AAIA Question 16

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B1

  In frameworks like ISACA’s AAIA, NIST AI RMF, or ISO 42001, when a data leakage incident occurs in shared AI systems, auditors emphasize: Contain the breach. Notify stakeholders. Investigate & remediate (including technical fixes like privacy techniques). Review governance/controls (data lineage, output guardrails, etc.).

• Chose B1

  When sensitive data is actively leaking through an AI model's outputs (often via "training data extraction" or "membership inference" attacks), the auditor's first priority is to stop the bleeding. The first action must be to stop the exposure Disabling the model: Prevents further leakage Protects all partners and stakeholders Notifying partners ensures: Transparency Regulatory compliance (e.g., breach notification requirements)

• Chose C1

  While option B is highly appropriate from an incident response standpoint, it does not reflect an auditor’s perspective.