Generative AI Leader Practice Question: A global retailer uses a generative AI model to…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use a third-party logging service with data deletion policies

  Why it's wrong here

  A third-party logging service still records prompts and responses, so data is logged for improvement regardless of the vendor's deletion policy. Outsourcing is tempting because it shifts retention controls to a specialist, and would be correct where logging is allowed and the concern is only deletion enforcement.

• ✗

  Enable data logging for six months and then automatically delete

  Why it's wrong here

  Retaining prompts and responses for six months still logs them for model improvement, breaching the requirement that they not be logged at all. Time-limited retention is tempting because it limits exposure, and would be correct where logging is permitted but storage duration must be bounded by a retention schedule.

• ✓

  Disable prompt/response logging in Vertex AI endpoint settings

  Why this is correct

  Disabling prompt and response logging at the Vertex AI endpoint prevents customer data being stored for model improvement, directly satisfying GDPR data minimisation by ensuring personal data in prompts is not retained beyond serving the request.

• ✗

  Anonymize all customer data before logging

  Why it's wrong here

  Anonymisation still logs prompt and response content, merely stripped of identifiers, so data is retained for model improvement contrary to the no-logging requirement. It is tempting because anonymisation supports data minimisation generally, and would be correct where logging is permitted provided personal data is irreversibly removed.

Go deeper

Related to this question