CCNA AI Security, Ethics and Governance Questions

Why this answer

How to eliminate wrong answers

Option A is wrong because accountability for treatment outcomes is a general ethical concern but not the most critical here; the primary issue is that the model's training data lacks demographic diversity, which leads to biased predictions before accountability can even be assessed. Option B is wrong because lack of transparency (black-box nature) is a separate concern; while it can exacerbate bias, the core problem is that the model's training data does not represent the target population, not that the model's decisions are opaque. Option C is wrong because privacy violations in training data are a valid concern but not directly triggered by the scenario; the scenario describes using data from a single hospital, which does not inherently imply privacy breaches, whereas the demographic shift introduces bias.

Why this answer

How to eliminate wrong answers

Option A is wrong because PCI DSS is a security standard for protecting payment card data, not a framework for regulating automated decision-making or profiling of EU citizens' personal data. Option C is wrong because HIPAA applies to protected health information in the United States and does not address automated decision-making or profiling under EU law. Option D is wrong because SOX is a US federal law focused on financial reporting and corporate governance, with no provisions for personal data processing or AI-driven profiling.

Why this answer

How to eliminate wrong answers

Option A is wrong because removing the ZIP code feature may not eliminate bias if other features (e.g., income, credit history) are correlated with ZIP code, and it could reduce model accuracy by discarding legitimate predictive information. Option B is wrong because increasing the decision threshold for those ZIP codes is a post-hoc adjustment that treats the symptom (high false positives) without fixing the underlying bias, and it may introduce new disparities or violate regulatory requirements for consistent lending standards. Option C is wrong because discontinuing use of the model for those ZIP codes abandons the model's utility entirely for those areas, which is operationally impractical and does not address the bias—it simply avoids the problem rather than correcting it.

Why this answer

How to eliminate wrong answers

Option A is wrong because a human-in-the-loop review process introduces latency and cannot scale to handle high-volume chatbot traffic; it is a secondary safeguard, not the first implementation. Option C is wrong because creating a usage policy defines acceptable behavior but does not technically prevent the model from generating offensive responses—it is a documentation step, not an enforcement mechanism. Option D is wrong because sanitizing training data is a proactive but time-consuming and imperfect process; even with clean data, large language models can still generate toxic outputs due to emergent behaviors or adversarial prompts, so a runtime filter is needed first.

Why this answer

How to eliminate wrong answers

Option A is wrong because detailed audit logging is a detective control that records who accessed what and when, but it does not prevent exposure of PII or ensure compliance with privacy regulations like HIPAA or GDPR. Option C is wrong because encrypting data at rest (e.g., AES-256) and in transit (e.g., TLS 1.3) protects against unauthorized interception but does not remove PII from the data; if an authorized user or AI model processes encrypted data, the plaintext still contains identifiable information. Option D is wrong because role-based access control limits who can view or process data but does not alter the data itself; a user with the appropriate role can still access raw PII, violating privacy regulations if the data is used for AI training without anonymization.

Why this answer

How to eliminate wrong answers

Option A is wrong because a larger validation dataset does not protect against adversarial perturbations; it only improves the statistical estimate of model performance on clean data, not robustness to crafted attacks. Option B is wrong because reducing input resolution may actually increase vulnerability by discarding fine-grained features that help distinguish objects, and it does not prevent pixel-level manipulations from fooling the model. Option C is wrong because increasing model complexity often makes the model more susceptible to overfitting and adversarial examples, as deeper networks can have larger linear regions that attackers exploit.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because additional testing only measures the disparity but does not fix it; it is a diagnostic step, not a corrective action. Option C is wrong because replacing the object detection algorithm does not guarantee improved fairness—bias often stems from training data distribution, not the algorithm itself, and a different algorithm may still exhibit similar biases if trained on the same skewed data. Option D is wrong because adjusting the decision threshold can trade off precision and recall but does not address the underlying data imbalance; it may reduce false negatives for one group at the expense of increased false positives for another, without resolving the root cause.

