2.3 Identify and Explain the Classification and Attributes of AI Applications and Apply Security Controls NETWORK-SECURITY-ARCHITECT Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Under GDPR, what is a data protection impact assessment (DPIA) required for?

   • AOnly processing that involves transferring data outside the EU
   • BAny processing that is likely to result in a high risk to individuals' rights and freedoms
   • COnly processing that involves automated decision-making
   • DAll processing of personal data, regardless of risk
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What does HIPAA require for AI applications that handle protected health information (PHI)?

   • AEnsuring AI models are trained only on de-identified data
   • BObtaining explicit consent from patients for all AI processing
   • CDeleting PHI after each AI analysis
   • DCompliance with the HIPAA Privacy and Security Rules
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   How does data loss prevention (DLP) protect sensitive data when used with AI applications?

   • ABy requiring multi-factor authentication for all users
   • BBy classifying data and enforcing policies to prevent unauthorized sharing or leakage
   • CBy encrypting all data at rest and in transit
   • DBy blocking all external network traffic
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A multinational company deploys an AI recruitment tool that screens job applicants. The tool processes personal data of applicants from the EU and the US. The company's legal team wants to ensure the tool complies with GDPR requirements for automated decision-making. Which control is REQUIRED under GDPR for this AI application?

   • AConduct a data protection impact assessment (DPIA) only if the tool processes special category data.
   • BObtain a signed consent form from every applicant before their data is processed by the AI tool.
   • CProvide applicants with the right to obtain human intervention, express their views, and contest the automated decision.
   • DStore all applicant data in an EU-based data center to comply with data residency requirements.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A marketing agency uses an AI content generator that can access the agency's customer database. The agency wants to prevent the AI from learning or reproducing customer PII in its outputs. Which DLP control is MOST effective for this scenario?

   • ATrain the AI model to avoid generating PII by fine-tuning it on non-sensitive data.
   • BMonitor the AI tool's outputs for PII patterns and alert the security team.
   • CClassify customer PII in the database and configure the AI tool to reject prompts that request PII.
   • DRestrict the AI tool's database access to read-only permissions.
   Reveal Solution Discussion Select an answer first