component should the auditor examine to ensure that the pipeline steps are reproducible?

A.Kubelet

B.Kubeflow Pipelines

C.Prometheus

D.Istio

AnswerB

KFP provides the framework for reproducible and versioned workflows.

Why this answer

Kubeflow Pipelines (KFP) ensure reproducibility through containerized steps and pipeline definitions stored in YAML.

Full explanation →

109

MCQmedium

What does a 'Model Approval' workflow ensure?

A.Human oversight of deployment

B.Faster training

C.Reduced cloud costs

D.Automatic deletion

AnswerA

Governance standard.

Why this answer

That a human reviewer has vetted the model against compliance and quality standards before production deployment.

Full explanation →

110

Multi-Selectmedium

Which TWO of the following are examples of AI governance 'Inputs'?

Select 2 answers

A.A photograph of the company founder

B.Internal AI Policy and guidelines

C.External regulatory frameworks (e.g., EU AI Act)

D.The company's social media password

E.The office printer manual

AnswersB, C

Internal policies shape the governance framework.

Why this answer

Inputs include regulatory requirements and internal policy documents.

Full explanation →

111

MCQeasy

What is the primary function of an 'AI Ethics Board'?

A.Managing the HR payroll systems

B.Fixing bugs in the server infrastructure

C.Reviewing AI projects for alignment with corporate values and societal norms

D.Writing the code for all production models

AnswerC

The ethics board acts as a moral compass to ensure the company's AI initiatives are responsible.

Why this answer

The ethics board ensures that AI projects align with corporate values and societal standards.

Full explanation →

112

Multi-Selectmedium

Which THREE of the following are core components of a robust AI Governance and Risk Assessment Framework?

Select 3 answers

A.Network bandwidth optimization plans

B.Standardized model risk assessment templates

C.Automated model training hyperparameter tuning

D.Defined AI risk appetite and threshold levels

E.Roles and responsibilities for model ownership and accountability

AnswersB, D, E

Required for consistent, reproducible risk evaluation.

Why this answer

These three options represent the strategic, operational, and accountability pillars of a comprehensive AI governance program.

Full explanation →

113

MCQhard

When auditing an AI system, how do you verify 'Model Reproducibility'?

A.Asking the team

B.Verifying pipeline run with identical inputs

C.Checking cloud bills

D.Reading the documentation

AnswerB

The definition of reproducibility.

Why this answer

Verify that you can re-run the training pipeline with the same code version and data snapshot to get the same model weights.

Full explanation →

114

MCQmedium

An auditor is evaluating an AI system's robustness against adversarial attacks. Which technique involves perturbing input data to see if the model output changes significantly?

A.Model pruning

B.Bias assessment

C.Data augmentation

D.Adversarial testing

AnswerD

Adversarial testing specifically probes models for sensitivity to noise.

Why this answer

Adversarial testing involves small perturbations to inputs to identify instability or security weaknesses.

Full explanation →

115

MCQmedium

What is the primary benefit of using 'Containerization' for AI model auditability?

A.Reduced data storage costs

B.Increased hardware speed

C.Simplified UI design

D.Environment reproducibility

AnswerD

Containers capture the entire execution environment for reproducibility.

Why this answer

Containers (e.g., Docker) encapsulate code, libraries, and dependencies, ensuring that the model runs the same way in audit as it did in training.

Full explanation →

116

MCQmedium

In a CI/CD pipeline for AI, where should the 'Model Validation' gate be located?

A.During feature engineering

B.Between training and registration

C.Before source code check-in

D.After deployment

AnswerB

Prevents promotion of unqualified models.

Why this answer

Validation must occur after training but before model registration to prevent bad models from reaching production.

Full explanation →

117

MCQeasy

What is the primary function of an 'AI Pipeline Orchestrator' like Kubeflow or Airflow?

A.Automating task dependencies

B.Encrypting network traffic

C.Writing code for the model

D.Optimizing SQL queries

AnswerA

Defines and runs DAGs of tasks.

Why this answer

Orchestration automates the sequence of tasks: data ingestion, training, and deployment.

Full explanation →

118

Multi-Selectmedium

Which THREE of the following are essential components of an MLOps maturity model for ensuring operational stability?

Select 3 answers

A.Storing raw data directly in the model repository

B.Centralized model registry and artifact management

C.Automated retraining pipelines

D.Manual model validation processes

E.Real-time monitoring and alerting for model performance

AnswersB, C, E

Centralized governance is essential for reproducibility.

Why this answer

Maturity models focus on automation, monitoring, and governance.