Why this answer

How to eliminate wrong answers

Option A is wrong because developing algorithms is a technical function performed by data scientists and engineers, not by an ethics board, which focuses on governance and oversight. Option B is wrong because managing cloud infrastructure is an IT operations role involving platforms like AWS or Azure, unrelated to ethical review processes. Option C is wrong because marketing AI products is a business development activity that promotes AI solutions, whereas an ethics board provides independent scrutiny to prevent unethical practices.

Why this answer

How to eliminate wrong answers

Option B is wrong because increasing model replicas only distributes load and improves throughput, but does not detect or block malicious inputs; adversarial attacks exploit model vulnerabilities, not resource exhaustion. Option C is wrong because retraining with adversarial examples requires model retraining, which violates the constraint of 'without requiring model retraining' and is a longer-term solution, not real-time mitigation. Option D is wrong because rolling back to a previous version does not address the root cause; the same adversarial inputs would still be effective against the older model, and the attack vector remains unmitigated.

Why this answer

How to eliminate wrong answers

Option A is wrong because ISO 27001 certification pertains to information security management systems, not to AI-specific risk or bias compliance under the EU AI Act; the Act does not require ISO 27001 certification for high-risk AI systems. Option B is wrong because the EU AI Act does not mandate public disclosure of source code; doing so could violate trade secrets and intellectual property rights, and transparency requirements are limited to documentation and logging, not open-source publication. Option C is wrong because registration with a national data protection authority is not a pre-deployment requirement for high-risk AI systems under the EU AI Act; instead, the Act requires registration in an EU-wide database managed by the European Commission, not individual national authorities.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because Accountability refers to the assignment of responsibility for the model's decisions and outcomes, not the presence of bias itself; while the bank must be accountable for the bias, the primary violation here is the discriminatory outcome. Option C is wrong because Transparency concerns the ability to explain and understand how the model makes decisions (e.g., through interpretability or documentation), but the core issue is the biased result, not a lack of explanation. Option D is wrong because Privacy involves the protection of personal data and compliance with regulations like GDPR or CCPA; the scenario does not describe unauthorized data use or exposure, only discriminatory lending decisions.

Why this answer

How to eliminate wrong answers

Option B is wrong because adding a static warning does not enforce any change in workflow or guarantee that radiologists will actually catch missed rare conditions; it merely shifts liability without reducing the risk of false negatives. Option C is wrong because requiring all AI predictions to be reviewed by a radiologist before final diagnosis would be prohibitively expensive and slow, defeating the purpose of using AI to improve throughput and contradicting the limited IT budget constraint. Option D is wrong because increasing the false positive threshold would reduce false negatives but would also increase false positives, potentially overwhelming radiologists with unnecessary alerts and degrading trust in the system, while not addressing the core issue of overreliance on the AI's confidence.

Why this answer

How to eliminate wrong answers

Option A is wrong because retraining on a balanced dataset only addresses representation bias (e.g., equal numbers of approved/rejected loans across groups) but does not remove the underlying biased correlations learned from historical lending practices; it may also reduce model performance by discarding real-world data distributions. Option B is wrong because removing all protected attributes does not eliminate bias—correlated features (e.g., zip code, income) can act as proxies for race or gender, leading to indirect discrimination, and the ethics committee explicitly wants to keep protected attributes. Option C is wrong because post-processing adjusts outputs after the model is trained, which can improve demographic parity but often at the cost of significant accuracy loss and does not address bias embedded in the model's internal representations.

Why this answer

How to eliminate wrong answers

Option A is wrong because ChurnPredict v1 uses a gradient-boosted decision tree (XGBoost) with built-in feature importance and SHAP support, satisfying the policy's interpretability requirement. Option B is wrong because FraudDetect v4 employs a logistic regression model with L1 regularization, which is inherently interpretable through coefficient analysis and passes the transparency audit. Option D is wrong because LoanApproval v3 is a rule-based system using a decision tree with a maximum depth of 5, providing full traceability and meeting the policy's compliance criteria.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because specifying the exact training algorithm and hyperparameters is a detail of model development documentation, not the primary purpose of a model card, which focuses on high-level transparency for governance and end-users. Option C is wrong because a complete risk assessment framework is a broader governance artifact (e.g., an AI risk register) that may reference model cards but is not the primary purpose of the card itself. Option D is wrong because a model card is not a legal contract; it is a technical documentation tool for transparency, and legal agreements are separate documents governed by terms of service or licensing.

