A risk practitioner is developing risk scenarios related to successful data poisoning attacks on an AI model used across the organization. Which of the following is the BEST approach to help ensure the scenarios are relevant?
Answer(s): D
Risk scenario development in AI requires that scenarios be grounded in organizational context, business processes, and actual threat landscapes. Risk scenarios must reflect the specific systems, data flows, and stakeholder concerns relevant to the organization.Why D is Correct: According to the ISACA AAIR Study Guide, engaging key stakeholders is the cornerstone of effective risk scenario development. Stakeholders bring domain knowledge, business context, and awareness of operational dependencies that technical practitioners may lack. This collaborative approach ensures scenarios address real-world consequences, organizational risk appetite, and business-critical functions—making them actionable and relevant.Why A is Wrong: Adversarial testing in a sandbox validates controls but does not by itself produce contextually relevant risk scenarios. It is a technical activity, not a scenario development process.Why B is Wrong: Peer benchmarking provides useful threat intelligence but cannot replace stakeholder engagement. Industry peer data may not reflect the organization's specific AI architecture or risk tolerance.Why C is Wrong: Data flow diagrams are useful supporting artifacts but describe technical pathways rather than capturing the organizational and business context required for relevant risk scenarios.
Which of the following is a risk practitioner's BEST recommendation to establish accountability for AI system outputs and decisions?
Accountability in AI governance requires that specific individuals or roles be clearly designated as responsible for AI system outputs, decisions, and associated risks. Without formal documentation of ownership, accountability gaps emerge.Why D is Correct: The ISACA AAIR framework emphasizes that accountability must be explicit and documented, with named individuals assigned to own AI outcomes. Formal role assignments create a traceable chain of responsibility that supports auditability, regulatory compliance, and effective escalation when issues arise. Named ownership prevents diffusion of responsibility.Why A is Wrong: A centralized task force creates collective responsibility, which can dilute individual accountability. Governance bodies support oversight but do not replace individual role ownership for specific outputs.Why B is Wrong: Continuous monitoring and KPIs are valuable operational controls but represent monitoring mechanisms, not accountability structures. Monitoring detects issues but does not assign responsibility for them.Why C is Wrong: Resource allocation reviews address investment efficiency rather than accountability for AI decisions and outputs. This is a management activity, not an accountability framework.
Which of the following is the PRIMARY purpose of maintaining comprehensive model cards and documentation?
Model cards are standardized documents that communicate key information about AI models, including their intended use, training data, performance characteristics, limitations, and ethical considerations. They serve as a primary transparency instrument in AI governance.Why D is Correct: According to the ISACA AAIR curriculum, the primary purpose of model cards is to provide transparency to stakeholders—including developers, users, auditors, and regulators. Transparency enables informed decision-making about model deployment, helps identify potential misuse, and supports responsible AI governance across the life cycle.Why A is Wrong: Justifying use cases is a secondary benefit. Model cards are not primarily advocacy documents; their core function is objective disclosure of model characteristics and limitations.Why B is Wrong: Preserving audit trails is a governance function served by version control and change management systems. While model cards contribute to audit readiness, it is not their primary purpose.Why C is Wrong: Technical specifications represent only a subset of model card content. Model cards go beyond technical detail to address fairness, bias, intended use boundaries, and societal impact considerations.
Which of the following BEST enables an organization adopting AI solutions to foster an ethical and risk-aware culture?
Organizational culture is primarily shaped by leadership behavior and tone at the top. In AI governance, an ethical culture cannot be mandated through documentation alone—it must be demonstrated through the actions and values of organizational leaders.Why D is Correct: The ISACA AAIR Study Guide emphasizes that tone at the top is the most powerful driver of ethical culture. When leaders consistently model ethical behavior in AI development and usage, they create a normative environment where employees internalize values rather than merely complying with rules. This authentic leadership approach produces sustainable cultural change.Why A is Wrong: Checklists are compliance tools that address process adherence, not cultural transformation. A checklist culture can produce box-ticking behavior without genuine ethical commitment.Why B is Wrong: Conference participation raises awareness but has minimal impact on day-to-day organizational behavior. External networking does not directly shape internal culture.Why C is Wrong: Disciplinary actions represent reactive compliance enforcement. While necessary, punitive measures create a compliance-driven rather than values-driven culture, which is less robust and sustainable.
To reinforce organization-wide ethical norms and risk recognition, which of the following is MOST important to integrate into AI user training?
Answer(s): B
Effective AI user training must go beyond policy acknowledgment and compliance instruction to equip employees with the practical skills needed to identify ethical risks and report them appropriately. This builds an active risk-aware workforce.Why B is Correct: The ISACA AAIR framework identifies that training on ethical risk indicators and reporting mechanisms directly reinforces ethical norms by enabling employees to recognize real-world signs of AI misuse, bias, or harmful outputs. When staff can identify specific risk signals and know how to escalate them, the organization builds a proactive risk culture grounded in practical ethical literacy.Why A is Wrong: Acceptable use policy acknowledgment is a compliance activity, not a culture-building measure. Acknowledging a document does not ensure employees understand how to apply ethical principles in practice.Why C is Wrong: Cyber threat identification addresses security risk, which is narrower than the full scope of ethical AI risk. Security training does not develop ethical judgment regarding fairness, bias, or societal impact.Why D is Wrong: Regulatory compliance checklists address legal obligations but do not develop the ethical reasoning and risk recognition skills needed to reinforce organizational norms.
