QUESTION 1
Which of the following is MOST important for an IS auditor to consider when identifying Al risk a in a know your customer (KYC) application within a banking organization?

A. Benchmarking against peer organizations
B. Intellectual property leakage and invalidation
C. Business disruption and financial impact
D. Incident response plan

Correct Answer: C
QUESTION 2
A bank uses a video-based know your customer (KYC) verification process. Cybercriminals exploit this process by using deepfake technology to impersonate bank customers. Which of the following countermeasures is the BEST way for the bank to mitigate this risk?

A. Leveraging Al-based liveness detection during video verification
B. Requesting additional identity and address documents for verification
C. Discontinuing the use of the video-based verification process
D. Encrypting all customer data and communication

Correct Answer: A
QUESTION 3
Which of the following is MOST important to review in order to gain assurance that an Al model is performing without biases?

A. Al model adaptability
B. Al development environment
C. Al training data
D. Al model temperature

Correct Answer: C
QUESTION 4
Which of the following is the GREATEST risk associated with using Al in audit planning?

A. Incomplete data
B. Scope creep
C. Limited knowledge
D. Increased planning costs

Correct Answer: A
QUESTION 5
Which of the following do supervised Al learning models PRIMARILY use to train algorithms?

A. Randomized data sets
B. Clustered data sets
C. Labeled data sets
D. Unlabeled data sets

Correct Answer: C
QUESTION 6
A retail organization uses an Al model to analyze customers’ purchase history in order to offer personalized discounts. Which of the following practices represents the MOST ethical use of customer data?

A. Sharing customer purchase data with third-party vendors to improve advertising and communication
B. Utilizing customer purchase data only after obtaining explicit consent and allowing customers to opt out
C. Retaining and analyzing all available customer data to ensure unbiased recommendations
D. Providing the public with access to review and audit the data set of collected customer information

Correct Answer: B
QUESTION 7
Which of the following will provide the BEST evidence to support the alignment of an Al model with an organization’s business objectives?

A. Al model inventory
B. Al model vulnerability assessment
C. Al acceptable use policy
D. Al change management requests

Correct Answer: A
QUESTION 8
A healthcare organization uses an Al model to analyze patient data and provide diagnostic recommendations. Which of the following MOST effectively detects data drift related to the model’s predictions?

A. Using adversarial testing to simulate scenarios that stress test the model’s predictions
B. Applying overrides to allow healthcare professionals to correct the Al model’s recommendations
C. Comparing incoming patient data distributions with the training data set
D. Conducting periodic model retraining to ensure alignment with updated patient data

Correct Answer: C
QUESTION 9
An organization is evaluating change management practices for Al-based decision support models. Which of the following BEST demonstrates effective Al-focused change management?

A. Documenting model updates and retraining sessions to ensure traceability
B. Engaging an independent expert to review the model’s accuracy and precision on a quarterly basis
C. Assigning a single data science team member to adjust the model in order to establish accountability
D. Deploying two separate copies of the model after each adjustment to compare results

Correct Answer: A
QUESTION 10
Which use case for an Al model to be used by food delivery service would pose ethical risk to the organization?

A. Correlating time, cost, delivery distance, and customer satisfaction metrics to issue coupons to customers receiving substandard service
B. Comparing total food preparation and delivery time to an industry benchmark to set key performance and risk indicators for individual restaurants
C. Using customer service metrics for service speed and food quality to predict customer retention and forecast revenue
D. Basing driver retention and termination decisions on the number of delivered orders per total hours worked as compared to an industry benchmark

Correct Answer: D
QUESTION 11
An IS auditor is interviewing management about implemented controls around machine learning (ML)

models deployed in the production environment.
Which of the following schedules for reviewing the performance of a deployed model would be of GREATEST concern to the auditor?

A. After changes to hardware and software platforms
B. On an annual recurring basis
C. One time prior to migrating to production
D. After functionality changes

Correct Answer: C
QUESTION 12
Which of the following is the MOST important course of action for an organization prior to allowing end users to utilize an Al tool?

A. Develop an Al policy with guidelines on appropriate use.
B. Determine the impact to the disaster recovery plan (DRP)
C. Implement baseline performance metrics.
D. Ensure a cybersecurity insurance clause is in place to include the use of Al.

Correct Answer: A
QUESTION 13
A healthcare organization uses patient data to train an Al model for early disease detection. Which of the following practices provides the BEST assurance that personal data is secure and its integrity is maintained?

A. Implementing strict data access controls and conducting security tests
B. Encrypting stored data to reduce exposure and log access
C. Anonymizing patient data and performing regular quality checks
D. Updating the Al model with new data and tracking changes

Correct Answer: C
QUESTION 14
Which of the following controls would MOST effectively mitigate worst-case service disruption scenarios affecting an Al-based application system?

A. Implementing a kill chain process in the event of disruption
B. Performing periodic tabletop exercises
C. Including a range of Al disruption scenarios in the disaster recovery plan (DRP)
D. Updating key risk indicators (KRIs) regularly

Correct Answer: C
QUESTION 15
The PRIMARY purpose of maintaining an audit trail in AI systems is to:

A. facilitate transparency and traceability of decisions.
B. analyze model accuracy and fairness.
C. ensure compliance with regulatory standards for Al.
D. measure computational efficiency.

Correct Answer: A
QUESTION 16
To confirm the fairness of Al model decisions, the BEST way to collect reliable evidence during an Al audit is by:

A. interviewing developers.
B. observing the system’s interactions with end users.
C. testing the model with a curated sample data set.
D. analyzing system metadata.

Correct Answer: C
QUESTION 17
When reviewing contracts or other lengthy documentation in the planning phase, which of the following tools would BEST extract relevant information?

A. Robotic process automation (RPA)
B. Autoregressive sequencing model
C. Predictive analytics
D. Natural language processing

Correct Answer: D
QUESTION 18
During a pre-implementation risk assessment, an Al model is determined to present a significant risk of bias and potential harm in excess of the organization’s risk tolerance. Which of the following is the MOST appropriate response?

A. Enhance the data that the model is trained on.
B. Obtain board approval for an exception.
C. Revisit the risk tolerance to ensure it is appropriate.
D. Postpone deployment until the risk can be safely managed.

Correct Answer: D
QUESTION 19
Which of the following metrics are the BEST indication of a mature and effective approach to an organization’s data governance program for its Al systems?

A. Percentage of Al models with documented data lineage
B. Number of Al projects completed within the last fiscal year
C. Frequency of data quality audits on the organization’s data sets
D. Total budget allocated to Al initiatives across all departments

Correct Answer: A
QUESTION 20
Which of the following is the MOST important purpose of conducting a risk assessment for Al models within an organization?

A. Determining whether Al model outputs align with established use cases
B. Defining mitigation strategies for Al deployment
C. Monitoring Al model performance on an ongoing basis
D. Categorizing data used by the Al model

Correct Answer: B