CCNA Gcl Responsible Ai Governance Questions

Option B is correct because providing a numerical confidence score between 0 and 1 for each conclusion directly quantifies the model's certainty, enabling users to assess the reliability of each legal analysis. This approach maximizes transparency by allowing legal professionals to calibrate their trust in the AI's output, which is critical for high-stakes contract review where false positives or negatives carry significant risk.

Option C is correct because Google's safety filters in Vertex AI provide built-in, configurable protections against hate speech, violence, and sexual content, directly addressing content safety requirements for generative AI outputs. These filters are part of Google's Responsible AI toolkit and can be enabled at the model deployment level to automatically block harmful content without requiring custom development.

GDPR requires explicit consent for processing personal data, making consent mechanisms a core requirement.

SynthID is Google DeepMind's technology for embedding invisible watermarks into AI-generated images, audio, text, and video, enabling identification of synthetic content.

Grounding (A) provides explainability through citations, data residency controls (C) ensure compliance with data location laws, and differential privacy (E) protects individual privacy during model training.

Google's safety filters in Vertex AI are specifically designed to block harmful content such as hate speech and violence by evaluating model inputs and outputs against predefined safety categories. These filters operate at the API level, allowing developers to configure thresholds for blocking sensitive content, making them the direct solution for the startup's requirement to prevent AI-generated hate speech or violence.

GDPR requires a lawful basis for processing personal data, such as user consent, and the right to erasure (right to be forgotten). Data subjects must be able to request deletion of their data.

Maintaining clear documentation of training data provenance and licensing is crucial for IP compliance, as recommended by Google's AI governance.

Option A is correct because it is the exact wording of one of Google's seven AI Principles, which explicitly states the commitment to 'avoid creating or reinforcing unfair bias.' This principle directly addresses the need to mitigate bias in AI systems, such as ensuring training datasets are representative and algorithms do not perpetuate historical inequities. It is a foundational directive for responsible AI development, distinct from broader accountability, safety, or privacy concerns.

To measure bias, the test set should include prompts that are neutral in gender but may elicit biased responses. The correct approach is to analyze the gender of pronouns, roles, or descriptors in the model's completions.

Google's AI Principles include incorporating privacy design principles. The best practice is to de-identify the training data by removing or masking PII before fine-tuning, reducing privacy risk.

SynthID is an invisible watermarking tool for AI-generated content, enabling identification of synthetic images, audio, text, or video without altering the user experience.

Google's safety filters are designed to block harmful content categories, including hate speech, and can be applied at inference time without retraining the model.

Option B is correct because grounding by referencing source documents in the output directly ties the generated statistics to verifiable original sources, ensuring citation accuracy. This technique retrieves and cites specific passages from trusted documents, which is essential for responsible AI in marketing copy where factual claims must be traceable.

Option B is correct because Google's AI Principle of being accountable to people requires that AI systems remain under human control, especially in high-stakes domains like healthcare. A human override mechanism ensures that clinicians can reject AI suggestions that are not widely accepted, directly addressing the principle's emphasis on human oversight and responsibility for outcomes.

Option D is correct because it directly addresses explainability by providing confidence scores, which quantify the model's certainty, and accountability by including disclaimers about system limitations. This aligns with responsible AI principles that require transparency in automated decision-making, especially in high-stakes domains like visa processing where users must understand the system's reliability and potential biases.

Human oversight, risk management, and transparency are key regulatory requirements for high-risk AI systems.

Under GDPR, processing personal data requires a lawful basis; explicit consent is essential when no other basis (e.g., legitimate interest) clearly applies, especially for fine-tuning where data is used to train a model that may memorize and regenerate personal information. Without consent, the processing is unlawful, exposing the team to significant fines and regulatory action. This is a foundational requirement that overrides technical measures like storage location or documentation.

Option A is correct because in high-stakes domains like legal contract summarization, the AI output must be validated by a qualified human expert before use. This ensures accountability and mitigates risks of hallucinated clauses or misinterpretations that could lead to legal liability. A confidence score or automated flagging alone is insufficient because even high-confidence outputs can contain subtle errors that only a trained lawyer can catch.

Grounding (citing sources) is the best technique because it directly links each generated output to specific, verifiable source documents or data points. This ensures traceability, which is critical for regulated financial advice where every claim must be attributable to a known reference, such as a regulatory filing or market data feed.

Chain-of-thought reasoning provides step-by-step explanations of how the model arrived at its conclusion, enhancing transparency.

Grounding allows the model to cite sources, improving explainability and trustworthiness by connecting outputs to verifiable information.

Option A is correct because copyright issues arise from the training data and the model's license. The training data provenance determines if the model was trained on copyrighted works without permission, and the license terms specify whether commercial use is allowed. Without checking both, the company risks infringing on original creators' rights.

Option D is correct because Google's pre-built safety filters in Vertex AI are specifically designed for content moderation tasks like hate speech, violence, and sexual content detection. They are immediately available, require no custom training, and integrate directly with Vertex AI's generative AI workflows, making them the most efficient choice for a social media company needing rapid deployment.

