AAIA Practice Questions

Question 1

An organization is scaling its AI governance program. You need to automate the identification of 'Shadow AI' in the corporate network. Which tool would be the most effective to gain visibility into unauthorized AI model API usage?

Accepted Answer

Microsoft Defender for Cloud Apps. Cloud Access Security Brokers (CASBs) like Microsoft Defender for Cloud Apps provide visibility into unsanctioned SaaS and API usage, including AI platforms.

Answer

Azure AI Content Safety

Answer

GitHub Copilot Business logs

Answer

Azure Policy

Question 2

Which action is required when a model is found to be 'Non-compliant' with the internal AI Governance policy?

Accepted Answer

Immediate remediation or removal from the production environment. Non-compliant models must be removed from production or restricted until remediated to prevent risk.

Answer

Writing a blog post about the failure

Answer

Ignoring the finding if the model is profitable

Answer

Giving the model a new name

Question 3

What is the purpose of an 'AI Audit trail'?

Accepted Answer

Providing transparency and accountability. To provide a transparent, verifiable record of all actions taken on an AI system.

Answer

Reducing cloud latency

Answer

Increasing model performance

Answer

Changing model parameters

Question 4

A firm uses a third-party AI service. Which control is most critical to ensure compliance with the firm's own AI governance policy?

Accepted Answer

Including AI-specific compliance requirements in the vendor service-level agreement (SLA). Supply chain risk management requires mapping vendor controls to internal governance requirements.

Answer

Conducting weekly penetration tests on the vendor's office premises

Answer

Requesting the vendor's employee turnover rates for the last fiscal year

Answer

Requiring the vendor to submit copies of all their marketing brochures

Question 5

Which TWO of the following are examples of 'Data Leakage' that an auditor should look for in a pipeline?

Accepted Answer

Training on test data. Option B is correct because training on test data is a classic form of data leakage: information from the evaluation set contaminates the training process, so the model's reported performance is optimistically biased and does not reflect true generalization to unseen data. Option E is correct because including target-related features that are not available at inference time (e.g., using the label or a post-outcome variable as an input) leaks future/target information into training, producing a model that cannot be reproduced or used in production. Option A is not leakage per se; using cloud-based storage is an infrastructure choice that may raise other security or compliance concerns but does not itself contaminate training with evaluation or target information. Option C is not leakage; documenting model parameters is a governance and reproducibility practice. Option D is not leakage; using open-source libraries is a normal engineering decision that may introduce supply-chain risk but does not constitute data leakage.

Answer

Using cloud-based storage

Answer

Documenting model parameters

Answer

Using open-source libraries

Question 6

Which TWO are common 'AI Operational' challenges?

Accepted Answer

Data quality management. B (Data quality management) is a core AI operational challenge because production models depend on clean, consistent, and representative training and inference data; poor data quality causes drift, bias, and degraded accuracy that must be continuously monitored and remediated. E (Model maintenance) is also correct because deployed models require ongoing retraining, versioning, performance monitoring, and updates as data distributions and business requirements change over time. The remaining options are not AI operational challenges: A (Selecting a font) is a design/typography decision, C (Writing poetry) is a creative content task rather than an operational concern, and D (Buying new office chairs) is a facilities/procurement matter unrelated to running AI systems.

Answer

Selecting a font

Answer

Writing poetry

Answer

Buying new office chairs

Question 7

In the context of AI regulatory compliance, what is the 'Model Risk Management' (MRM) framework mainly concerned with?

Accepted Answer

Governance and validation controls. MRM manages the risks associated with model usage, including governance, validation, and control.

Answer

Reducing cloud expenses

Answer

Increasing developer productivity

Answer

Marketing model features

Question 8

You are auditing an organization's AI deployment in Microsoft Azure. The Chief Risk Officer requires a central dashboard to monitor AI model performance drift and data quality metrics across all deployed services. Which tool should you confirm is configured to provide these insights?