Full explanation →

119

MCQeasy

What is the primary function of an 'AI Audit Log'?

A.To automatically order pizza for the team

B.To track and document all interactions and changes made to the AI system

C.To store the personal contact information of the IT staff

D.To provide entertainment for employees during breaks

AnswerB

An audit log provides a record for investigations and compliance verification.

Why this answer

An audit log records all actions performed by or on the AI system, ensuring accountability and traceability.

Full explanation →

120

MCQeasy

Which metric is commonly used to audit classification models?

A.Logarithmic growth

B.F1-score

C.Mean Squared Error

D.CPU utilization

AnswerB

F1-score is a standard audit metric for classification models.

Why this answer

The F1-score balances precision and recall, providing a single metric for classification performance.

Full explanation →

121

MCQmedium

Which tool provides visual confirmation of data lineage in an end-to-end AI project?

A.Apache Airflow

B.Docker

C.Jenkins

D.Kubernetes

AnswerA

The DAG view shows the sequence and dependencies of data processing.

Why this answer

Apache Airflow provides DAG (Directed Acyclic Graph) visualization, which auditors use to map data flow and lineage.

Full explanation →

122

MCQeasy

A board of directors requests a quarterly report on AI risk exposure. Which component of the NIST AI Risk Management Framework should you prioritize to demonstrate that the board's AI policy is being operationally enforced?

A.Measure

B.Manage

C.Map

D.Govern

AnswerD

The Govern function establishes the culture, policies, and oversight mechanisms necessary for AI risk management.

Why this answer

The 'Govern' function of the NIST AI RMF is the primary domain for board-level oversight and organizational policy enforcement.

Full explanation →

123

MCQmedium

In the context of 'AI Pipelines', what is the role of a 'Model Registry'?

A.Storing training logs

B.Version control for model artifacts

C.Monitoring compute costs

D.Optimizing SQL queries

AnswerB

Provides centralized management.

Why this answer

The Model Registry provides a central repository to store, version, and manage the lifecycle of trained models.

Full explanation →

124

MCQmedium

In an AI Audit, what does an 'Input Feature Schema' define?

A.The training duration

B.Expected data format and constraints

C.The database name

D.The model architecture

AnswerB

Crucial for interface contracts.

Why this answer

It defines the expected data types, shapes, and constraints for input features, ensuring integration stability.

Full explanation →

125

Multi-Selectmedium

Which TWO of the following are considered 'Model Metadata' that should be tracked in a registry?

Select 2 answers

A.Hyperparameters

B.Training dataset version

C.Employee vacation schedule

D.Cafeteria menu

E.Office Wi-Fi password

AnswersA, B

Essential for reproduction.

Why this answer

Registry must store enough info to recreate the model state.

Full explanation →

126

MCQeasy

Which of these is a valid reason to 'Roll Back' a model deployment?

A.To save storage space

B.To change the model name

C.Detected production performance issues

D.Developer preference

AnswerC

Standard incident response.

Why this answer

If the model in production starts showing unexpected errors or performance drops, rolling back is the immediate safety action.

Full explanation →

127

MCQmedium

You are configuring a CI/CD pipeline for ML using GitHub Actions to deploy to a Kubernetes cluster. To ensure sensitive credentials for your container registry are not exposed in logs, what is the best practice?

A.Store credentials in GitHub Secrets

B.Use environment variables in the workflow file

C.Hardcode credentials in the Dockerfile

D.Commit a .env file to the repository

AnswerA

GitHub Secrets masks values in logs and encrypts them at rest.

Why this answer

Using GitHub Secrets is the standard way to inject sensitive data into CI/CD pipelines securely.

Full explanation →

128

Multi-Selecteasy

Which TWO of the following are primary benefits of implementing a Model Registry in an AI production environment?

Select 2 answers

A.Allows for direct modification of training data

B.Enables versioning and lifecycle management of models

C.Increases the hardware utilization of GPUs

D.Facilitates standardized deployment across different environments

E.Automatically deletes old training instances

AnswersB, D

This is the core function of a model registry.

Why this answer

Model registries ensure version control and facilitate collaboration.

Full explanation →

129

MCQmedium

Which of the following is a key component of 'MLOps Maturity'?

A.Manual data entry

B.Single engineer silo

C.No documentation

D.Automated pipeline triggers

AnswerD

Essential for mature operations.

Why this answer

High maturity involves full CI/CD, automated testing, and active model monitoring.

