Evasion attacks involve adversaries crafting inputs specifically designed to fool AI models into producing incorrect outputs—for example, manipulating images to evade object detection or modifying text to bypass content classifiers. Detecting these attacks requires identifying inputs that are statistically unusual or inconsistent with legitimate use patterns.

Why B is Correct: The ISACA AAIR adversarial AI security guidance identifies anomaly detection as the most effective mitigation for evasion attacks. Anomaly detection systems monitor input distributions, model query patterns, and output characteristics for statistical deviations that indicate adversarial manipulation. By identifying inputs that fall outside expected distributions or trigger unusual model responses, anomaly detection catches evasion attempts before they produce harmful outputs.

Why A is Wrong: API rate limiting controls query frequency to prevent brute-force model probing but does not detect or prevent crafted adversarial inputs sent at normal rates. An attacker can evade rate limits by spacing requests or distributing queries.

Why C is Wrong: Predictive analytics uses historical patterns to forecast future outcomes. It does not specifically detect real-time adversarial manipulation of model inputs.

Why D is Wrong: Feature importance weighting adjusts how much different input features influence model predictions. While it can improve robustness to irrelevant features, it does not detect adversarial inputs specifically crafted to exploit important features.

Output deterioration despite stable inputs is a classic indicator of model drift—specifically concept drift, where the underlying relationships between inputs and targets change over time even when the distribution of inputs appears stable. This requires ongoing monitoring and systematic recalibration.

Why D is Correct: The ISACA AAIR life cycle management guidance identifies continuous performance monitoring and scheduled recalibration as the appropriate response to model drift. Monitoring provides early warning when performance degrades below thresholds, while scheduled recalibration ensures the model is periodically updated to reflect current real-world patterns. This systematic approach prevents continued deterioration and maintains model reliability.

Why A is Wrong: Source code audits and peer reviews address development quality and code integrity, not model drift. Drift is a statistical phenomenon driven by changing data relationships, not code defects that code reviews can identify.

Why B is Wrong: Replacing predictive AI with static rule-based systems eliminates the adaptive capabilities that make AI valuable. Static rules cannot respond to evolving patterns and typically perform worse in dynamic environments.

Why C is Wrong: Dataset cleansing addresses data quality for model retraining but does not establish the ongoing monitoring mechanism needed to detect future drift. A one-time cleansing activity cannot prevent recurrent deterioration.

AI systems generate large volumes of operational data—model outputs, query logs, performance metrics, system telemetry. AI-powered analytics tools can process this data at scale and speed to identify subtle patterns that indicate developing vulnerabilities before they manifest as incidents.

Why B is Correct: According to ISACA AAIR monitoring and analytics guidance, the primary benefit of AI-based risk monitoring tools is their ability to identify latent vulnerabilities through anomaly detection in large datasets. Human analysts cannot process the volume and velocity of data produced by AI systems at sufficient scale to detect subtle, early-stage indicators of emerging risks. AI-powered analytics provide this capability—identifying patterns that precede security incidents, model failures, or compliance violations.

Why A is Wrong: Industry trend forecasting is a strategic risk intelligence activity. While valuable for planning, it represents a secondary, external-facing use of AI analytics rather than the primary benefit of monitoring organizational AI system risks.

Why C is Wrong: Access attempt logging and documentation are security event recording functions. While comprehensive logging is important for audit trails, the primary benefit of AI analytics is pattern detection across that logged data—not the logging activity itself.

Why D is Wrong: Automation of risk analysis and treatment decisions is a contested application of AI in risk management. Human judgment in risk treatment decisions is typically retained as a governance requirement. Removing human involvement from treatment decisions is not the primary benefit of AI monitoring tools.