A bank wants to build a fraud detection model using transaction data from multiple branches. The data is sensitive and cannot leave each branch's jurisdiction. The bank also needs to ensure that the model does not memorize individual transactions. Which combination of techniques best meets these requirements?

Pseudonymize the data and share it centrally for training.

Federated learning with differential privacy applied to the model updates.

Homomorphic encryption of the data, then centralize it for training.

Use a trusted third party to collect all data and anonymize it before training.

A European company uses a US-based cloud provider to host an AI customer service chatbot. The chatbot processes personal data of EU customers. The company wants to ensure GDPR-compliant cross-border data transfers. Which mechanism is most appropriate?

Anonymize the data before sending it to the US.

Use standard contractual clauses (SCCs) without any additional safeguards.

Rely on the cloud provider's certification under the EU-US Data Privacy Framework.

Obtain consent from each customer for the transfer.

Which regulation grants California residents the right to request that a business delete their personal information and the right to opt out of the sale of their personal information?

Health Insurance Portability and Accountability Act (HIPAA)

California Consumer Privacy Act (CCPA)

General Data Protection Regulation (GDPR)

Payment Card Industry Data Security Standard (PCI DSS)

A large organization has multiple AI projects across different departments. The privacy team is overwhelmed and cannot review every project in detail. Which approach best establishes ongoing privacy accountability?

Rely on the AI vendors to ensure privacy compliance.

Delegate all privacy reviews to each department's IT team.

Perform a one-time privacy audit of all AI projects and then stop.

Create a centralized AI governance committee that reviews all AI projects and maintains a register of processing activities.

A company is deploying an AI system that uses personal data for automated decision-making. The DPO is concerned about accountability. Which measure best demonstrates accountability to regulators?

Conduct a one-time privacy impact assessment before deployment.

Implement a privacy policy that is reviewed annually.

Maintain a record of processing activities, including the purpose, categories of data, and retention periods.

Appoint a data protection officer, but do not provide them with resources.

EC-CouncilCertified Responsible AI Governance and Ethics

Domain 5Objective 3

Data Privacy CRAGE Practice Questions (Page 1)

Part of the AI Security Architecture, Privacy, and Trust domain, which makes up ~19% of our current practice bank.

54questions here

11free pages

10concepts

Questions 1–5

1expert · hard
A bank wants to build a fraud detection model using transaction data from multiple branches. The data is sensitive and cannot leave each branch's jurisdiction. The bank also needs to ensure that the model does not memorize individual transactions. Which combination of techniques best meets these requirements?
Select an answer first
2application · medium
A European company uses a US-based cloud provider to host an AI customer service chatbot. The chatbot processes personal data of EU customers. The company wants to ensure GDPR-compliant cross-border data transfers. Which mechanism is most appropriate?
Select an answer first
3foundation · easy
Which regulation grants California residents the right to request that a business delete their personal information and the right to opt out of the sale of their personal information?
Select an answer first
4application · medium
A large organization has multiple AI projects across different departments. The privacy team is overwhelmed and cannot review every project in detail. Which approach best establishes ongoing privacy accountability?
Select an answer first
5expert · hard
A company is deploying an AI system that uses personal data for automated decision-making. The DPO is concerned about accountability. Which measure best demonstrates accountability to regulators?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CRAGE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CRAGE” is a trademark of its owner, used for identification only.