Why this answer

How to eliminate wrong answers

Option A is wrong because replacing convolutional layers with transformer layers would require significant architectural changes and likely full retraining, not a lightweight fix, and transformers are not inherently more robust to low-light conditions without specific training. Option C is wrong because adversarial training focuses on imperceptible perturbations that cause misclassification, which is a different problem (adversarial attacks) than natural low-light degradation; it does not simulate the global brightness reduction or noise patterns of low-light environments. Option D is wrong because increasing model depth by adding more convolutional layers does not address the specific data distribution shift (low-light) and may lead to overfitting or vanishing gradients without corresponding training data changes.

Why this answer

How to eliminate wrong answers

Option B is wrong because adversarial training is a proactive defense that makes models robust to future attacks, but it does not remove existing poisoned data; the current model is already compromised and needs immediate cleanup first. Option C is wrong because decreasing retraining frequency would actually prolong exposure to the poisoned data, allowing the attack to continue influencing recommendations for longer. Option D is wrong because differential privacy adds noise to protect individual privacy, not to correct injected profiles; it would not remove the fake clicks and could degrade model accuracy without addressing the attack.

Why this answer

How to eliminate wrong answers

Option A is wrong because `enable_input_sanitization = true` would actually help prevent input manipulation by cleaning or validating inputs, so enabling it reduces vulnerability, not causes it. Option B is wrong because `audit_level = basic` controls the granularity of logging and monitoring, not the security posture against adversarial inputs; it affects visibility, not defense. Option D is wrong because `pii_detection = enabled` focuses on identifying personally identifiable information for compliance, not on defending against adversarial perturbations that cause misclassification.

Why this answer

How to eliminate wrong answers

Option B (Model versioning) is wrong because it refers to tracking and managing different iterations of a model for reproducibility and rollback, not to providing explanations to end-users about specific decisions. Option C (Differential privacy) is wrong because it is a technique for adding noise to data to protect individual privacy during training, not a mechanism for explaining or justifying individual automated decisions. Option D (Data minimization) is wrong because it is a principle of collecting only the necessary data for a task, which relates to privacy and storage, not to the transparency or contestability of automated decisions.

Why this answer

How to eliminate wrong answers

Option A is wrong because merely increasing training data diversity does not guarantee fairness; the model can still learn biased correlations from the data or amplify existing societal biases, and without fairness metrics, there is no way to measure whether the outcome is equitable. Option C is wrong because retraining monthly with the latest transaction data addresses model drift and concept drift, not bias; bias can persist or even worsen with new data if the underlying data generation process remains biased. Option D is wrong because SHAP values provide local interpretability for individual predictions but do not measure or mitigate systemic bias across groups; they explain why a specific decision was made, not whether the model treats groups fairly overall.

Why this answer

How to eliminate wrong answers

Option A is wrong because data drift refers to changes in the distribution of input features (e.g., transaction amounts shift higher), which would affect recall or overall accuracy but not specifically precision in a steady decline pattern. Option C is wrong because model overfitting would cause poor generalization from the start, not a gradual decline over two months after deployment. Option D is wrong because an adversarial attack typically causes sudden, targeted performance drops or specific misclassifications, not a steady, broad decline in precision over time.

Why this answer

How to eliminate wrong answers

Option A is wrong because data poisoning attacks involve corrupting the training data (e.g., injecting malicious samples) to manipulate the model's learned behavior, not perturbing inputs at inference time. Option B is wrong because model extraction attacks aim to steal a model's architecture or parameters by querying it (e.g., via API calls), not by modifying inputs to cause misclassification. Option D is wrong because membership inference attacks determine whether a specific data point was used in the model's training set, not by perturbing inputs to cause misclassification.

