A healthcare startup is deploying an AI chatbot that provides medical advice. The chatbot processes personal health data from users in the EU and California. The startup must comply with GDPR, CCPA, and conduct a PIA. The startup has limited resources and must prioritize its compliance efforts. What is the most appropriate first step?

Delete all user data after each session to avoid compliance obligations

Conduct a PIA to identify privacy risks and determine which regulations apply to the data processing

Implement GDPR-compliant consent mechanisms first because GDPR is stricter than CCPA

Implement CCPA opt-out mechanisms first because the startup is based in California

A multinational corporation is training a language model on internal communications. The data includes sensitive employee information. The security team requires that only the NLP research group can access the raw text, while the infrastructure team manages the storage but should not read the content. What should be implemented?

Use Azure RBAC to grant the NLP group read access to the data and the infrastructure team only 'Storage Account Contributor' without data-plane read permissions

Create a shared folder with read access for all employees

Grant the infrastructure team full access to the storage account for management purposes

Encrypt the data and give the decryption key to the infrastructure team

A financial institution is building an AI model to detect money laundering. The data includes transaction records and customer identities. The model is trained in a shared environment where multiple teams work on different models. The security team requires that the anti-money-laundering (AML) team can only access the data needed for their model, and that no other team can access it. What is the most effective way to isolate the data?

Create a separate Azure Data Lake Storage container with RBAC that grants access only to the AML team

Store the data in the same container as other teams but use a naming convention to identify it

Grant the AML team full access to the entire storage account

Encrypt the data with a key that only the AML team knows

A California-based marketing company uses an AI model to score leads based on consumer behavior data. Under CCPA, consumers have the right to opt out of the sale of their personal information. The company currently shares consumer data with third-party data brokers. What must the company implement to comply with CCPA?

A clear 'Do Not Sell My Personal Information' link on the website and a process to honor opt-out requests

An encryption mechanism for all consumer data at rest

A consent banner that requires consumers to agree before any data is collected

A data retention policy that deletes all consumer data after 30 days

Under the GDPR, what is the term for the rights of individuals to access, rectify, and erase their personal data processed by an AI system?

Data protection impact assessments

PMICertified Professional in Managing AI (PMI-CPMAI)

Domain 1Objective 1

Oversee Privacy and Security Plan PMI-CPMAI Practice Questions (Page 4)

Part of the Support Responsible and Trustworthy AI Efforts domain, which accounts for 15% of the PMI-CPMAI exam. PMI does not publish an official question count, but from its 160-minute exam (~65–105 total, ~10–16 in this domain), expect 2–3 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

7concepts

15%of the exam

Questions 16–20

16expert · hard
A healthcare startup is deploying an AI chatbot that provides medical advice. The chatbot processes personal health data from users in the EU and California. The startup must comply with GDPR, CCPA, and conduct a PIA. The startup has limited resources and must prioritize its compliance efforts. What is the most appropriate first step?
Select an answer first
17application · medium
A multinational corporation is training a language model on internal communications. The data includes sensitive employee information. The security team requires that only the NLP research group can access the raw text, while the infrastructure team manages the storage but should not read the content. What should be implemented?
Select an answer first
18expert · hard
A financial institution is building an AI model to detect money laundering. The data includes transaction records and customer identities. The model is trained in a shared environment where multiple teams work on different models. The security team requires that the anti-money-laundering (AML) team can only access the data needed for their model, and that no other team can access it. What is the most effective way to isolate the data?
Select an answer first
19application · medium
A California-based marketing company uses an AI model to score leads based on consumer behavior data. Under CCPA, consumers have the right to opt out of the sale of their personal information. The company currently shares consumer data with third-party data brokers. What must the company implement to comply with CCPA?
Select an answer first
20foundation · easy
Under the GDPR, what is the term for the rights of individuals to access, rectify, and erase their personal data processed by an AI system?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PMI-CPMAI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by PMI. “PMI-CPMAI” is a trademark of its owner, used for identification only.

Oversee Privacy and Security Plan PMI-CPMAI Practice Questions (Page 4)

Questions 16–20

Under the GDPR, what is the term for the rights of individuals to access, rectify, and erase their personal data processed by an AI system?

Keep studying — Support Responsible and Trustworthy AI Efforts