Isaca Updated AAIA Exam Questions and Answers by zayden

Adversarial testing involves simulating real-world attacks or malicious inputs against AI models (e.g., adversarial examples, poisoning, evasion) to identify how the system behaves under intentional misuse or hostile conditions. The primary objective is to discover weaknesses and control gaps (D) in the model and its surrounding processes—such as inadequate input validation, insufficient monitoring, or missing safeguards against adversarial inputs.

While results from adversarial testing may inform incident response planning (A), KRI definition (B), or security awareness (C), those are secondary benefits. AAIA’s coverage of AI threats and vulnerabilities emphasizes adversarial testing as a control validation and gap-identification mechanism , directly addressing AI-specific risk exposure.

Data cleaning is a foundational task in the AI development lifecycle. The AAIA™ Study Guide identifies data quality—ensuring completeness, accuracy, consistency, and correctness—as critical to building effective and unbiased AI systems. Cleaning the data involves removing duplicates, correcting errors, addressing missing values, and standardizing formats.

“Data cleaning is a prerequisite for effective training and evaluation. Poor-quality data leads to inaccurate or misleading model outputs, increasing operational and ethical risks.”

While training (D) is essential, it must occur only after the data has been adequately prepared. Stratification (A) supports certain modeling approaches but is secondary to data integrity. Therefore, C is the most important task at the data-gathering stage.

Generative AI excels at synthesizing large datasets and technical documentation into understandable insights. The AAIA™ Study Guide recommends leveraging generative AI to identify domain-specific risks and control considerations by analyzing complex environments and correlating them with industry risk patterns.

“AI can assist auditors during planning by generating tailored risk profiles for technologies under review, helping prioritize audit focus and scoping.”

While summarizing interviews (D) and creating diagrams (B) are helpful, only C directly informs audit planning with actionable intelligence. A (separation of duties) is a later-stage control assessment.

Data drift occurs when the statistical properties of input data change over time, causing the AI model to produce increasingly inaccurate or biased results.

The correct response is to document the risk and implement continuous monitoring (A) because:

Drift requires ongoing detection , not a one-time fix

Retraining too early can reinforce issues (especially with the same dataset)

Disabling the system (D) is overly disruptive unless drift results in unsafe decisions

Continuing deployment without monitoring (C) increases risk of degraded performance

AAIA emphasizes drift monitoring dashboards, alerting mechanisms, and retraining triggers as essential controls for AI operations.