An organization seeks to implement a new AI system that uses customer information to create targeted product recommendations. Which of the following is the MOST important consideration to ensure the system complies with regulatory requirements?
Answer(s): A
Privacy and data protection regulations worldwide—including GDPR, CCPA, and sector-specific laws—impose strict requirements on the collection, use, and processing of personal information. Customer data used for AI systems must be obtained through lawful means with appropriate consent for the specific processing purpose.Why A is Correct: According to ISACA AAIR guidance on regulatory compliance, the legal basis for processing personal data is the foundational requirement. An AI system built on data collected without proper consent or legal authorization exposes the organization to regulatory penalties, reputational damage, and forced shutdown of the system. Consent must be specific to the AI use case, not merely generic data collection consent.Why B is Wrong: Backup and storage protocols address data security and resilience, which are compliance requirements but secondary to the lawfulness of data collection. Securely storing improperly obtained data does not cure the regulatory violation.Why C is Wrong: Human review of recommendations is a governance safeguard for accuracy and fairness, not a regulatory compliance requirement for data collection. Many regulations do not require human review of recommendation systems.Why D is Wrong: Supervised learning is a modeling technique that does not address regulatory compliance regarding data sourcing. The training methodology is irrelevant to whether the underlying data was legally obtained.
An organization is integrating AI systems into core business operations and has decided to establish a formal process to align AI initiatives with corporate values. Which of the following is the GREATESTbenefit of this decision?
Answer(s): D
Aligning AI initiatives with corporate values establishes ethical foundations that directly influence how models are designed, deployed, and governed. This alignment is most powerfully expressed through enhanced transparency and explainability of AI decisions.Why D is Correct: The ISACA AAIR Study Guide identifies transparency and explainability as core benefits of value-aligned AI governance. When AI processes are formally anchored to corporate values, organizations build systems that can explain their decisions to regulators, customers, employees, and the public. This fosters trust, enables accountability, and supports compliance across all stakeholder groups—producing the most broadly impactful organizational benefit.Why A is Wrong: This option suggests a sequential approach where ethics are retrofitted after deployment, which is actually a risk and poor practice. The formal alignment process prevents this problem rather than enabling it.Why B is Wrong: ROI evaluation is a financial management function. While valuable, it is a narrow benefit compared to the enterprise-wide stakeholder value created by transparency and explainability.Why C is Wrong: Obtaining executive support for training is an organizational change management benefit. While useful, it is a means to an end rather than the primary organizational benefit of value alignment.
A risk practitioner learns that an organization's AI inventory includes separate listings of AI systems, models, and datasets. Which of the following is the risk practitioner's BEST recommendation to improve AI governance?
An AI inventory that lists systems, models, and datasets separately without showing how they relate to each other creates significant governance blind spots. Understanding interdependencies is critical for comprehensive risk assessment and impact analysis.Why A is Correct: The ISACA AAIR framework emphasizes that AI governance requires understanding how AI components interact. Mapping interdependencies reveals which datasets feed which models, which systems depend on which models, and how failures cascade across the AI ecosystem. Continuous mapping ensures this understanding remains current as the AI landscape evolves, enabling accurate risk assessment, change impact analysis, and incident response.Why B is Wrong: Training frequency is a useful operational metric but represents a single attribute addition to inventory records. It does not address the fundamental governance gap of disconnected asset listings.Why C is Wrong: Automating reconciliation improves inventory maintenance efficiency but does not resolve the architectural problem of separate, unlinked asset listings. An automated process applied to siloed data still produces siloed results.Why D is Wrong: Assigning oversight to a committee addresses governance accountability but does not improve the quality or utility of the inventory itself. Oversight without integrated data still leaves governance gaps.
An organization plans to deploy a generative AI system that processes sensitive personal data across multiple countries with varying privacy laws. Which of the following is the BEST course of action to manage legal and regulatory exposure?
