AAIA Practice Test

AAIA Practice Test practice questions, page 6 of 23, with answer review and explanations.

Question 26

During a pre-implementation risk assessment, an AI model is determined to present a significant risk of bias and potential harm in excess of the organization’s risk tolerance. Which of the following is the MOST appropriate response?

  1. Obtain board approval for an exception.
  2. Enhance the data that the model is trained on.
  3. Revisit the risk tolerance to ensure it is appropriate.
  4. Postpone deployment until the risk can be safely managed.

Question 27

An organization is adopting AI for its procurement and inventory teams, raising concern from stakeholders that they will lose their jobs due to AI. Which of the following is the BEST way for the IS auditor to assess whether the potential negative impacts were minimized?

  1. Review human-centered design practices to determine how they were considered.
  2. Review how the project management team collected feedback in engagement activities.
  3. Review the current state assessment of how AI may impact the organization.
  4. Review the AI roadmap for short-term and long-term milestones.

Question 28

A healthcare organization uses data clustering to group patients by medical history for personalized treatment recommendations. Which of the following is the GREATEST privacy risk associated with this practice?

  1. Clustering increases the complexity of the model, making data harder to anonymize.
  2. The clustering requires more data, increasing the risk of a privacy breach.
  3. Irrelevant features in the data may result in inaccurate or biased treatments.
  4. Clusters can reveal sensitive personal information depending on how the information is presented.

Question 29

Which of the following is the GREATEST risk associated with using AI in audit planning?

  1. Scope creep
  2. Limited knowledge
  3. Increased planning costs
  4. Incomplete data

Question 30

When using off-the-shelf AI models, which of the following is the MOST appropriate way for organizations to approach vendor management?

  1. Establish responsibility and clear terms for model updates and support.
  2. Only use models from vendors with globally recognized accreditation.
  3. Use the vendor only if the contract has been reviewed by the information security department.
  4. Ensure a minimum of three quotes have been obtained for market research and comparison.