hardMultiple Choice
Generative AI Leader Practice Question: An enterprise deploys a generative AI chatbot…
An enterprise deploys a generative AI chatbot that must comply with GDPR right to deletion. Users can request deletion of their personal data. The chatbot uses a RAG pipeline with a vector database. What is the MOST effective way to handle deletion requests?
⚠ Common exam trap
Generative AI Leader often tests the misconception that filtering outputs or anonymizing index entries satisfies deletion — the trap is confusing runtime privacy controls with actual data erasure across all derived stores.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Delete the user's documents from the vector index and original storage, then rebuild the index
GDPR Article 17 (right to erasure) requires that personal data be deleted from all systems where it is stored, including derived stores like vector indexes. In a RAG pipeline, the user's documents exist both in original storage and as embeddings in the vector database, so the compliant approach is to delete from both and rebuild or re-index the affected vectors. Simply filtering responses or anonymizing records leaves the personal data recoverable and does not satisfy erasure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Delete the user's documents from the vector index and original storage, then rebuild the index
Why this is correct
Rebuilding the index after removing the user's documents guarantees no residual embeddings remain, satisfying GDPR erasure. Simply deleting source files leaves vectors containing personal data still queryable, so full index reconstruction is the only method that reliably eliminates every trace.
- ✗
Update the user's records in the vector index with anonymized placeholders
Why it's wrong here
Anonymised placeholders leave the original personal data embedded in the vector store, so the GDPR erasure obligation remains unmet. This approach suits retaining analytical value where identifiers are stripped but records must persist. Deletion requires removing the affected vectors and their source documents from the index entirely.
- ✗
Add a filter to the chat application to block the user's name from appearing in responses
Why it's wrong here
Filtering the name from responses leaves the personal data stored in the vector database and embeddings, so the deletion obligation is unmet. It is tempting because it is a quick application-layer change. Deleting or re-indexing the affected vectors is correct; output filtering suits preventing disclosure, not erasure.
- ✗
Retrain the LLM from scratch without the user's data
Why it's wrong here
Retraining the base model does not remove the user's data from the vector database, which is where the RAG pipeline stores it, and is disproportionate. It is tempting because it sounds thorough. Deleting the user's vectors and embeddings is correct; retraining suits correcting model behaviour, not fulfilling erasure requests.
About these practice questions
One of 1,008 original Generative AI Leader practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Google Cloud exam blueprint
This Generative AI Leader practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the Generative AI Leader exam.