Answer(s): B
Multi-jurisdictional AI deployment requires jurisdiction-specific compliance strategies because privacy and data protection laws vary significantly across countries. A one-size-fits-all approach frequently fails to meet local requirements, while post-deployment remediation creates legal exposure during the gap period.Why B is Correct: According to ISACA AAIR guidance, the best approach to multi-jurisdictional compliance is to tailor controls to each relevant statutory framework before deployment and maintain audit trails that demonstrate adherence. This proactive, documented approach reduces legal exposure, satisfies regulatory examination requirements, and enables the organization to demonstrate accountability—a key requirement of frameworks like GDPR.Why A is Wrong: Post-deployment remediation means the organization is non-compliant during deployment, which creates immediate regulatory exposure. Iterative fixes after harm has occurred are inadequate for protecting individuals or the organization.Why C is Wrong: Uniform global policies cannot satisfy jurisdictions with conflicting requirements— some laws mandate data residency within borders, making cross-border transfer impossible regardless of encryption strength.Why D is Wrong: Restricting disclosure of model operations conflicts with transparency requirements embedded in many privacy laws, including GDPR's right to explanation. IP protection cannot override regulatory disclosure obligations.
Which of the following is the PRIMARY benefit of integrating AI risk processes into an enterprise risk framework?
Enterprise risk framework integration elevates AI risk management from a technical discipline to a strategic organizational function, ensuring AI risks are considered alongside all other enterprise risks in strategic planning and decision-making.Why D is Correct: The ISACA AAIR curriculum identifies enterprise integration as the mechanism that enables organization-level oversight and ensures AI risk management aligns with strategic objectives, risk appetite, and governance structures. This integration allows the board and senior management to make informed decisions about AI investment, deployment, and risk acceptance with full awareness of AI's contribution to the organizational risk profile.Why A is Wrong: KPI benchmarking is an operational performance management activity. While integration may improve KPI accuracy, this is a secondary operational benefit rather than the primary strategic benefit of ERM integration.Why B is Wrong: Regulatory compliance is improved by integration but represents a specific compliance benefit rather than the primary organizational value. Compliance is an output of good governance, not the purpose of ERM integration.Why C is Wrong: Cyber threat identification is a security function that benefits from integration but is not the primary benefit. Many AI risks are non-cyber in nature—fairness, accuracy, transparency— and would not be captured by a cyber-focused framing.
Which of the following is MOST important to evaluate when selecting a vendor for a third-party large language model (LLM)?
Third-party LLMs process organizational data—including sensitive and proprietary information— during both training and inference. The vendor's data handling practices determine whether the organization's data remains private, secure, and compliant with legal obligations.Why D is Correct: According to ISACA AAIR third-party risk guidance, data handling practices are the most critical evaluation criterion for AI vendors. How the vendor uses input data—whether for model training, analytics, or retention—directly determines data privacy risk, intellectual property exposure, and regulatory compliance. Vendors who train on customer input data without restriction create significant privacy and confidentiality risks.Why A is Wrong: SLA alignment with corporate strategy addresses availability and performance obligations. While important, these commercial terms do not address the fundamental data risk created by vendor data handling practices.Why B is Wrong: ML method selection reflects technical sophistication but does not determine data risk. The risk profile is driven by data governance, not algorithmic choice.Why C is Wrong: Subscription models represent commercial and procurement considerations. Pricing structure has no bearing on data privacy risk or the organization's risk exposure from vendor data practices.
An organization intends to implement an AI system that poses significant societal risk and interfaces with critical infrastructure and public services. Which of the following is the BEST course of action?
High-risk AI systems—particularly those affecting critical infrastructure and public services—require rigorous pre-deployment assessment to identify potential harms, regulatory obligations, and societal impacts before they affect people or essential services.Why A is Correct: The ISACA AAIR framework, consistent with emerging AI regulations (including the EU AI Act's requirements for high-risk systems), mandates comprehensive pre-launch impact assessment for systems posing significant societal risk. This assessment must cover adverse impact scenarios, applicable compliance obligations, and mitigation measures. Acting before deployment prevents irreversible harm and demonstrates responsible governance to regulators and the public.Why B is Wrong: External consultants can support impact assessment but cannot substitute for the organization's own comprehensive evaluation and accountability. External expertise supplements internal assessment; it does not replace the organization's obligation to assess and take responsibility.Why C is Wrong: Restricting disclosure conflicts with regulatory transparency requirements for high-risk AI systems. Many jurisdictions require explainability and disclosure for systems affecting public services. IP protection cannot override public safety obligations.Why D is Wrong: Parallel model evaluation is a technical testing method that quantifies operational performance. It does not constitute the comprehensive societal impact and compliance assessment required for high-risk deployment.