Why this answer

How to eliminate wrong answers

Option B is wrong because Privacy focuses on protecting personal data and controlling its collection, use, and sharing, not on making AI decisions traceable or understandable. Option C is wrong because Robustness concerns the system's ability to maintain performance under adversarial conditions or unexpected inputs, not the traceability of its decision-making process. Option D is wrong because Accountability refers to assigning responsibility for AI outcomes and ensuring there are mechanisms for redress, but it does not inherently require that the decision-making process itself be transparent or understandable.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because transparency refers to the openness and explainability of AI decisions, not the presence of biased outcomes; a model can be fully transparent yet still unfair. Option B is wrong because privacy concerns the protection of personal data and consent, not the equitable treatment of groups in decision-making. Option C is wrong because accountability involves assigning responsibility for AI outcomes, but the core ethical breach here is the biased result itself, not the lack of a responsible party.

Why this answer

How to eliminate wrong answers

Option A is wrong because applying a fairness constraint that penalizes the model for disparate impact is a post-hoc regularization technique that can reduce approval rates overall and may not comply with fair lending laws if it introduces reverse discrimination or violates the business requirement of not significantly reducing overall approval rates. Option B is wrong because discontinuing the AI model and using manual approval for all loans is an extreme measure that abandons automation entirely, likely increasing operational costs and introducing human bias, which does not meet the goal of compliance without significantly reducing approval rates. Option D is wrong because adjusting the approval threshold to equalize approval rates across ethnic groups is a simplistic, outcome-based fix that does not address underlying bias in the model's learned representations; it can lead to inconsistent decisions for similar applicants and may violate the principle of individual fairness under fair lending laws.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because data poisoning involves injecting malicious data into the training set to corrupt the model's behavior, which would typically cause systematic errors across many inputs rather than selectively high confidence for some individuals. Option B is wrong because an evasion attack (adversarial example) manipulates input data to cause misclassification, but it does not explain the high confidence scores for certain individuals; evasion attacks usually reduce confidence or cause incorrect labels. Option D is wrong because model extraction aims to duplicate the model's functionality by querying it and training a substitute, not to reveal training data or cause confidence anomalies for specific individuals.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because data poisoning involves injecting malicious data into the training set to corrupt the model's learning, not causing misclassification of benign traffic at inference time. Option B is wrong because model inversion attacks aim to reconstruct private training data from the model's outputs, not to cause misclassification of specific inputs. Option D is wrong because membership inference attacks determine whether a specific data point was used in training, not to cause the model to misclassify benign traffic as malicious.

Why this answer

How to eliminate wrong answers

Option A is wrong because adding a confidence score disclaimer does not fix the underlying algorithmic bias; it merely informs users of potential inaccuracy without correcting the model's systematic error. Option B is wrong because reducing the sample size of non-native English speakers would exacerbate the bias by further underrepresenting that group, violating the ethical principle of fairness and likely increasing model variance. Option C is wrong because continuing to use a model with known demographic bias, even if overall accuracy is acceptable, violates the AI ethics principle of non-maleficence and could lead to harmful disparities in patient care.

Why this answer

How to eliminate wrong answers

Option A is wrong because encrypting training data at rest protects confidentiality and integrity during storage, but it does not prevent malicious data from being ingested into the training set; data poisoning occurs before encryption is applied. Option B is wrong because deploying an anomaly detection system on model outputs is a reactive measure that detects poisoning after the model has already been compromised, rather than preventing the attack. Option C is wrong because retraining with a smaller, curated dataset may reduce the impact of poisoning but does not address the underlying vulnerability that allowed poisoned data to enter the system; it is a recovery step, not a first-line mitigation.

Why this answer

Why this answer

How to eliminate wrong answers

Option B (Alice) is wrong because Alice is the project manager who requested the model deployment, but she did not perform the actual deployment action; the audit log shows she only submitted the request. Option C (Carol) is wrong because Carol is the ethics officer who approved the model earlier, but the audit log indicates she did not approve this specific deployment; the failure is that Bob bypassed the required approval step. Option D (System) is wrong because the system is an automated deployment pipeline that executed Bob's command; it has no agency or responsibility for compliance decisions, and the governance policy assigns accountability to human actors.

