Privacy and Data Governance Programs AAIA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A financial services firm uses an AI system for credit scoring. A customer submits a data subject access request (DSAR) to obtain a copy of all personal data the firm holds about them, including the data used to train the AI model. The firm's data inventory shows that the training dataset contains the customer's data, but it is stored in a backup archive. What is the firm's primary obligation regarding this DSAR?

   • AProvide the customer with a copy of the personal data held in the active production system, and inform them that archived backup data is not subject to access requests.
   • BDelete the customer's data from the backup archive immediately to avoid having to disclose it in the DSAR response.
   • CProvide the customer with the AI model's credit score decision and the rationale, but withhold the underlying training data as it is proprietary.
   • DSearch all systems, including the backup archive, and provide the customer with a copy of all their personal data in a structured, commonly used, and machine-readable format.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the purpose of regulatory compliance mapping in the context of AI systems?

   • ATo ensure that the AI system is compliant with all international laws.
   • BTo identify which privacy regulations apply to the AI system and align controls accordingly.
   • CTo eliminate the need for legal review of AI systems.
   • DTo create a single global privacy policy for all jurisdictions.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is a key element of a data processing agreement (DPA) with a third-party vendor?

   • AGuaranteeing that the vendor will never experience a data breach.
   • BEnsuring that the vendor is located in the same country as the organization.
   • CRequiring the vendor to use the same AI model as the organization.
   • DSpecifying the purpose and duration of data processing.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A multinational retail company is deploying an AI-powered customer recommendation engine. The data governance team needs to create a complete record of all customer data assets used by the system, including where they are stored, who owns them, and their sensitivity level. The company operates in both the EU and the US. What is the most effective first step for the team to take?

   • ADeploy a data loss prevention tool to monitor and block any unauthorized transfers of customer data.
   • BCreate a data retention schedule that defines how long customer data can be kept in each region.
   • CAppoint a data steward for each business unit to manage customer data access requests.
   • DImplement a data classification scheme and build a data inventory that tags each dataset with its sensitivity and regulatory jurisdiction.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which data governance principle is most directly supported by implementing data lifecycle management?

   • AEnsuring data is retained only as long as necessary and disposed of securely.
   • BAssigning ownership and accountability for data assets.
   • CGuaranteeing that data is always available to authorized users.
   • DEnsuring that data is accurate and complete.
   Reveal Solution Discussion Select an answer first