Free Practice Questions for Isaca AAIA Exam

Detecting data drift is critical in maintaining the reliability and accuracy of AI models, especially in dynamic environments like healthcare where patient populations and data characteristics can change over time. According to the ISACA Advanced in AI Audit™ (AAIA™) Study Guide,data drift refers to changes in the input data's statistical properties compared to the data on which the model was originally trained. If not detected, data drift can degrade model performance and lead to erroneous predictions.

Themost effective approach to detect data driftis tocontinuously compare the statistical distributions of incoming (production) data with those of the training dataset. This allows organizations to identify deviations in data patterns, which can be early indicators that the AI model’s predictions may no longer be valid or optimal.

As stated in the AAIA™ Study Guide under "AI Model Monitoring and Maintenance":

“Monitoring input data for distributional changes compared to the model’s training data is an essential step in identifying data drift. Statistical tests and visualizations can help auditors and AI operators detect when the underlying data characteristics have shifted, prompting further investigation or retraining needs.”

While options such as retraining the model (option C) or adversarial testing (option D) are valuable for ongoing performance and robustness,they do not inherently detect data drift—they respond to or stress-test existing issues. Applying overrides (option B) is a human-in-the-loop safeguard, not a method for drift detection.

Documented data lineage (option B) is a cornerstone of mature data governance. The ISACA AAIA™ Study Guide highlights that “effective data governance for AI is characterized by the organization’s ability to trace and document the origin, transformation, and use of data throughout its lifecycle and within AI models.” This documentation provides transparency, supports accountability, and enables effective risk management.

While regular data quality audits (option C) are important, they do not, by themselves, ensure transparency or traceability. The number of projects (option A) and budget allocation (option D) are not directly indicative of governance maturity.

If the combined size of the training, validation, and testing sets exceeds the original data size, it suggests that records may have been reused across sets. This can lead to data leakage, where the model has access to test or validation information during training, resulting in overly optimistic performance metrics.

“Data leakage invalidates model evaluation because it introduces unintended data overlap. Auditors must ensure that the training, validation, and test sets are strictly partitioned.”

Options A, C, and D refer to process order or quantity, but only B addresses the root issue of compromised model integrity due to overlapping data.

The AAIA™ Study Guide emphasizes that the foundation of any high-performing and ethical AI system lies in the quality and integrity of its data. For high-risk AI systems, such as those used in healthcare, finance, or criminal justice, it is essential to base models on trustworthy data. This ensures reliable predictions, reduces bias, and mitigates risk.

“Trustworthy datasets are characterized by accuracy, completeness, consistency, and ethical sourcing. In high-risk AI applications, ensuring data quality at every stage is crucial to system reliability and compliance.”

While backups, user training, and MFA are important for security and operational resilience, they do not address the core challenge of ensuring model accuracy and fairness at the development and design phase. Therefore, option C is the most effective practice.

When using generative AI tools during audit activities, the most critical concern is the reliability and appropriateness of the information being entered and processed. According to the AAIA™ Study Guide, auditors are accountable for ensuring that audit data is valid, confidential, and that generated outputs are factual and verifiable.

“IS auditors must evaluate whether the information entered into AI tools is reliable and appropriate for the audit context. Inputting sensitive or unverified data may lead to regulatory violations or audit inaccuracies.”

While hallucinations (C) and privacy notices (B) are important concerns, the primary auditor responsibility is to ensure that source data is accurate and suitable. Therefore, D is the correct response.

Exploratory Data Analysis (EDA) is critical during the initial stages of AI model development. According to the AAIA™ Study Guide, performing EDA—including identifying null values, incorrect data types, or duplicates—ensures that the data fed into the model is clean and reliable.

“Initial data frames should be subject to thorough EDA to uncover data quality issues. These issues, if not addressed early, can severely affect model training and predictive accuracy.”

While separating data sets (B) and visualizations (A) are important steps in later phases, C is foundational to ensure readiness for model training. Risk assessments (D) are necessary but not the first operational step.

False positives in fraud detection AI systems often stem from poorly optimized hyperparameters. Hyperparameters control aspects of the model’s learning process such as the learning rate, decision thresholds, and complexity penalties. When these parameters are not tuned correctly, the model can become overly sensitive and flag normal behavior as suspicious, leading to customer complaints.

“Hyperparameter tuning is essential to balance sensitivity and specificity in AI models. Improper tuning can result in a high rate of false positives or negatives, particularly in systems like fraud detection that require nuanced pattern recognition.”

Options A and B relate to data governance but do not directly cause false positives in predictions. Option C (compute scale training) may affect model efficiency, not accuracy. Thus, D is the most appropriate answer.

Generative AI tools such as large language models often have token limitations that restrict how much input they can process in a single prompt. According to the AAIA™ Study Guide, when input exceeds token limits, the model processes only the initial portion—leading to biased outputs based on early entries.

“Token limits in generative AI systems may lead to partial input processing, skewing model outputs toward the beginning of the data and introducing interpretive bias. Auditors must assess whether output reflects the full dataset.”

Options A and C describe side effects, but D identifies the most significant risk—output distortion due to truncated input.

Including AI-specific disruption scenarios in the organization’s Disaster Recovery Plan (DRP) ensures preparedness for worst-case events affecting AI systems. The AAIA™ Study Guide recommends tailoring business continuity and DR strategies to cover model unavailability, data corruption, and AI-specific dependencies.

“AI disruptions can arise from unique causes such as model corruption, adversarial attacks, or drift. Integrating these into the DRP allows for effective, scenario-specific responses and minimizes downtime.”

Tabletop exercises (A) are valuable for preparedness but are less comprehensive than scenario planning. Kill chains (B) are security-specific. KRIs (C) aid in monitoring but don’t ensure recovery. Therefore, D offers the most robust mitigation.