AAIR Exam Dumps - Isaca AI Risk Questions and Answers

When an AI system used for safety-critical quality control produces inaccurate responses that could harm users, the most immediate and effective safeguard is inserting human judgment into the decision process before unsafe outputs can reach production or end users.

Why A is Correct: The ISACA AAIR human oversight guidance identifies human-in-the-loop reviews as the most effective mitigation when AI outputs pose safety risks. In safety-critical applications like manufacturing quality control, human reviewers can catch and correct AI errors before they result in unsafe products reaching consumers. This control is immediately implementable, does not require model retraining, and directly addresses the safety risk. It is the appropriate response when AI accuracy cannot be fully trusted.

Why B is Wrong: Bias and fairness testing is a model evaluation activity that assesses whether outputs are systematically skewed. While useful for improving the model, it does not provide immediate protection against the safety risk of current inaccurate outputs.

Why C is Wrong: Synthetic data augmentation may improve model quality over time but requires model retraining and does not prevent currently inaccurate outputs from causing harm in the interim.

Why D is Wrong: Prompt engineering training improves how users interact with AI systems to elicit better outputs. It is useful for generative AI applications but does not directly address safety risks from QC system inaccuracies, which require operational oversight rather than improved prompting.

Control selection for AI systems requires balancing the effectiveness and cost of proposed controls against the potential losses or harms the controls are designed to prevent. This cost-benefit analysis ensures resources are allocated proportionately to risk reduction value.

Why C is Correct: The ISACA AAIR control selection guidance identifies the cost-benefit analysis of control effectiveness versus potential business losses as the most important mitigation control determination factor. Implementing controls that cost more than the risk they mitigate represents inefficient risk management; failing to implement cost-effective controls that prevent large losses represents inadequate risk management. This proportionality assessment is the foundation of risk-based control selection.

Why A is Wrong: Risk awareness training is an important enabler of effective risk management but is an organizational capability development activity rather than a control selection criterion. Training supports controls but does not determine which controls to implement.

Why B is Wrong: Control performance baselines and compliance reporting requirements are governance and compliance management activities. While necessary for control monitoring, they describe how controls are measured after selection, not how controls are selected in the first place.

Why D is Wrong: Computational complexity is a technical characteristic of the AI system that influences implementation considerations but is not the primary driver of control selection. The most computationally complex system still requires controls proportionate to its risk profile, not its technical architecture.

Data poisoning attacks involve malicious modification of training data to degrade model performance or introduce backdoors. With multiple external data sources, the attack surface for introducing poisoned data is broad and requires proactive, continuous detection at the ingestion stage.

Why B is Correct: The ISACA AAIR adversarial AI guidance identifies continuous monitoring and anomaly detection at the data ingestion pipeline as the most effective defense against data poisoning. By monitoring incoming data in real time for statistical anomalies, unexpected distributions, or known poisoning patterns, organizations can detect and block malicious data before it contaminates training datasets. This preventive approach is superior to reactive detection after poisoning has occurred.

Why A is Wrong: Reactive data integrity reviews triggered by model drift occur after poisoning has already affected model behavior. By this stage, the model may have been deployed and made harmful decisions. Prevention during ingestion is superior to post-drift investigation.

Why C is Wrong: Model code and deployment artifact controls address security of the software pipeline but do not protect training data from external poisoning. Data integrity requires data-layer controls, not code security.

Why D is Wrong: Regularization reduces overfitting to training noise but does not detect or prevent deliberate poisoning attacks. A sufficiently targeted poisoning attack can introduce systematic bias that regularization techniques cannot mitigate.

Within the ISACA Advanced in AI Risk framework, governance decisions should align AI use with policy, accountability, stakeholder expectations, risk appetite, and applicable legal or ethical obligations. Potential human-rights harms are best managed through recurring stakeholder engagement in risk treatment because affected people may reveal impacts that technical metrics or internal policy mapping miss. Ongoing participation supports identification, escalation, and remediation of evolving harms. This makes option C, Engaging stakeholders in recurring risk treatment processes, the strongest answer. The other choices describe narrower technical, operational, performance, or administrative considerations and do not address the primary risk-management objective in the scenario as directly. A risk practitioner should select the response that most effectively reduces the stated exposure while preserving appropriate oversight, traceability, and alignment with organizational risk tolerance and business requirements.

Credit scoring AI systems are subject to anti-discrimination regulations that prohibit using models that produce biased outcomes affecting protected classes. When bias cannot be eliminated through technical means, continuing to operate the system creates ongoing legal violations and harm to affected individuals.

Why B is Correct: According to ISACA AAIR risk treatment guidance and legal compliance obligations, removing a biased credit-scoring system from production is the appropriate response when bias cannot be technically remediated. Continuing to operate a system known to produce discriminatory credit decisions violates anti-discrimination laws (such as the Equal Credit Opportunity Act), exposes the organization to regulatory enforcement, and causes ongoing harm to affected borrowers. Risk avoidance through system withdrawal is the appropriate treatment when the risk cannot be adequately mitigated.

Why A is Wrong: Requesting senior management risk acceptance for confirmed legal violations is inappropriate because organizations cannot accept risks involving known regulatory breaches. Senior management cannot legitimately authorize continued discriminatory lending practices.