Full explanation →

130

MCQeasy

What is the primary role of a 'Human-in-the-Loop' (HITL) audit requirement?

A.To review critical AI decisions

B.To automate model retraining

C.To generate marketing reports

D.To improve GPU performance

AnswerA

Human oversight mitigates risks of automated errors.

Why this answer

HITL ensures that sensitive or critical decisions made by AI are reviewed by human experts.

Full explanation →

131

MCQmedium

When auditing model versioning, what is the recommended practice for maintaining evidence?

A.Delete old versions

B.Use mutable file names

C.Use immutable versioning

D.Store models in cache

AnswerC

Immutable tagging ensures that the exact model version remains auditable.

Why this answer

Immutable model repositories and versioning control (e.g., Git LFS, MLflow) ensure the exact state can be audited.

Full explanation →

132

Multi-Selectmedium

Which TWO of the following are essential when performing an 'AI Risk Assessment'?

Select 2 answers

A.Listing the names of the team members' families

B.Assessing the likelihood and severity of identified risks

C.Identifying potential harms to stakeholders

D.Choosing the best coffee brand for the office

E.Selecting the color scheme for the model's dashboard

AnswersB, C

Risk quantification requires understanding likelihood and severity.

Why this answer

An assessment must identify both technical risks and potential impacts on stakeholders.

Full explanation →

133

Multi-Selecthard

Which THREE factors influence 'AI Pipeline' latency?

Select 3 answers

A.Company CEO name

B.Model parameter size

C.Network transfer speed

D.Data preprocessing complexity

E.Office building height

AnswersB, C, D

Memory/CPU bound task.

Why this answer

Latency is affected by data processing, model size, and compute overhead.

Full explanation →

134

MCQhard

You are auditing a 'Model Lifecycle' and find that the decommissioning process is not defined. What is the impact?

A.The office wifi will stop working

B.The company's stock price will drop immediately

C.Increased risk of using outdated or insecure models in production

D.The data scientists will leave the company

AnswerC

Leaving unused models active is a significant security and compliance vulnerability.

Why this answer

Without a decommissioning process, deprecated or risky models may remain in production, posing security and performance risks.

Full explanation →

135

MCQhard

You are auditing a model using IBM Watson OpenScale. Which feature should be configured to detect 'Disparate Impact' to ensure regulatory compliance?

A.Fairness monitor

B.Quality monitor

C.Drift detection monitor

D.Explainability monitor

E.Payload logging

AnswerA

The Fairness monitor calculates Disparate Impact and other bias metrics.

Why this answer

Watson OpenScale features a 'Fairness' monitor that specifically tracks Disparate Impact ratios.

Full explanation →

136

MCQeasy

What is the purpose of 'Performance Monitoring' in AI?

A.Encrypting data

B.Changing model weights

C.Renaming models

D.Ensuring SLA compliance

AnswerD

Primary monitoring goal.

Why this answer

To detect if the system is meeting its latency, throughput, and accuracy targets.

Full explanation →

137

MCQmedium

What is the primary function of a 'Canary Deployment' in AI model release?

A.Gradual rollout to test stability

B.To update documentation

C.To delete old models

D.To increase training performance

E.To encrypt model weights

AnswerA

Mitigates impact of failures.

Why this answer

Releasing the new model to a small subset of traffic to monitor performance before full rollout.

Full explanation →

138

MCQmedium

When auditing an MLflow experiment, which object allows the auditor to verify the exact parameters and code version used during training?

A.MLflow Model Registry

B.MLflow Run

C.MLflow Experiment

D.MLflow Tracking Server

AnswerB

The Run captures all parameters, metrics, and metadata for a specific execution.

Why this answer

The MLflow Run object stores the code version (git commit), parameters, and metrics for a training session.

Full explanation →

139

MCQmedium

A company uses MLflow for model registry and tracking. You need to transition a model from the 'Staging' environment to 'Production' only after it passes an automated integration test. How is this state transition managed in MLflow?

A.Using the 'transition_model_version_stage' API

B.Updating the 'version' tag in the git repo

C.Deleting the model in Staging and re-uploading to Production

D.Manually copying files in the S3 bucket

AnswerA

This API call allows for programmatic state management of registry versions.

Why this answer

Transitioning model versions in the MLflow Model Registry is done via the 'transition_model_version_stage' API or UI.

Full explanation →

140

MCQhard

Which AI risk is best mitigated by conducting a 'bias audit' on the training dataset?

A.Hardware overheating

B.System latency

C.Unfairness and discrimination in model outputs

D.Server cost overruns

AnswerC

Data bias is the primary cause of output unfairness; detecting it early is key.