A risk practitioner is assessing risk in a newly implemented AI system integrated into an organization's business processes. Which of the following is the MOST important consideration for the risk practitioner?
AI risk assessment must be calibrated to the potential consequences of AI-driven decisions. The criticality and impact of AI-driven decisions directly determine the magnitude of risk exposure and the appropriate level of risk treatment.Why D is Correct: According to ISACA AAIR principles, the most fundamental risk assessment consideration is the nature and impact of decisions driven by the AI system. Systems making high-stakes decisions—affecting employment, credit, healthcare, or public safety—carry significantly greater risk than those supporting low-impact tasks. Understanding decision criticality frames all other risk assessment activities and drives proportionate control selection.Why A is Wrong: Escalation protocols are governance process elements that should be designed after understanding the risk profile. They are outputs of risk assessment, not inputs to the primary assessment consideration.Why B is Wrong: Prior automation levels provide contextual background but do not determine the risk profile of the new AI system. The relevant risk driver is forward-looking, not historical.Why C is Wrong: Internal expertise levels affect assessment capability but represent an organizational constraint rather than the primary risk consideration. The risk lies in the system's potential impact, not in who assesses it.
Which of the following is the GREATEST concern when AI risk management operates separately from enterprise risk management (ERM)?
Answer(s): A
Enterprise Risk Management (ERM) provides the strategic framework within which all organizational risks—including AI risks—should be managed. When AI risk management operates in isolation, it loses connection to enterprise strategy, risk appetite, and cross-functional control objectives.Why A is Correct: The ISACA AAIR curriculum identifies strategic control alignment as a foundational ERM integration requirement. When AI risk operates independently, controls may conflict with or duplicate enterprise controls, risk appetite thresholds may differ, and AI risks cannot be aggregated or prioritized alongside other organizational risks. This misalignment creates blind spots at the enterprise level and undermines coherent strategic risk management.Why B is Wrong: Inconsistent regulatory reporting is a compliance concern but is a downstream consequence of poor governance rather than the greatest organizational risk from separation. Regulatory gaps can often be patched operationally without full integration.Why C is Wrong: Training cost increases represent a financial efficiency concern unrelated to the governance challenge of separate risk management functions. ROI impacts are not driven by organizational structure of risk management.Why D is Wrong: Redundant documentation is an operational inefficiency, not a strategic risk. Duplicated records are wasteful but do not threaten organizational strategy or expose the enterprise to unmanaged risk.
Which of the following is the PRIMARY reason to include contractual requirements for model updates and disclosures from third-party AI suppliers?
Third-party AI suppliers introduce significant risk through model updates, changes in training data, and modifications to system behavior. Contractual disclosure requirements ensure the acquiring organization can maintain active risk oversight despite not controlling the vendor's development processes.Why B is Correct: The ISACA AAIR framework emphasizes that third-party AI contracts must protect against harms arising from undisclosed changes. When vendors make silent updates to models, the acquiring organization cannot assess new risks before they affect users, decisions, or regulated outcomes. Timely disclosure requirements enable proactive risk detection and mitigation before individuals are harmed.Why A is Wrong: Availability guarantees are service-level concerns addressed by SLA provisions. While important operationally, they do not address the risk management imperative of understanding what changes have been made to AI models.Why C is Wrong: Internal trust-building is a change management consideration, not the primary purpose of contractual disclosure requirements. Contracts address risk obligations, not organizational confidence.Why D is Wrong: Vendor staff access to sensitive datasets is a data access and privacy concern addressed through data processing agreements and access controls, not model update disclosure requirements.
Share your comments for ISACA AAIR exam with other users:
i purchased this exam dumps from another website with way more questions but they were all invalid and outdate. this exam dumps was right to the point and all from recent exam. it was a hard pass.
it was a good experience and i got 90% in the 200-901 exam.
hi please upload this
please upload it
really need this dump. can you please help.
really good and covers many areas explaining the answer.
yes, can you please upload the exam?
how many questions are there in these dumps?
hi team, please upload this , i need it.
question 14 - run terraform import: this is the recommended best practice for bringing manually created or destroyed resources under terraform management. you use terraform import to associate an existing resource with a terraform resource configuration. this ensures that terraform is aware of the resource, and you can subsequently manage it with terraform.
please upload dump. thanks in advance.
great great
answer 16 should be b your organizational policies require you to use virtual machines directly
the question are kind of tricky of you didnt get the hnag on it.
can anyone tell me if this is for rhel8 or rhel9?
good content
pdb and cdb are critical to the database
till 104 questions are free, lets see how it helps me in my exam today.
question # 56, answer is true not false.
i would be requiring dumps to prepare for certification exam
very helpful
control file is the heart of rman backup
hi could you please upload the ibm c2090-543 dumps
appriciate if you could upload this again
please upload the dump
i found some questions answers mismatch with explanation answers. please properly update
nothing to mention
knowable questions
very helpfull
good questions
its helpful
i just took my oracle exam and let me tell you, this exam dumps was a lifesaver! without them, iam not sure i would have passed. the questions were tricky and the answers were obscure, but the exam dumps had everything i needed. i would recommend to anyone looking to pass their oracle exams with flying colors (and a little bit of cheating) lol.
22. if you need to make sure that one computer in your hot-spot network can access the internet without hot-spot authentication, which menu allows you to do this? answer is ip binding and not wall garden. wall garden allows specified websites to be accessed with users authentication to the hotspot
is question 1 correct?