Isaca AAIA Exam Dumps

False positives in fraud detection AI systems often stem from poorly optimized hyperparameters. Hyperparameters control aspects of the model's learning process such as the learning rate, decision thresholds, and complexity penalties. When these parameters are not tuned correctly, the model can become overly sensitive and flag normal behavior as suspicious, leading to customer complaints.

''Hyperparameter tuning is essential to balance sensitivity and specificity in AI models. Improper tuning can result in a high rate of false positives or negatives, particularly in systems like fraud detection that require nuanced pattern recognition.''

Options A and B relate to data governance but do not directly cause false positives in predictions. Option C (compute scale training) may affect model efficiency, not accuracy. Thus, D is the most appropriate answer.

The confusion matrix is a key performance evaluation tool in machine learning and AI auditing. According to the AAIA Study Guide, a confusion matrix presents detailed information about actual versus predicted classifications, allowing auditors to assess accuracy, precision, recall, and F1 scores.

''A confusion matrix reveals not just how often predictions are correct, but also the types of errors being made---false positives and false negatives---thereby providing a clear view of the model's predictive reliability.''

Adversarial testing evaluates robustness, group analysis identifies bias across subgroups, and latency testing examines performance speed---not predictive accuracy. Thus, D is the most relevant for ensuring correct predictions.

When data is scarce, training a deep CNN from scratch is likely to result in overfitting. 'Transfer learning' allows an organization to take a model previously trained on a massive dataset (like ImageNet) and 'fine-tune' it for their specific, smaller dataset. The model already knows how to recognize basic shapes and textures, so it requires much less data to learn specific new categories. This is a common and highly effective practice in medical imaging or specialized manufacturing audits. Duplicating data (Option D) does not add new information and only leads to overfitting.

Prompt injection attacks involve maliciously crafted inputs intended to override system instructions, exfiltrate data, or cause harmful behavior. The most effective control aligned with incident management is to deploy robust input validation and sanitization (C), which includes rules and filters designed to detect and neutralize potentially malicious content before it reaches the model. AAIA's coverage of AI threats and vulnerabilities highlights the importance of input validation and secure prompt handling for generative AI systems.

Fine-tuning the model (A) is a long-term adaptation, not an immediate incident control. Scanning for code-like structure (B) or excessive special characters (D) may catch some attacks but are too narrow; many prompt injections use natural language. Comprehensive input validation and sanitization is the most effective and generalizable incident management response.

ISACA, AAIA Exam Content Outline -- Domain 5: Ethical and Legal Considerations in AI; AI-specific threats and incident management.

ISACA AI security guidance covering prompt injection and input validation controls.

In predictive maintenance use cases---such as detecting turbine failure---the most critical concern is identifying as many actual failures as possible to prevent catastrophic events. The AAIA Study Guide emphasizes that in such high-risk scenarios, Recall is the most appropriate metric because it measures the proportion of true positives correctly identified.

''Recall is critical in scenarios where missing a positive instance (e.g., a failure) is costly or dangerous. It ensures that most real issues are caught by the model, even at the expense of some false positives.''

Precision measures correctness of positive predictions, specificity measures true negatives, and accuracy may be misleading if the data is imbalanced. Thus, D (Recall) is most appropriate.