Isaca Updated AAIA Exam Questions and Answers by luan

In the standard machine learning workflow, the " Validation Dataset " is specifically used for " model selection " and " hyperparameter tuning. " It serves as a bridge between training and the final test. Using the training set (Option B) for tuning would lead to overfitting. The " Testing " or " Holdout " set (Options A and C) must remain completely " unseen " until the very end to provide an unbiased final estimate of how the model will perform in the real world. According to the ISACA AAIA™ manual, maintaining this strict partitioning is critical for model integrity and preventing overly optimistic performance reports.

AI systems must align with the organization’s risk appetite and ethical principles , especially in healthcare where patient safety is paramount. The BEST action is to adjust the AI’s parameters (A) so the recommendations reflect the hospital’s conservative risk tolerance, reducing the frequency of high-risk suggestions. AAIA stresses AI governance alignment with organizational risk appetite, treatment guidelines, and ethical priorities.

Option B is overly disruptive and eliminates beneficial AI capabilities. Option C is necessary for privacy but does not address treatment safety. Option D limits utility but doesn’t correct underlying alignment issues. The core issue is model alignment with ethical and safety standards , making option A the correct choice.

" Agency " refers to the model ' s ability to take actions or access data. LLMs are non-deterministic and can be tricked via " prompt injection " to ignore their internal rules. Therefore, " Authorization and privilege checks " must be performed by a separate, deterministic security layer that is " independent of the LLM. " According to the ISACA AAIA™ Study Guide, you should never allow an AI to decide its own permissions (Option D) or those of other systems. If a user asks an AI to delete a file, the AI should simply " request " the deletion, and a standard, non-AI security system should check if the user has the right to do so. This maintains the " Principle of Least Privilege " and prevents unauthorized actions via model manipulation.

Using postal codes as a primary factor in credit scoring raises concerns of geographic and socioeconomic bias. Postal codes can serve as proxies for race, ethnicity, or income level—potentially violating fair lending laws and ethical guidelines.

“Auditors should flag models that rely on proxies for protected attributes. Postal codes are high-risk features that may inadvertently lead to redlining or other discriminatory practices.”

A, B, and C are more justifiable under fair lending guidelines. Thus, D presents the highest concern.