Understand Regulatory Frameworks CY0-001 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An AI ethics committee is reviewing a generative AI system that creates realistic fake images of individuals. The system can be used for both creative and malicious purposes. The committee is concerned about the ethical implications of deepfakes. Which action best aligns ethical considerations with regulatory compliance?

   • ARely on users to self-regulate and report misuse.
   • BImplement a content provenance system that labels AI-generated images and requires user consent for creating images of real people.
   • CDeploy the system without restrictions because it is a creative tool.
   • DBan the system entirely to avoid any ethical or legal issues.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is an example of an international regulatory variation in AI governance?

   • AAll countries have adopted the same AI regulations to ensure global consistency
   • BThe United States has a federal law that preempts all state-level AI regulations
   • CThe European Union has no AI-specific regulations and relies solely on voluntary industry standards
   • DChina has implemented regulations requiring algorithmic recommendation systems to be transparent and subject to government oversight
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A global e-commerce company uses an AI recommendation engine that profiles users to personalize product suggestions. The company operates in the EU, California, and China. Which of the following is a key difference the company must account for when complying with GDPR, CCPA/CPRA, and China's PIPL?

   • ACCPA/CPRA applies to all businesses regardless of size, while GDPR only applies to companies with more than 250 employees.
   • BGDPR and PIPL both require data localization, while CCPA/CPRA does not.
   • CGDPR requires a lawful basis for processing, while CCPA/CPRA and PIPL do not require any legal basis.
   • DPIPL imposes stricter cross-border transfer rules, requiring a security assessment for outbound transfers of personal information, while GDPR allows transfers under adequacy decisions or appropriate safeguards.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A multinational healthcare AI startup develops a patient-triage chatbot that processes protected health information (PHI) for hospitals in the US and the EU. The company stores all training data in a US data center. The EU hospitals require that their patients' data be processed under GDPR. Which combination of compliance measures should the company implement to satisfy both HIPAA and GDPR requirements?

   • AAnonymize all EU patient data before processing and store it only in the US, eliminating the need for GDPR compliance.
   • BObtain patient consent for all processing and sign a BAA with EU hospitals to satisfy both HIPAA and GDPR.
   • CImplement a Business Associate Agreement (BAA) with US hospitals and rely on the EU-US Data Privacy Framework for EU data transfers.
   • DSign BAAs with US hospitals, restrict EU data processing to EU-based infrastructure, and implement GDPR-compliant data subject rights and DPIA processes.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In what way can regulatory frameworks influence the deployment of an AI system?

   • AThey mandate that all AI systems be deployed on-premises to ensure security
   • BThey may require the system to include mechanisms for explaining decisions to affected individuals
   • CThey have no effect on deployment because regulations only apply to data collection
   • DThey require that AI systems operate without any human oversight
   Reveal Solution Discussion Select an answer first