Why this answer

How to eliminate wrong answers

Option A is wrong because SMOTE rebalances the training data by oversampling the minority class, but retraining the entire gradient boosted tree model from scratch is resource-intensive and contradicts the constraint of limited resources; moreover, SMOTE may introduce synthetic noise that degrades model performance. Option B is wrong because adversarial debiasing is a training-time technique that requires modifying the model architecture and retraining, which is not feasible given the limited resources and the fact that the model is already deployed; it also does not directly address the false negative rate disparity without full retraining. Option D is wrong because replacing the model with a simpler logistic regression model would require retraining and likely reduce predictive performance, especially for complex interactions in patient vitals and symptoms, and does not guarantee bias reduction; interpretability alone does not correct the existing bias.

Why this answer

Why this answer

How to eliminate wrong answers

Option B (Privacy by design) is wrong because the complaint is about price disparity and lack of understanding, not about how customer data is collected, stored, or protected. Option C (Accountability) is wrong because while accountability is important for assigning responsibility, it does not directly solve the customer's need to understand why the price differs; it focuses on who is responsible rather than making the algorithm's logic visible. Option D (Beneficence) is wrong because beneficence refers to doing good or maximizing benefits, but the immediate ethical failure here is the lack of clarity and justification for the pricing decision, not the absence of overall positive outcomes.

Why this answer

How to eliminate wrong answers

Option A is wrong because data poisoning attacks involve injecting malicious data to corrupt model behavior, which DP-SGD does not specifically prevent—it only limits per-example influence but does not detect or filter poisoned inputs. Option C is wrong because adversarial patch attacks target image classifiers by placing physical patches on objects to cause misclassification, which is a computer vision robustness issue unrelated to the privacy guarantees of DP-SGD. Option D is wrong because model inversion attacks aim to reconstruct training data features or attributes from the model, and while DP-SGD provides some defense, its primary and most direct mitigation is against membership inference, not full inversion which requires stronger assumptions and additional techniques.

Why this answer

How to eliminate wrong answers

Option A is wrong because ignoring regulatory requirements is not a viable option for a financial institution; it would lead to non-compliance and potential penalties. Option B is wrong because asking the vendor to develop a custom explanation module would require the vendor to modify their proprietary algorithm, which they have stated is a 'black box' and cannot provide explanations, making this request impractical and likely impossible. Option C is wrong because replacing the model with a simpler, interpretable model would sacrifice the predictive performance that the current model provides, which may be critical for accurate credit risk assessment.

Why this answer

How to eliminate wrong answers

Option A is wrong because ISO/IEC 27001 is an international standard for information security management systems (ISMS), not an AI-specific risk management framework, and it focuses on general data security rather than AI risks. Option B is wrong because COBIT (Control Objectives for Information and Related Technologies) is a framework for IT governance and management, developed by ISACA, and does not address AI-specific risks or the NIST AI RMF. Option D is wrong because GDPR (General Data Protection Regulation) is a European Union regulation for data privacy and protection, not a risk management framework, and it is not designed by NIST.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a supply chain attack involves compromising hardware or software during the manufacturing or distribution process, not manipulating physical inputs after deployment. Option B is wrong because a model inversion attack aims to reconstruct private training data from model outputs, not to cause misclassification of inputs. Option D is wrong because data poisoning attacks corrupt the training dataset to influence the model's learned behavior, whereas the sticker is applied to a real-world input at inference time, not during training.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because deleting the training data is a destructive action that may destroy forensic evidence needed to understand why the model misbehaved; it also does not stop the chatbot from generating offensive responses in the meantime. Option C is wrong because rolling back to a previous model version assumes the issue is in the model weights, but the offensive behavior could stem from the data update itself or a configuration change, and rolling back might reintroduce other vulnerabilities or not address the root cause. Option D is wrong because adding a content filter is a reactive, post-hoc mitigation that does not stop the ongoing generation of offensive responses; filters can be bypassed and do not address the underlying model or data corruption.

