Isaca Certification CISA Dumps PDF

Comprehensive and Detailed Step-by-Step Explanation:

Data collection and obtaining consentis themost critical regulatory requirementwhen using customer data for AI training, especially under laws likeGDPR, CCPA, and ISO 27701.

Collection of Data and Obtaining Consent (Correct Answer – C)

Ensures compliance withprivacy lawsthat require explicit customer consent.

Example:UnderGDPR, companies mustinform usershow their data will be used and allow them toopt out.

AI Algorithm Accuracy (Incorrect – A)

Important formodel performancebutnot a primary legal concern.

Ethical Use of Computing Resources (Incorrect – B)

Ethical considerations are valuable butnot a regulatory priority.

Continuous Monitoring of AI (Incorrect – D)

Ensuresperformance, butregulatory compliance focuses on data privacy.

References:

ISACA CISA Review Manual

GDPR & CCPA Compliance Guidelines

ISO 27701 (Privacy Information Management System)

IT application owners having sole responsibility for architecture approval (B) is a major concern because it indicates a lack of oversight and segregation of duties.EA decisions should be reviewed by a cross-functional governance body to ensure alignment with security, compliance, and business objectives.

Other options:

The CIO chairing the review board (A)may indicate centralized leadership but is not inherently a risk.

EA governing non-IT projects (C)may indicate scope expansion but is not a security risk.

Security requirements being reviewed (D)is a best practice and not a concern.