Oversee Privacy and Security Plan PMI-CPMAI Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In a data governance framework for an AI project, what is the primary purpose of classifying PII data?

   • ATo automatically delete all data that is not required for the specific AI use case
   • BTo determine the appropriate level of protection and access controls required for the data
   • CTo improve the accuracy of the AI model by filtering out irrelevant data
   • DTo reduce the storage cost of the data by identifying redundant copies
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A large insurance company is building an AI model to detect fraudulent claims. The data includes sensitive customer information. The company has a data governance team that must classify and inventory all PII, but the data science team needs to work with the data. The security team has mandated that the data science team should not be able to export raw PII from the environment. What is the most effective way to satisfy both the governance and security requirements?

   • AClassify the data and provide the data science team with full access to the raw data but restrict export via a data loss prevention (DLP) policy
   • BSkip the inventory and focus on encrypting the data at rest
   • CProvide the data science team with access to the raw data and rely on their agreement to not export it
   • DClassify the data, create an inventory, and provide the data science team with access to a de-identified version of the dataset
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A retail company is building a recommendation engine. The training dataset contains customer purchase history and demographic information. The data engineering team needs to run preprocessing jobs, while the model training team needs access to the final cleaned dataset. The security team wants to ensure that no single team can access both the raw data and the production model weights. What access control approach should be implemented?

   • AProvide the model training team with direct access to the raw data to improve model accuracy
   • BUse a single service principal for all jobs to simplify management
   • CCreate separate roles: one for data preprocessing with read/write on raw data, and another for model training with read access to the cleaned dataset only
   • DGrant both teams the same role with full access to all data and model artifacts
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A multinational retailer uses an AI system to personalize marketing emails. The system processes customer data from both the EU and California. A customer from the EU requests deletion of their data, while a customer from California requests to opt out of the sale of their data. The company must comply with both GDPR and CCPA. What is the most appropriate approach?

   • AHonor the GDPR deletion request by deleting the EU customer's data, and honor the CCPA opt-out by stopping the sale of the California customer's data
   • BConduct a PIA before taking any action
   • CApply the same deletion process to both customers to simplify compliance
   • DIgnore the CCPA opt-out because the company is based in the EU
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which of the following is a key consideration for secure data handling during the data collection phase of the AI lifecycle?

   • AEncrypting data after it has been used for model training
   • BEnsuring data is collected only from authorized sources and with proper consent
   • CGranting all team members access to the raw data to speed up development
   • DDeleting data immediately after collection to minimize storage
   Reveal Solution Discussion Select an answer first