Why this answer

How to eliminate wrong answers

Option A is wrong because ignoring the disparity violates ethical AI principles and regulatory requirements (e.g., HIPAA, FDA guidelines for clinical AI), and overall accuracy can mask significant subgroup performance drops that lead to misdiagnosis. Option B is wrong because simply adding more data from the underperforming group does not guarantee removal of spurious correlations or biased representations; it may even amplify existing biases if the data contains systematic label noise or confounding variables. Option D is wrong because removing demographic attributes (often called 'fairness through unawareness') is ineffective, as proxy variables (e.g., ZIP code, socioeconomic indicators) can still encode the protected attribute, and the model may learn biased correlations from remaining features.

Why this answer

How to eliminate wrong answers

Option A is wrong because differential privacy is a technique for protecting individual data points by adding noise to queries or training data, not for generating explanations for decisions; it addresses privacy compliance, not explainability. Option C is wrong because bias audits detect and measure unfairness or discrimination in model outcomes, but they do not provide per-decision explanations required by the regulation; they focus on fairness, not transparency. Option D is wrong because establishing an AI ethics board provides high-level governance and policy oversight, but it does not directly implement the technical capability to produce explanations for individual automated decisions, which is the core regulatory requirement.

Why this answer

How to eliminate wrong answers

Option A is wrong because reinforcement learning with fairness constraints focuses on optimizing a reward signal over time, which is not designed for static, explainable decision-making in hiring; it also introduces complexity that undermines the goal of straightforward explainability. Option C is wrong because using a black-box deep learning model with SHAP explanations still relies on post-hoc approximations that can be inaccurate or misleading, and SHAP values do not guarantee that the model's internal logic is free from bias—they only approximate feature contributions. Option D is wrong because ensemble methods with feature importance (e.g., random forest) provide only global importance scores that can be unstable and do not offer per-decision transparency; they also fail to reveal how features interact in a specific hiring outcome.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because using open-source models only does not inherently ensure GDPR compliance; open-source models can still process excessive personal data or lack proper anonymization, and licensing terms do not substitute for regulatory adherence. Option B is wrong because regular vulnerability scans address security vulnerabilities (e.g., CVE patching) but do not enforce data minimization, purpose limitation, or anonymization required by GDPR; they are a security practice, not a privacy governance practice. Option D is wrong because hiring more data scientists does not guarantee compliance; without implementing specific technical controls like anonymization or data minimization, additional personnel cannot mitigate systemic privacy risks or meet GDPR's accountability requirements.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because retraining on a larger dataset does not address the root cause of prompt injection; the model will still be vulnerable to crafted inputs that bypass its instruction-following boundaries. Option B is wrong because encryption protects data in transit but does not inspect or filter the content of prompts, so it cannot prevent injection attacks. Option C is wrong because reducing the number of parameters degrades model performance and does not mitigate injection; the attack exploits input handling, not model capacity.

Why this answer

How to eliminate wrong answers

Option A is wrong because data poisoning involves injecting malicious samples into the training dataset to corrupt the model's learning process, which would manifest as a gradual degradation in model accuracy over time, not as a sudden burst of multiple alerts during inference. Option B is wrong because a network hardware failure would typically cause connectivity issues, latency spikes, or packet loss, not specific, targeted misclassifications in an AI model's output. Option D is wrong because a scheduled model retraining process is a planned maintenance activity that updates the model with new data, which would not generate alerts unless the retraining itself introduces errors, but the scenario describes multiple alerts from the monitoring log, not a retraining event.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because random selection of candidates would destroy the model's predictive accuracy entirely, as it ignores all qualifications and job-relevant features, which is not a valid remediation technique. Option C is wrong because simply removing the gender feature does not eliminate bias; the model can still learn gender proxies from correlated features such as years of experience, education, or job titles, leading to indirect discrimination. Option D is wrong because collecting more data from underrepresented groups may improve representation but does not guarantee removal of existing bias in the model's decision boundary; it can even introduce new imbalances if not handled carefully, and it does not actively debias the training process.