Which of the following is the PRIMARY benefit of defining and documenting a RACI matrix for AI solution development and deployment?
A RACI (Responsible, Accountable, Consulted, Informed) matrix is a governance tool that explicitly maps roles and decision authority across project activities. For AI systems, RACI frameworks ensure that accountability for decisions, outputs, and risk management is clearly defined and documented.Why D is Correct: The ISACA AAIR curriculum identifies the RACI matrix as a foundational accountability instrument. Its primary benefit is establishing unambiguous responsibility and decision authority, which is essential for AI governance where multiple stakeholders—technical teams, business owners, risk practitioners, compliance officers—must work together with clear lanes of authority. This clarity prevents accountability gaps and ensures risk management actions are owned.Why A is Wrong: Facilitating collaboration is a secondary benefit. While RACI does support cross-functional coordination, collaboration enablement is not its defining purpose. Collaboration can occur without a RACI through other mechanisms.Why B is Wrong: Consolidating governance authority in senior leadership describes centralization, which is not the purpose of RACI. In fact, RACI typically distributes responsibility across multiple levels rather than consolidating it.Why C is Wrong: Strengthening technical development governance is an application of the RACI, not its primary benefit. The RACI benefit is accountability clarity, which then supports technical and architectural governance.
Share your comments for ISACA AAIR exam with other users:
question 35 is incorrect, the correct answer is c, it even states so: explanation: when a vm is infected with ransomware, you should not restore the vm to the infected vm. this is because the ransomware will still be present on the vm, and it will encrypt the files again. you should also not restore the vm to any vm within the companys subscription. this is because the ransomware could spread to other vms in the subscription. the best way to restore a vm that is infected with ransomware is to restore it to a new azure vm. this will ensure that the ransomware is not present on the new vm.
i would like to take psm1 exam.
cbd and pdb are key to the database
the purchase and download process is very much streamlined. the xengine application is very nice and user-friendly but there is always room for improvement.
please upload p_sapea_2023
anyone use this? the question dont seem to follow other formats and terminology i have been studying im getting worried
good questions
hello are these questions valid for ms-102
some questions are wrongly answered but its good nonetheless
how to get system serial number using intune
is it really helpful to pass the exam
#229 in incorrect - all the customers require an annual review
kindy upload
fantastic assessment on psm 1
56 question correct answer a,b
thank you for providing the q bank
true quesstions
i can´t believe ms asks things like this, seems to be only marketing material.
hi, could you please add the last update of ns0-527
question #3 refers to vnet4 and vnet5. however, there is no vnet5 listed in the case study (testlet 2).
sometimes it may be good some times it may be
qs 4 answer seems wrong- please check
very detailed explanation !
the interactive nature of the test engine application makes the preparation process less boring.
very useful.
complete question dump should be made available for practice.
i just passed my first exam. i got 2 exam dumps as part of the 50% sale. my second exam is under work. once i write that exam i report my result. but so far i am confident.
nice create dewey stefen
i just wrote this exam and it is still valid. the questions are exactly the same but there are about 4 or 5 questions that are answered incorrectly. so watch out for those. best of luck with your exam.
passed my exam today. this is a good start to 2023.
great sharing
very helpful
thanks.. very helpful
i registered for 1z0-1047-23 but dumps qre available for 1z0-1047-22. help me with this...
Keeping this site free takes real effort. We constantly battle automated scraping and unauthorized content copying. A quick account helps us protect the community and keep the site free.
To continue studying for your AAIR, please sign in or create a free account.