Why C is Wrong: Sourcing a replacement system is a necessary future action but takes time to procure, validate, and deploy. In the interim, the biased system should not continue operating. Removing the system from production should precede replacement planning.

Why D is Wrong: Applying compensating controls to generate offsetting biases compounds the discriminatory problem rather than resolving it. Deliberately introducing additional bias—even in the opposite direction—creates an unpredictably biased model that does not produce fair outcomes.

Within the ISACA Advanced in AI Risk framework, program management connects risk identification, control selection, treatment, monitoring, resilience, third-party oversight, and reporting to enterprise risk objectives. A risk mitigation plan should contain concrete measures that reduce identified AI risks, such as controls for data poisoning and algorithmic bias. Strategic objectives and vendor-selection criteria are governance inputs, not the actual treatment measures for the identified risk. This makes option C, Measures to address issues such as data poisoning and algorithmic bias, the strongest answer. The other choices describe narrower technical, operational, performance, or administrative considerations and do not address the primary risk-management objective in the scenario as directly. A risk practitioner should select the response that most effectively reduces the stated exposure while preserving appropriate oversight, traceability, and alignment with organizational risk tolerance and business requirements.

Model poisoning attacks target the training data or model parameters to degrade performance or introduce malicious behavior. Supply chain tampering introduces compromised components at vendor or integration stages. Security by design principles require embedding defenses against these threats from the earliest design stages.

Why C is Correct: According to ISACA AAIR security by design guidance, adversarial resilience and data integrity controls address both model poisoning and supply chain tampering at their root. Adversarial resilience training prepares the model to resist maliciously crafted inputs. Data integrity controls—cryptographic signing, provenance tracking, integrity verification—detect tampering in training data and model artifacts across the supply chain. Together, these form the most comprehensive defense against both attack categories.

Why A is Wrong: Data refreshes with checksums detect post-hoc data corruption but do not build adversarial resilience into the model itself. Checksums verify file integrity but cannot prevent poisoning attacks that maintain file integrity while altering data content.

Why B is Wrong: Frequent retraining and bias monitoring address performance drift and fairness but do not specifically protect against deliberate tampering. A retrained model may still be trained on poisoned data if integrity controls are absent.

Why D is Wrong: Data tokenization protects sensitive field values from unauthorized access (a privacy control) but does not address model poisoning or supply chain tampering, which can occur without accessing or exposing the sensitive field values themselves.

Within the ISACA Advanced in AI Risk framework, governance decisions should align AI use with policy, accountability, stakeholder expectations, risk appetite, and applicable legal or ethical obligations. AI security policies should be relevant to the organization ' s current and planned use cases and strategic objectives. A policy disconnected from actual AI adoption will not establish useful requirements for the risks the organization is taking. This makes option B, Relevance to current and projected AI use cases and strategic objectives, the strongest answer. The other choices describe narrower technical, operational, performance, or administrative considerations and do not address the primary risk-management objective in the scenario as directly. A risk practitioner should select the response that most effectively reduces the stated exposure while preserving appropriate oversight, traceability, and alignment with organizational risk tolerance and business requirements.

Risk scenario development in AI requires that scenarios be grounded in organizational context, business processes, and actual threat landscapes. Risk scenarios must reflect the specific systems, data flows, and stakeholder concerns relevant to the organization.

Why D is Correct: According to the ISACA AAIR Study Guide, engaging key stakeholders is the cornerstone of effective risk scenario development. Stakeholders bring domain knowledge, business context, and awareness of operational dependencies that technical practitioners may lack. This collaborative approach ensures scenarios address real-world consequences, organizational risk appetite, and business-critical functions—making them actionable and relevant.

Why A is Wrong: Adversarial testing in a sandbox validates controls but does not by itself produce contextually relevant risk scenarios. It is a technical activity, not a scenario development process.

Why B is Wrong: Peer benchmarking provides useful threat intelligence but cannot replace stakeholder engagement. Industry peer data may not reflect the organization ' s specific AI architecture or risk tolerance.

Why C is Wrong: Data flow diagrams are useful supporting artifacts but describe technical pathways rather than capturing the organizational and business context required for relevant risk scenarios.

Adversarial training improves model robustness against known attack patterns by incorporating adversarial examples into the training process. However, no single security technique provides comprehensive protection—adversarial training addresses only the attack vectors it was designed for, leaving other vulnerabilities unaddressed.

Why B is Correct: The ISACA AAIR security defense-in-depth guidance identifies residual system vulnerabilities as the greatest risk when adversarial training is the sole security measure. Adversarial training protects against specific attack types (evasion, perturbation) but does not address infrastructure vulnerabilities, API security weaknesses, model inversion attacks, membership inference, or other security risks present in a testing environment. A defense-in-depth approach is required for comprehensive protection.

Why A is Wrong: Adversarial training does increase computational requirements and may extend training cycles, but inefficiency is an operational concern rather than a security risk. The security risk of unprotected vulnerabilities significantly outweighs training cycle efficiency.

Why C is Wrong: Overfitting to adversarial training examples is a model quality concern that can be managed through standard regularization techniques. It represents a model performance trade-off, not the greatest security risk from relying solely on adversarial training.

Why D is Wrong: Exposure of proprietary algorithms is an intellectual property risk that is not specifically increased by relying on adversarial training. Algorithm confidentiality is protected through access controls and encryption, which are separate from the adversarial training approach.