CCAR-P Governance, Safety, and Risk Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Enable verbose audit logging on all regions and review the logs quarterly to detect any cross-region data movement.

  Why it's wrong here

  Detection after the fact does not satisfy a residency obligation. Logs can reveal that data moved, but by then the violation has already occurred and may have triggered regulatory exposure. Because the requirement is that data never leaves its region, a detective-only control leaves the primary risk unaddressed and would not convince an auditor that residency is architecturally enforced.

• ✗

  Use a single global endpoint and rely on contractual terms stating that data will be handled in accordance with local laws.

  Why it's wrong here

  Contractual language does not guarantee technical residency. A single global endpoint may route or store data across regions, and the retailer would have no architectural control over where processing occurs. Because the requirement is to prove data never leaves its region, a legal assurance without matching technical controls cannot satisfy auditors who need evidence of actual data flow boundaries.

• ✗

  Encrypt all customer data with a customer-managed key before sending it to a shared multi-region inference pool.

  Why it's wrong here

  Encryption protects confidentiality but does not control location. Data encrypted with any key still physically resides and is processed wherever the inference pool operates, so residency is violated even though the content is unreadable. The requirement concerns where data is processed and stored, not only who can read it, so encryption alone cannot satisfy the geographic constraint.

• ✓

  Deploy region-specific endpoints and storage in each geography, pin explicit model identifiers per region, and validate data flows so no cross-region replication occurs.

  Why this is correct

  This is correct because regional endpoints and storage keep processing and persistence within the required geography, and pinning explicit model identifiers prevents a silent upgrade from routing traffic to a model hosted elsewhere. Validating data flows closes the loop by proving no replication path exists. Together these measures give auditors concrete evidence that residency holds even during model changes.