AAIA Question of the Day: Data Subject Request Preservation

Quiz Yazan Ibrahim
AI audit training by expert Yazan Abu Ghosh for auditors with certifications.

AAIA exam practice question — AAIA Question of the Day: Data Subject Request Preservation

AAIA exam practice question: daily practice for the ISACA Advanced in AI Audit (AAIA) exam — domain: AI Governance and Risk.

Question

Your company’s production recommendation model used customer transaction data. Legal notifies the AI team of a data subject deletion request that may affect training examples and model artifacts stored across services. Which control most effectively ensures preservation of relevant artifacts and an auditable chain-of-custody while the request is evaluated?

  • A. Implement an automated legal-hold mechanism that freezes deletion of identified model artifacts and records immutable audit logs with chain-of-custody metadata.
  • B. Require the data engineering team to manually copy relevant artifacts to a secure directory and log the action in the ticketing system.
  • C. Temporarily disable all automated retention and deletion policies across systems until legal completes its review.
  • D. Rely on scheduled backups and restore points to recover artifacts later if preservation is required.
Show the answer and explanation

Correct answer: A. Implement an automated legal-hold mechanism that freezes deletion of identified model artifacts and records immutable audit logs with chain-of-custody metadata.

The automated legal-hold mechanism is best because it preserves only the identified artifacts, prevents accidental or automated deletion, and generates immutable audit records and chain-of-custody metadata required for legal and regulatory review. Manual copying is error-prone, may miss artifacts, and ticket logs can be altered or incomplete. Disabling retention policies globally is overly broad, increases exposure to unnecessary data retention risks, and can violate privacy requirements. Relying on backups is unreliable for preservation of evidentiary metadata and may not capture the precise state or lineage of artifacts needed for audit, plus restoring backups can conflict with deletion obligations.

Want more practice?

Prepare for the ISACA Advanced in AI Audit (AAIA) exam with AI Audit & Compliance Framework: Practical Methods & Evaluation.