Changes to production AI models-including retraining, parameter updates, and architecture modifications- can alter model behavior in ways that introduce new biases, reduce accuracy, or create regulatory compliance issues. Validation before deploying changes is the most critical safeguard.
Why C is Correct: According to ISACA AAIR change management guidance for AI systems, rigorous validation to assess changes' effects on predictive accuracy and model bias is the most important change management activity. Production AI models make real-world decisions affecting people and business outcomes. Unvalidated changes may degrade performance, introduce discriminatory patterns, or create regulatory violations that are difficult to detect and remediate after deployment.
Why A is Wrong: Allowing operational teams to adjust configuration parameters in real time bypasses change control processes and creates untracked, unvalidated changes to model behavior. This represents a governance risk, not an acceptable change management practice.
Why B is Wrong: Access controls for new model functionalities are a security and authorization concern.
While important for access governance, they do not address the technical risk that model changes may degrade performance or introduce bias.
Why D is Wrong: Expediting production rollouts to minimize downtime prioritizes availability over quality assurance. Rushing changes without adequate validation trades one operational risk (downtime) for a potentially more severe risk (biased or inaccurate outputs affecting critical decisions).

AI systems introduce unique security threat vectors that differ fundamentally from conventional IT security scenarios. Risk scenarios must address AI-specific attacks-model poisoning, adversarial inputs, output manipulation-that conventional security frameworks do not cover.
Why A is Correct: The ISACA AAIR AI security risk scenario guidance focuses on attacks that specifically exploit AI system properties-particularly techniques that maliciously alter AI outputs. These AI-specific attack vectors (adversarial examples, model inversion, prompt injection, output manipulation) represent the most important focus for AI security risk scenario development because they target capabilities unique to AI systems and cannot be addressed by repurposing conventional IT security scenarios.
Why B is Wrong: Business unit readiness documentation is a change management and organizational capability assessment activity. It supports AI adoption planning but does not constitute AI security risk scenario development.
Why C is Wrong: Access policy development is an important security control activity but represents control design rather than risk scenario development. Access policies respond to identified risks; they are not themselves risk scenarios.
Why D is Wrong: Quantum encryption is an emerging cryptographic technology addressing future threats to classical encryption. While relevant for long-term data protection planning, it represents a specialized and forward-looking concern rather than the most important focus for current AI security risk scenarios.

Credit risk assessment AI models trained on unrepresentative datasets perpetuate and amplify historical financial inequities, producing discriminatory outcomes that violate anti-discrimination laws and harm underrepresented borrowers. Dataset diversity is the primary safeguard against training-data-driven bias.
Why A is Correct: According to ISACA AAIR bias and fairness guidance for financial AI, dataset diversity is the most important factor for supporting accurate and unbiased credit risk outcomes. A diverse dataset that represents the full population of potential borrowers-across demographics, income levels, credit histories, and geographies-enables the model to learn genuine risk relationships rather than proxies for protected characteristics. Without diversity, even technically sophisticated models perpetuate discriminatory patterns from historical data.
Why B is Wrong: Supervised learning is a modeling approach, not a data quality characteristic. The choice of supervised learning is appropriate for credit scoring but does not determine whether the training data is representative or unbiased.
Why C is Wrong: Synthetic data augmentation can supplement real data to address specific gaps but cannot substitute for diversity in the underlying real-world data. Synthetic data derived from biased real data may amplify rather than correct the original bias.
Why D is Wrong: Data normalization is a preprocessing technique that scales numerical features to comparable ranges to improve model convergence. It addresses technical modeling quality but has no effect on the representational diversity or demographic fairness of the dataset.

Traditional intellectual property law was designed for human-created works. AI-generated content sits in a legal grey zone because current copyright frameworks in most jurisdictions do not clearly establish who-if anyone-holds copyright in outputs created autonomously by AI systems.
Why C is Correct: According to ISACA AAIR, the lack of regulatory clarity around AI-generated content copyright is the greatest IP challenge because it creates fundamental uncertainty about ownership, transferability, and enforceability of rights in AI outputs. Without clear legal status, organizations cannot confidently assert ownership, license AI-generated materials, or prevent competitors from copying outputs.
This uncertainty pervades commercial agreements, licensing strategies, and competitive protection.
Why A is Wrong: Zero-data retention policies actually protect intellectual property by ensuring vendor systems do not retain proprietary input data. This represents a protective measure, not a challenge.
Why B is Wrong: Training material customization for confidential data handling is a workforce education challenge. While important for data protection, it does not represent the primary IP challenge from AI- generated content.
Why D is Wrong: Low-risk use cases like administrative tasks present minimal IP concerns because the outputs are typically not commercially significant or protectable. The IP challenge is greatest for creative, analytical, and proprietary outputs.

A comprehensive, well-designed data pipeline establishes consistent, documented processes for data collection, preprocessing, transformation, and quality validation across training, testing, and validation stages.
This systematic approach reduces the likelihood of data errors propagating through to the final model.
Why A is Correct: According to ISACA AAIR data pipeline governance guidance, the primary benefit of a comprehensive pipeline is reducing error propagation risk. By applying consistent quality checks, validation gates, and transformation rules throughout the pipeline, errors in raw data are detected and corrected before they influence model training. This prevents data quality failures from compounding into model accuracy and bias problems-producing a higher-quality, more reliable final model.
Why B is Wrong: Governance risk sharing with external providers occurs through contractual arrangements and shared responsibility frameworks, not through data pipeline implementation. Pipeline design is an internal quality management measure.
Why C is Wrong: Automation of early-stage pipeline tasks is an operational efficiency benefit. While valuable, efficiency is a secondary benefit compared to the primary purpose of ensuring data quality and reducing error risk.
Why D is Wrong: Enhanced auditability is an important governance benefit that pipeline documentation provides but is not the primary purpose of pipeline implementation. The primary purpose is quality assurance during model development; auditability is a beneficial side effect.