Objective 2.3 Follow Applicable Regulations, Standards, and Best Practices CERTIFIED-ETHICAL-EMERGING-TECHNOLOGIST Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   A US healthcare organization is developing an AI system that processes patient medical records. Which regulation is most directly applicable to the handling of this data?

   • AHIPAA
   • BCCPA
   • CNIST Cybersecurity Framework
   • DGDPR
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A multinational e-commerce company is expanding its operations to serve customers in the European Union. The company's data center is in the United States. The legal team is reviewing how to handle customer data. Which action is required to comply with GDPR?

   • AObtain explicit consent from every user before any data processing, including for fraud prevention.
   • BAnonymize all customer data before transferring it to the U.S. to avoid GDPR obligations.
   • CEnsure that data transfers to the U.S. are protected by an appropriate mechanism, such as Standard Contractual Clauses or an adequacy decision.
   • DStore all EU customer data on servers located in the U.S. to simplify compliance with U.S. laws.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company is developing an AI system for medical diagnosis. The system will be used in both the EU and the U.S. The company wants to ensure compliance with both GDPR and HIPAA, and also follow ethical AI best practices. Which combination of actions is most appropriate?

   • AConduct a Data Protection Impact Assessment (DPIA) for the EU, implement HIPAA safeguards for U.S. data, and establish an AI ethics board to review system outputs.
   • BImplement ISO/IEC 27001 and consider that sufficient for both GDPR and HIPAA compliance.
   • CUse only de-identified data for the AI system to avoid GDPR and HIPAA obligations.
   • DRely on the model's accuracy as the sole measure of compliance, and avoid external audits.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A manufacturing company is implementing a new IoT system that collects sensor data from its production line. The company wants to ensure the system is secure and compliant with industry best practices. Which standard or framework is most relevant for establishing a cybersecurity baseline?

   • AGDPR
   • BCCPA
   • CISO/IEC 27001
   • DNIST Cybersecurity Framework (CSF)
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A government agency is developing a facial recognition system for law enforcement. The agency wants to follow best practices for responsible AI use. Which approach is most consistent with NIST's AI Risk Management Framework?

   • AUse the system only for non-critical tasks to avoid any risk.
   • BRely on the vendor's claims of accuracy without independent testing.
   • CConduct a risk assessment, involve stakeholders, and implement ongoing monitoring and governance.
   • DDeploy the system immediately to improve public safety, and evaluate performance after deployment.
   Reveal Solution Discussion Select an answer first