Why this answer

How to eliminate wrong answers

Option B is wrong because apologizing and offering a manual review is a reactive customer service response that does not address the root cause of the bias in the model; it fails to assess or remediate the systemic issue. Option C is wrong because immediately removing age from the feature set and retraining the model is a hasty action that could mask the problem without understanding whether age is a proxy for other correlated features (e.g., years of experience), potentially leading to unintended discrimination or model degradation. Option D is wrong because ignoring the complaint outright violates ethical AI principles and regulatory requirements (such as EEOC guidelines), and age is not a legitimate business requirement for resume screening unless it is a bona fide occupational qualification, which is rarely the case.

Why this answer

How to eliminate wrong answers

Option B is wrong because a model inversion attack reconstructs training data from model outputs, not by manipulating prompts, and its mitigation (differential privacy) does not address prompt-level manipulation. Option C is wrong because data poisoning involves corrupting the training data to influence model behavior, not exploiting the model at inference time via prompts, and strict access controls are a general security measure, not a direct mitigation for prompt injection. Option D is wrong because a membership inference attack determines if a specific record was used in training, not by tricking the model with prompts, and adding noise to outputs is a privacy technique, not a defense against prompt injection.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because explainable AI (XAI) techniques, such as SHAP or LIME, provide post-hoc interpretability of model decisions but do not prevent the generation of privacy-violating responses; they only help diagnose why a violation occurred after the fact. Option B is wrong because encrypting chatbot conversations at rest (e.g., using AES-256) and in transit (e.g., using TLS 1.3) protects data from external interception but does not control the content generated by the chatbot itself, which is the source of the privacy risk. Option D is wrong because anonymizing training data (e.g., via k-anonymity or differential privacy) reduces the risk of the model memorizing PII, but it does not prevent the chatbot from generating new responses that violate privacy regulations through inference or context-based leakage during inference.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a deployment pipeline bug would typically cause functional failures (e.g., model not loading, incorrect API calls) or output errors, not the generation of offensive language that is contextually coherent. Option B is wrong because overfitting to rare examples would cause the model to memorize specific training instances, leading to exact or near-exact reproductions of those rare inputs, not the generation of novel offensive language that was not present in the training data. Option D is wrong because data poisoning requires an attacker to deliberately inject malicious samples into the training set, which would likely leave traces of explicit offensive content; the scenario states no explicit offensive content was found, making this less likely than the model learning implicit biases from the existing corpus.

Why this answer

How to eliminate wrong answers

Option A is wrong because differential privacy does not primarily target bias reduction; it addresses privacy, and increased training time is a secondary implementation cost, not the primary trade-off. Option B is wrong because differential privacy does not inherently lower interpretability or increase fairness; it may even reduce fairness if noise disproportionately affects minority subgroups, and interpretability is a separate concern. Option C is wrong because differential privacy does not improve inference speed or reduce memory usage; it typically adds computational overhead during training and does not affect inference latency or memory footprint.

Why this answer

How to eliminate wrong answers

Option A is wrong because model complexity does not inherently cause bias; a complex model may overfit but that does not explain persistent gender bias after removing the gender feature. Option C is wrong because while historical hiring bias in training data can contribute to bias, the question states the bias persists after retraining, implying the root cause is not simply the data but the model's use of proxy features that encode the same bias. Option D is wrong because the evaluation metric not measuring fairness is a detection issue, not the root cause of the bias persisting; the bias would still exist even if a fairness metric were used.

Why this answer

How to eliminate wrong answers

Option A is wrong because switching to unsupervised anomaly detection does not inherently defend against adversarial evasion; it may still be fooled by subtly modified patterns and often increases false positives due to lack of labeled threat data. Option B is wrong because simplifying to logistic regression reduces model capacity, making it less able to learn complex threat patterns and more susceptible to evasion, not less. Option D is wrong because adding random noise to input data degrades signal quality, increasing both false positives and false negatives, and does not target the specific evasion patterns used by the hacker group.

Why this answer

How to eliminate wrong answers

Option A is wrong because membership inference only determines whether a specific data point was part of the training set, not extract the actual data. Option C is wrong because adversarial examples involve crafting inputs to cause misclassification, not extracting training data. Option D is wrong because data poisoning involves corrupting the training data to manipulate model behavior, not extracting existing training data.