Human oversight is a key requirement for high-stakes AI systems. Vertex AI Human-in-the-Loop (HITL) provides a managed workflow to route predictions for human review, approval, or override before final output.

Model Cards document model details, Datasheets for Datasets document data, and the People + AI Guidebook provides best practices for communication. PAIR Explorables are for education, not documentation.

The primary risk is copyright infringement from training data. Verifying that the model's training data was properly licensed is essential before using outputs commercially.

Before attempting to fix bias, it is essential to evaluate the training data for representativeness. Bias often originates from imbalanced or unrepresentative training data.

Model Cards are designed to provide transparent documentation of model behavior, including intended use, performance, and limitations.

Option C is correct because the foundational legal risk in AI-generated imagery stems from the training data. If the model was trained on copyrighted works without permission, any output—even a novel image—can be considered a derivative work, exposing the company to infringement claims. Addressing the training data's compliance is the first and most critical step, as downstream mitigations (like watermarks or licenses) cannot retroactively fix an unlawfully trained model.

Under GDPR, users have the right to erasure (Article 17), which requires that their data be deleted upon request. For a generative AI chatbot fine-tuned on user data, this means the organization must have a mechanism to remove specific user data from the training dataset, as the model may have memorized that data. Option C directly addresses this right-to-deletion requirement, making it the mandatory practice.

Google's AI Principles require accountability and safety, especially in high-stakes domains like healthcare. Human oversight ensures that AI suggestions are reviewed by qualified professionals before action is taken.

The EU AI Act requires human oversight for high-risk AI systems, including the ability for humans to override or stop the system's decisions.

Vertex AI allows you to configure data residency controls that ensure prompts and responses are processed and stored within a specific geographic region, such as the European Union. This directly meets the requirement for EU customer data to remain within EU boundaries, as it leverages Google Cloud's regionalization capabilities for AI workloads.

Model Cards should disclose intended use, performance metrics, and known limitations to promote transparency and accountability.

Vertex AI's safety filters and adjustable safety settings are the built-in, most effective way to block harmful content. The other options are either insufficient or place undue burden on users.

Explainability in GenAI can be achieved by grounding outputs in verifiable sources and showing the reasoning process. Chain-of-thought reasoning provides step-by-step logic, making recommendations auditable.

Google's safety filters are designed to block harmful content categories. Vertex AI provides custom content controls to adjust thresholds. The other options are for different purposes.

Option B is correct because data minimization and purpose limitation are core requirements under both the EU AI Act (Article 10 on data governance) and Google's AI Principles (Privacy and Security). In generative AI, this means training and inference should use only the minimum necessary data, with clear constraints on how data is processed, to reduce privacy risks and comply with regulatory mandates.

Model Cards are designed to provide transparent documentation of ML models, including intended use, training data, and evaluation results.

Option D is correct because the first step in addressing model bias is to evaluate and measure the bias using a diverse, representative test set. This diagnostic step identifies the specific types and severity of gender stereotypes before any mitigation technique is applied, ensuring that subsequent interventions are targeted and effective. Without this evaluation, any corrective action risks being misapplied or introducing new biases.

Accountability means providing mechanisms for feedback and recourse when AI systems cause harm or make mistakes.

Providing human oversight for high-stakes decisions ensures accountability, aligning with Google's AI Principle that AI systems should be accountable to people.

Option B is correct because Google's privacy design principles require that user data used for fine-tuning must be obtained with explicit consent, ensuring transparency and user control. This aligns with the 'User Control and Transparency' principle, which mandates that users should be informed and give consent before their data is used to train or fine-tune models like those on Vertex AI.

SynthID is Google DeepMind's technology for embedding invisible watermarks into AI-generated images, audio, text, and video.

Human review for high-stakes decisions (C) ensures accountability, and providing model cards (E) ensures transparency about capabilities and limitations.

Under GDPR, using personal data for fine-tuning a generative AI model constitutes a new processing purpose that requires a lawful basis. Explicit consent (Article 7 and Article 9) is the most robust basis when relying on consent, as it must be freely given, specific, informed, and unambiguous. Without explicit consent, the company risks violating data minimization and purpose limitation principles, even if other anonymization or storage measures are applied.

The most likely cause is that the training data is not representative of diverse populations. Generative AI models learn patterns, correlations, and biases directly from their training data; if the data over-represents certain demographics or occupations in stereotypical roles, the model will reproduce those associations. This is a well-documented failure mode in NLP models, where biased training data leads to biased outputs even when prompts are neutral.

SynthID is designed to embed invisible watermarks into AI-generated content to help identify its origin.

Option B is correct because Vertex AI offers data residency controls that allow organizations to specify where data is stored and processed, ensuring EU user data remains within the EU to comply with GDPR's data localization requirements. This is achieved through configuration settings that restrict data processing to specific regions, such as europe-west4, preventing cross-border data transfers without adequate safeguards.

GDPR requires data residency/local processing (measures 1), explanation of AI decisions (right to explanation) (measure 3), and transparency about AI interaction (measure 5). The other options are not mandated by these regulations.