Accepted Answer

Azure Machine Learning Model Monitor. Azure Machine Learning Model Monitor is the service designed to continuously track model performance drift and data quality metrics for models deployed via Azure Machine Learning. It provides a central dashboard with metrics like feature attribution drift, data drift, and prediction drift, enabling the CRO to monitor all deployed services.

Answer

Microsoft Purview AI Compliance Manager

Answer

Azure Policy for AI

Answer

Azure AI Content Safety

Question 9

When auditing model versioning, what is the recommended practice for maintaining evidence?

Accepted Answer

Use immutable versioning. Immutable model repositories and versioning control (e.g., Git LFS, MLflow) ensure the exact state can be audited.

Answer

Delete old versions

Answer

Use mutable file names

Answer

Store models in cache

Question 10

A firm uses a 'Federated Learning' approach. Which governance benefit does this provide?

Accepted Answer

Enhanced data privacy by keeping raw data locally on devices. Federated learning allows training on decentralized data, keeping raw data on local devices, which enhances privacy.

Answer

Reduced usage of electricity

Answer

Faster model training times

Answer

Improved model interpretability

Question 11

Which TWO techniques should an auditor employ to detect bias in a model where the training data has imbalanced demographic representation?

Accepted Answer

Implementation of fairness-aware loss functions. Fairness-aware loss functions (B) are correct because they explicitly incorporate group-fairness constraints or penalties (e.g., equalized odds, demographic parity regularization) into the model's objective during training, directly counteracting bias caused by imbalanced demographic representation. Stratified cross-validation (E) is correct because it preserves the proportional class and demographic distribution in each fold, ensuring that performance and bias metrics are evaluated reliably across underrepresented groups rather than being masked by skewed splits. The remaining options do not belong: updating the corporate logo (A) and changing the font size in the UI (C) are cosmetic and have no effect on model training or bias, while increasing the number of project meetings (D) is a process activity that does not alter data imbalance or model fairness.

Answer

Updating the corporate logo

Answer

Changing the font size in the UI

Answer

Increasing the number of project meetings

Question 12

What is the primary function of an 'AI Audit Log'?

Accepted Answer

To track and document all interactions and changes made to the AI system. An audit log records all actions performed by or on the AI system, ensuring accountability and traceability.

Answer

To automatically order pizza for the team

Answer

To store the personal contact information of the IT staff

Answer

To provide entertainment for employees during breaks

Question 13

Which TWO of the following are essential for ensuring 'Model Observability' in an enterprise production environment?

Accepted Answer

System latency monitoring. Observability requires both performance metrics and input monitoring (drift).

Answer

Manual code refactoring

Answer

Database backup frequency

Answer

Developer salary audits

Question 14

What is the purpose of 'Model Validation' in the audit lifecycle?

Accepted Answer

To verify model performance on test data. Model validation is the process of evaluating a trained model's performance on a separate test dataset to ensure it generalizes well and meets the intended objectives. It verifies metrics such as accuracy, precision, recall, or fairness before deployment, catching overfitting or data leakage issues.

Answer

To speed up data ingestion

Answer

To lower API costs

Answer

To increase training time

Question 15

When auditing data pipelines, what is the function of a 'Data Quality' assertion?

Accepted Answer

To validate data integrity before training. Assertions (e.g., in Great Expectations) check if data meets predefined schemas and constraints before ingestion.

Answer

To rename data columns

Answer

To increase prediction speed

Answer

To compress input files

ISACA Advanced in AI Audit AAIA practice test

Three ways to study

Study AAIA by domain

Study AAIA by topic

AI Operations practice questions

AI Auditing Tools And Techniques practice questions

AI Governance And Risk practice questions

AAIA fundamentals practice questions

AAIA scenario practice questions

AAIA troubleshooting practice questions

ISACA Advanced in AI Audit (AAIA) (AAIA) practice questions