Ensuring AI model resilience against external threats involves validating that the model is configured to resist attacks, such as adversarial inputs, data poisoning, or misuse. The AAIA™ Study Guide emphasizes configuration testing as a crucial control to simulate threat scenarios and assess robustness.
"Model configuration testing simulates real-world threat conditions to validate model resilience. This includes testing against adversarial attacks, input manipulation, and exposure of sensitive outputs." While access monitoring (C) and anonymization (A) reduce risks, they don't actively validate model behavior under threat conditions. Therefore, D offers the most effective resilience measure.
Reference: ISACA Advanced in AI Audit™ (AAIA™) Study Guide, Section: "AI Governance and Risk Management," Subsection: "Security and Resilience Testing for AI Models"

Using AI to make employment decisions such as driver termination or retention introduces significant ethical risks. If based solely on performance metrics without context or human review, such systems can lead to unfair treatment or discrimination-violating principles of transparency and due process.
"Automating workforce decisions must be approached cautiously to prevent discriminatory outcomes. Ethical AI governance requires oversight when AI is used for employment-impacting decisions." A, C, and D involve business optimization without directly affecting individual employment rights. Therefore, B poses the greatest ethical risk.
Reference: ISACA Advanced in AI Audit™ (AAIA™) Study Guide, Section: "Ethical and Legal Considerations in AI," Subsection: "Human Impact and Workforce Automation Ethics"

Unsupervised learningusesunlabeled datato discover patterns, structures, or groupings without explicit outcome labels. The model "learns" by identifying similarities, clusters, or latent structures within the data, somewhat analogous to how humans can notice patterns without being told the correct answer. In AAIA's fundamentals coverage, unsupervised methods (e.g., clustering, dimensionality reduction) are explicitly linked to situations wherelabels are unavailable or costly, yet insight is still needed.
Supervised learning (A) requires labeled examples (input-output pairs). Federated learning (B) describes a distributed training paradigm, not the labeling requirement itself. Reinforcement learning (C) uses feedback in the form of rewards and penalties rather than unlabeled static datasets. Therefore,unsupervised learningis the correct type that directly usesunlabeled datato learn structure.
References:
ISACA,AAIA Exam Content Outline- Domain 1: AI Models, Considerations, and Requirements (supervised, unsupervised, reinforcement learning).
ISACA AI fundamentals content on learning types and data labeling.

AI-driven evidence collection should enhanceefficiency and accuracy. The BEST indicator of improvement isreduced time spent gathering data with fewer errors(B), showing that AI has streamlined data extraction, consolidation, and initial validation without compromising quality. AAIA's content on AI in audit processes highlights benefits such asautomation of repetitive tasks, improved coverage, and higher-quality evidence.
Extended timelines for retraining (A) suggest inefficiency rather than improvement. Eliminating human judgment (C) is neither realistic nor recommended; professional skepticism and auditor judgment remain essential. Relying on unstructured data with minimal cleansing (D) can increase risk of misinterpretation or noise. Therefore, more efficient and accurateevidence compilationis the clearest positive outcome.
References:
ISACA,AAIA Exam Content Outline- Domain 3: AI Auditing Tools and Techniques (efficiency and quality improvements in audit).
ISACA internal audit and data analytics guidance on AI's value in evidence collection.

Evaluatingedge cases-rare but critical scenarios where AI may behave unpredictably-must be done during thetest and verifystage (D). This phase is designed to simulate extreme or unusual inputs, validate performance under stress, and ensure robustness and safety before deployment. AAIA highlights that robustness testing, including edge case evaluation, is a key testing technique for AI solutions.
While planning (A) and data collection (C) prepare inputs, they do not evaluate model behavior. Operating and monitoring (B) may detect issues later, but edge case testing must occurpre-deploymentto reduce risk.
References:
ISACA,AAIA Exam Content Outline- Domain 2: Testing Techniques for AI Solutions (edge cases, robustness testing).