Reviewing the training data provenance and using models with appropriate licenses is critical. The other options either do not address the root cause or are insufficient.

Model Cards document model performance, intended use, and limitations. Datasheets for Datasets document dataset creation and composition. Both are part of the Responsible AI toolkit for transparency.

Evaluating bias with diverse test sets helps identify issues, and adjusting training data representativeness helps mitigate bias at the source.

The principle of avoiding creating or reinforcing unfair bias directly calls for evaluating and mitigating bias, including using diverse test sets.

SynthID is a Google DeepMind technology specifically designed to watermark and detect AI-generated text, images, audio, and video. It embeds an imperceptible digital watermark directly into the output of generative models, allowing for reliable detection even after modifications like cropping or compression. This makes it the correct tool for identifying potential misinformation from AI-generated text.

The People + AI Guidebook emphasizes setting appropriate expectations by clearly communicating what the AI can and cannot do.

Option D is correct because Google's AI Principles explicitly commit to building and testing AI systems for safety, including conducting rigorous safety testing and implementing appropriate safeguards to mitigate risks such as bias, misuse, and unintended harm. This commitment ensures that AI systems are designed to avoid creating or reinforcing unfair outcomes and to operate reliably under foreseeable conditions.

Option B is correct because the Responsible AI toolkit's Datasheet for Datasets framework requires documenting the demographic composition of data subjects to identify potential biases and ensure fairness. This transparency allows downstream users to assess whether the dataset may lead to discriminatory outcomes in generative AI models, aligning with responsible AI principles.

Retrieval-Augmented Generation (RAG) is the most appropriate approach because it allows the chatbot to answer questions based on the latest policy documents without retraining the underlying LLM. By indexing the documents in a vector store and retrieving relevant chunks at inference time, the system can incorporate monthly updates simply by re-indexing the new documents, making it cost-effective and scalable for frequently changing knowledge bases.

Differential privacy during training limits memorization by adding noise, making it much harder for the model to leak sensitive data from the training set.

The EU AI Act requires that high-risk AI systems maintain detailed technical documentation and logs for traceability and conformity assessment.

Option A is correct because Vertex AI allows you to enable logging of both prompts and responses for compliance auditing, while configuring a short retention period (e.g., 30 days) directly minimizes data retention. This balances regulatory requirements with data minimization principles, as Vertex AI's logging configuration supports setting retention policies via Cloud Logging or the Model Registry.

Google Cloud's Natural Language API includes content moderation models that can detect categories like hate speech, violence, and sexual content.

Evaluating bias with diverse test sets and ensuring representative training data are key steps to mitigate bias, as per Google's AI Principles.

Evaluating the model's decisions for disparate impact using protected attributes is a key step in detecting and mitigating unfair bias.

Option C is correct because auditing training data for demographic representativeness and evaluating the model using fairness metrics directly addresses the root causes of bias in generative AI systems. This practice aligns with Google's AI Principle of avoiding unfair bias by proactively identifying and mitigating imbalances in the data and measuring the model's performance across demographic groups using metrics like demographic parity or equal opportunity.

SynthID is Google DeepMind's tool for watermarking AI-generated content. The other options are unrelated.

Model Cards are the correct tool because they are specifically designed to document the intended use, performance metrics, and limitations of a machine learning model. This standardized documentation format, introduced by Google, provides transparency by detailing evaluation results across different conditions, intended use cases, and known biases, which is essential for responsible AI deployment.

Option B is correct because it directly implements the regulatory requirement for human-in-the-loop (HITL) oversight in high-stakes AI decisions. In financial advisory contexts, regulations like the EU AI Act or SEC guidelines mandate that a qualified human advisor must review and approve AI-generated recommendations before any action is taken, ensuring accountability and the ability to override erroneous outputs.

Option C is correct because data residency controls, such as those provided by cloud providers (e.g., AWS Organizations SCPs, Azure Policy, or GCP Organization Policies), allow the company to enforce that data is stored and processed only within specified geographic regions. This directly addresses strict data residency laws by preventing data from leaving the jurisdiction, which is a fundamental requirement for compliance with regulations like GDPR or Brazil's LGPD. Unlike workarounds, this approach provides native, auditable enforcement at the infrastructure level.

Grounding in generative AI means the model cites verifiable sources for its outputs, which is essential for explainability in domains like law.

Option C is correct because requiring a human clinician to review all AI-generated diagnoses before acting on them directly implements the human oversight mandate of Google's AI Principles (specifically the 'be accountable to people' principle) and the EU AI Act's requirement for high-risk AI systems to have meaningful human review. This ensures that the model's output is validated by a domain expert, mitigating risks of false positives or negatives that could harm patients.

The vendor must provide documentation (e.g., model cards, datasheets) to enable transparency and audit. Auditing the vendor's training data is not possible without cooperation. The other options are internal measures that do not address vendor transparency.

High-stakes medical decisions require human oversight (Principle: be accountable to people) and data privacy (Principle: incorporate privacy design principles). The other options are beneficial but not essential for compliance.