ISACA Advanced in AI Audit Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C1

  If an AI can browse the web, it can be "tricked" by external websites to leak internal data. Without Activity Logging (C), the organization is "blind" to whether the AI is fetching safe information or inadvertently downloading malicious payloads. Data Augmentation activity is technically pre-deplyment activities and applicable for both in-house or web solution. For a live solution with web integration enabled, the auditor's immediate concern is the security of the current state, not the historical training process.

• Chose A1

  Data imported from the web poses a higher risk of contamination than internal data, making it more susceptible to serious AI security risks such as data poisoning attacks, bias injection, and the inclusion of fraudulent data. For this reason, data augmentation activities (data security checks and cleansing) before model building can be considered the most important control.