Why this answer

Bias audits analyze datasets for underrepresented groups or historical prejudices that would lead to discriminatory outputs.

Full explanation →

141

Multi-Selecthard

Which THREE factors must be evaluated when assessing the 'Fairness' of an AI model?

Select 3 answers

A.The programming language used to build the model

B.Disparities in model error rates across protected groups

C.Historical bias present in the training datasets

D.Demographic parity metrics for the model's predictions

E.The number of CPU cores allocated for training

AnswersB, C, D

Differential error rates indicate bias.

Why this answer

Fairness assessment requires looking at demographic parity, historical bias, and error rate disparities.

Full explanation →

142

MCQhard

What is the consequence of 'Pipeline Staleness' in an AI system?

A.Model degradation due to outdated data

B.Unauthorized access

C.Increased hardware costs

D.System crash

AnswerA

Outdated data is the primary cause of poor results.

Why this answer

If the pipeline is not refreshed, it trains on outdated data, leading to model degradation.

Full explanation →

143

MCQmedium

What is the role of an 'A/B Test' in AI production?

A.Encrypting data

B.Reducing training time

C.Comparing two models in production

D.Deleting unused models

AnswerC

Statistical model comparison.

Why this answer

A/B testing allows comparing the performance of a new model against an existing one with real user traffic.

Full explanation →

144

MCQhard

You are assessing 'Model Security'. Which attack vector specifically exploits the AI training phase?

A.Man-in-the-middle attack

B.Data poisoning

C.Denial-of-service attack

D.Phishing attack

AnswerB

This attack directly compromises the integrity of the training data during the development phase.

Why this answer

Data poisoning involves injecting malicious data into the training set to influence the model's behavior.

Full explanation →

145

MCQmedium

In the context of AI regulatory compliance, what is the 'Model Risk Management' (MRM) framework mainly concerned with?

A.Reducing cloud expenses

B.Increasing developer productivity

C.Marketing model features

D.Governance and validation controls

AnswerD

Primary focus of MRM.

Why this answer

MRM manages the risks associated with model usage, including governance, validation, and control.

Full explanation →

146

MCQhard

You are auditing a 'Model Monitoring' dashboard. Which metric is most indicative of a potential degradation in the model's reliability over time?

A.Statistical drift between the production input data and training baseline

B.The physical location of the cloud server hosting the model

C.The number of lines of code in the model deployment script

D.The number of users accessing the model API

AnswerA

If production data drifts significantly from training data, the model's assumptions are no longer valid.

Why this answer

Data drift and concept drift are primary indicators that a model's performance may be degrading in a production environment.

Full explanation →

147

MCQeasy

In the context of AI Operations, what does 'CI/CD' stand for?

A.Computer Intelligence and Cloud Data

B.Continuous Integration and Continuous Deployment

C.Continuous Inference and Cloud Deployment

D.Code Integration and Cloud Delivery

AnswerB

Standard MLOps terminology.

Why this answer

Continuous Integration and Continuous Deployment/Delivery.

Full explanation →

148

Multi-Selecthard

Which THREE tasks are required for a 'Model Decommissioning' workflow?

Select 3 answers

A.Terminate serving infrastructure

B.Notify stakeholders

C.Ask developer for coffee

D.Delete all company records

E.Archive model artifacts

AnswersA, B, E

Stop resource billing.

Why this answer

Decommissioning requires archival, notification, and resource cleanup.

Full explanation →

149

MCQmedium

When auditing fairness using the 'Aequitas' toolkit, what is the first step an auditor should take?

A.Encrypt the dataset

B.Train a new model

C.Select bias metrics

D.Delete sensitive attributes

AnswerC

Before running analysis, the auditor must choose which fairness metrics are appropriate.

Why this answer

The first step in Aequitas is to define the bias metrics (e.g., False Positive Rate Parity) relevant to the context.

Full explanation →

150

MCQhard

When auditing model fairness in a production environment using IBM Watson OpenScale, which metric would you specifically validate to ensure the model is not violating protected class regulations?

A.Precision-Recall AUC

B.Model Latency

C.Root Mean Square Error

D.Disparate Impact

AnswerD

Disparate Impact measures the difference in outcomes for protected versus non-protected groups.

Why this answer

Disparate Impact is the standard statistical metric used in OpenScale to identify bias against protected groups during inference.

Full explanation →

ISACA Advanced in AI Audit (AAIA) (AAIA) (AAIA) — Questions 76–150