Get Isaca AAIR Exam Practice Questions - Real and Updated

Answer : A

Privacy and data protection regulations worldwide---including GDPR, CCPA, and sector-specific laws---impose strict requirements on the collection, use, and processing of personal information. Customer data used for AI systems must be obtained through lawful means with appropriate consent for the specific processing purpose.

Why A is Correct: According to ISACA AAIR guidance on regulatory compliance, the legal basis for processing personal data is the foundational requirement. An AI system built on data collected without proper consent or legal authorization exposes the organization to regulatory penalties, reputational damage, and forced shutdown of the system. Consent must be specific to the AI use case, not merely generic data collection consent.

Why B is Wrong: Backup and storage protocols address data security and resilience, which are compliance requirements but secondary to the lawfulness of data collection. Securely storing improperly obtained data does not cure the regulatory violation.

Why C is Wrong: Human review of recommendations is a governance safeguard for accuracy and fairness, not a regulatory compliance requirement for data collection. Many regulations do not require human review of recommendation systems.

Why D is Wrong: Supervised learning is a modeling technique that does not address regulatory compliance regarding data sourcing. The training methodology is irrelevant to whether the underlying data was legally obtained.

Answer : D

Enterprise risk framework integration elevates AI risk management from a technical discipline to a strategic organizational function, ensuring AI risks are considered alongside all other enterprise risks in strategic planning and decision-making.

Why D is Correct: The ISACA AAIR curriculum identifies enterprise integration as the mechanism that enables organization-level oversight and ensures AI risk management aligns with strategic objectives, risk appetite, and governance structures. This integration allows the board and senior management to make informed decisions about AI investment, deployment, and risk acceptance with full awareness of AI's contribution to the organizational risk profile.

Why A is Wrong: KPI benchmarking is an operational performance management activity. While integration may improve KPI accuracy, this is a secondary operational benefit rather than the primary strategic benefit of ERM integration.

Why B is Wrong: Regulatory compliance is improved by integration but represents a specific compliance benefit rather than the primary organizational value. Compliance is an output of good governance, not the purpose of ERM integration.

Why C is Wrong: Cyber threat identification is a security function that benefits from integration but is not the primary benefit. Many AI risks are non-cyber in nature---fairness, accuracy, transparency---and would not be captured by a cyber-focused framing.

Answer : D

Incident response for AI model degradation should follow a structured diagnostic process. Before implementing any corrective action, the scope and nature of the accuracy issues must be understood to ensure the response is appropriate and targeted.

Why D is Correct: According to ISACA AAIR incident response guidance, the first step when AI model accuracy deteriorates is to assess the impact---understanding which specific features are affected, how model outputs have changed, and what the business consequences are. This diagnostic step informs all subsequent decisions about whether to retrain, add validation cycles, or take the system offline. Acting without this assessment may waste resources on inappropriate responses or leave critical issues unaddressed.

Why A is Wrong: Adding validation review cycles is a process change that may be appropriate but cannot be determined without first understanding the nature and scope of the accuracy problem. Reviews address a symptom without diagnosing the cause.

Why B is Wrong: Taking the model offline and backing it up is a drastic operational measure that may be disproportionate to the actual issue. This decision requires understanding the severity and scope of the problem, which requires impact assessment first.

Why C is Wrong: Full model retraining is resource-intensive and may not address the root cause if the problem is not training data staleness. Impact assessment must precede the decision to retrain.

Answer : A

Enterprise Risk Management (ERM) provides the strategic framework within which all organizational risks---including AI risks---should be managed. When AI risk management operates in isolation, it loses connection to enterprise strategy, risk appetite, and cross-functional control objectives.

Why A is Correct: The ISACA AAIR curriculum identifies strategic control alignment as a foundational ERM integration requirement. When AI risk operates independently, controls may conflict with or duplicate enterprise controls, risk appetite thresholds may differ, and AI risks cannot be aggregated or prioritized alongside other organizational risks. This misalignment creates blind spots at the enterprise level and undermines coherent strategic risk management.

Why B is Wrong: Inconsistent regulatory reporting is a compliance concern but is a downstream consequence of poor governance rather than the greatest organizational risk from separation. Regulatory gaps can often be patched operationally without full integration.

Why C is Wrong: Training cost increases represent a financial efficiency concern unrelated to the governance challenge of separate risk management functions. ROI impacts are not driven by organizational structure of risk management.

Why D is Wrong: Redundant documentation is an operational inefficiency, not a strategic risk. Duplicated records are wasteful but do not threaten organizational strategy or expose the enterprise to unmanaged risk.

Answer : B

AI model reproducibility---the ability to recreate identical or near-identical outputs in different environments---depends on having access to the exact training data, model weights, and configurations used to produce a given model version. Training dataset snapshots are foundational to this capability.

Why B is Correct: The ISACA AAIR model documentation and auditability guidance identifies capturing and archiving complete training dataset snapshots as essential for reproducibility. To reproduce a model's outputs in another environment, the development team must be able to reconstruct the exact training conditions---including the precise dataset used. Without archived snapshots, datasets evolve and the original training conditions become impossible to recreate.

Why A is Wrong: Manual review of outputs validates accuracy for a specific deployment but does not address reproducibility across environments. Manual review cannot substitute for the technical artifacts needed to recreate a model.

Why C is Wrong: Continuous performance monitoring detects behavioral changes in production but does not enable reproduction of the model in alternative environments. Monitoring is forward-looking, while reproducibility is about reconstructing past conditions.

Why D is Wrong: AI-specific change management processes control how models are modified and deployed but do not capture the training artifacts needed for environmental reproduction. Change management governs transitions; reproducibility requires data preservation.