Data Management Specific to AI AAIA Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A defense contractor is developing an AI model to analyze classified satellite imagery. The data is stored in a private cloud environment. The security team has mandated that the data must be protected with the highest level of encryption and that access must be strictly controlled. The data science team needs to access the data for training. Which security control set provides the strongest protection while enabling the data science team to work?

   • AUse platform-managed keys (PMK) for encryption at rest and rely on the cloud provider's default access controls.
   • BEncrypt the data with a simple password and share the password with the data science team via email.
   • CStore the data in an on-premises server with no encryption but with a physical security guard.
   • DUse customer-managed keys (CMK) with hardware security modules (HSM) for encryption at rest, and implement role-based access control (RBAC) with multi-factor authentication (MFA) for all data access.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which component of a data governance framework defines who is accountable for specific data assets?

   • AData lineage
   • BData stewardship
   • CData profiling
   • DData encryption
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A multinational e-commerce company is building a recommendation engine that uses customer purchase history. The company operates in the EU and the US. The data science team wants to use all available customer data to maximize model accuracy. The legal team has stated that the company must comply with GDPR for EU customers. Which data handling approach best balances model performance with GDPR compliance?

   • AObtain explicit consent from EU customers for using their data in the recommendation engine, and provide an opt-out mechanism.
   • BUse all customer data for training, but implement a data retention policy that deletes EU customer data after 30 days.
   • CAnonymize all EU customer data before using it for training, and use the raw data for US customers.
   • DUse only EU customer data for training to ensure compliance, and exclude US data.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An AI auditor is responsible for ensuring that a model's training data has not been tampered with over time. The organization has a data governance framework that requires audit trails for all data access and modifications. The auditor wants to implement a control that provides a tamper-evident record of all changes to the training dataset. Which control is most effective?

   • ARely on the data science team to manually document any changes they make to the dataset in a shared spreadsheet.
   • BTake a snapshot of the training dataset at the beginning of each month and store it in the same storage account.
   • CEnable detailed logging on the data storage system to record all read and write operations, and store the logs in a separate, append-only location.
   • DUse a data versioning tool that tracks changes to the dataset, but allow data scientists to overwrite previous versions.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which security control is specifically designed to protect data while it is being transmitted between systems?

   • AEncryption in transit
   • BData masking
   • CEncryption at rest
   • DAccess control lists
   Reveal Solution Discussion Select an answer first