Isaca Updated AAIA Exam Questions and Answers by yazan

The GREATEST risk is that sensitive internal content may be embedded in AI prompts and sent to an external system (A), exposing confidential or regulated information. Retrieval-augmented generation often involves sending queries or embeddings to third-party APIs, creating a significant data leakage risk if internal context is included.

Option B deals with training-data leakage, which is notable but less immediate. Option C is irrelevant to the core risk. Option D concerns operational reliability, not security. In AAIA, protection of internal audit evidence and sensitive data is paramount, and the primary threat is external disclosure through prompts .

When data is scarce, training a deep CNN from scratch is likely to result in overfitting. " Transfer learning " allows an organization to take a model previously trained on a massive dataset (like ImageNet) and " fine-tune " it for their specific, smaller dataset. The model already knows how to recognize basic shapes and textures, so it requires much less data to learn specific new categories. This is a common and highly effective practice in medical imaging or specialized manufacturing audits. Duplicating data (Option D) does not add new information and only leads to overfitting.

" Historical Bias " occurs when the training data reflects existing social prejudices or past inequalities. If an organization’s historical hiring practices favored males, an AI model trained on those records will " learn " that being male is a characteristic of a successful candidate. This automates and perpetuates past discrimination into future decisions. The AAIA™ manual emphasizes that auditors must evaluate training data for historical bias to ensure fairness. Unlike confirmation bias (which involves seeking data that supports existing beliefs) or label bias (which involves incorrect classification), historical bias is a systemic issue inherent in the data collection from a flawed real-world environment.

" Vibe coding " or AI-assisted development carries the risk of introducing " hallucinated " vulnerabilities or insecure coding patterns that the AI learned from public (and potentially flawed) repositories. The most responsible control is to implement a rigorous, human-led " security checklist " for code reviews. This ensures that every line of AI-generated code is checked for common flaws like SQL injection or hardcoded credentials. Prompting the AI to check its own code (Option C) is unreliable because the model may suffer from the same biases or logic errors that created the code in the first place.