Responsible and secure AI

An organisation is preparing to publish an open-source machine learning model. To help downstream users understand the model's intended uses, limitations, and known biases, which artefact should they produce?

• AA data dictionary listing every feature in the training dataset
• BA model card documenting intended use cases, performance metrics, and known limitationscheck_circle Correct
• CA deployment runbook describing the infrastructure required to serve the model
• DA README file listing the Python package dependencies and installation steps

Why A is wrong: A data dictionary describes features but does not communicate intended use, limitations, performance across subgroups, or ethical considerations - the core content of a model card.

Why B is correct: A model card is the standardised responsible AI artefact specifically designed to disclose a model's purpose, evaluation results, fairness considerations, and constraints so users can make informed deployment decisions.

Why C is wrong: A deployment runbook covers operational setup, not model behaviour or ethical considerations. It addresses how to run the model, not whether or how it should be used.

Why D is wrong: Installation documentation helps users set up the software but contains none of the bias, fairness, or intended-use information that responsible AI disclosure requires.

A data science team notices that a credit-scoring model approves loans at a significantly lower rate for one demographic group compared to all others, even though that group has similar repayment histories. Which practice most directly addresses this disparity during model development?

• AEvaluating disaggregated fairness metrics across demographic subgroups and retraining with corrected data or constraintscheck_circle Correct
• BIncreasing the model's overall accuracy on the full training dataset
• CDeploying the model behind an API so that end users cannot inspect its decision logic
• DRemoving all demographic attributes from the training features before the initial model fit

Why A is correct: Disaggregated evaluation exposes differential performance per subgroup, allowing targeted mitigation such as re-sampling, re-weighting, or fairness constraints during retraining.

Why B is wrong: Tempting because higher accuracy sounds like a better model, but aggregate accuracy can improve while bias against a subgroup worsens if that group is a small fraction of the dataset.

Why C is wrong: Hiding decision logic via an API does nothing to correct the underlying bias; it only reduces transparency, which compounds responsible AI concerns.

Why D is wrong: Removing protected attributes is a common first step but does not eliminate bias because correlated proxy features (postcode, occupation) can still encode demographic information.

A company deploys a customer-facing chatbot backed by a large language model. An attacker crafts a message that instructs the model to ignore its system prompt and reveal internal configuration details. Which control most directly prevents this class of attack?

• AEnable TLS encryption for all traffic between the client and the model endpoint.
• BRestrict the model's IAM role to read-only permissions on all AWS services.
• CIncrease the model temperature to introduce randomness and reduce deterministic responses to adversarial prompts.
• DApply input validation and prompt sanitisation to strip or neutralise adversarial instructions before they reach the model.check_circle Correct

Why A is wrong: TLS protects data in transit but does nothing to prevent malicious instructions embedded in the model input from overriding system behaviour. The attack exploits the model's instruction-following, not network interception.

Why B is wrong: Least-privilege IAM limits downstream blast radius if the model calls AWS APIs, but does not prevent the model from responding to injected instructions with information it already holds in context. The attack succeeds before any IAM call is made.

Why C is wrong: Higher temperature makes outputs less predictable but does not block the model from following injected instructions; it may simply produce a slightly different but still harmful response. Temperature is a generation parameter, not a security control.

Why D is correct: Prompt injection attacks rely on the model treating user-supplied text as trusted instructions. Sanitising and validating inputs - removing delimiter tokens, detecting instruction-override patterns - removes the attack vector at its origin.

A bank runs a credit-decision model in a regulated market. An auditor asks the team to show, for any individual decision made last quarter, exactly which dataset version, feature transformations, and model artefact produced it. The team can name the current model but cannot reconstruct which inputs and version were live on a given past date. Which governance capability is the team missing?

• AReal-time inference monitoring that tracks latency and request volume for the production endpoint
• BA bias-detection report that measures approval-rate disparities across customer demographic groups
• CData lineage and traceability that links each prediction to its dataset version, transformations, and model versioncheck_circle Correct
• DAn access-control policy that restricts who can invoke the credit-decision model in production

Why A is wrong: Inference monitoring captures operational health such as throughput and latency, which is useful but does not record which data version or artefact produced a historical decision, so it cannot satisfy the auditor's reconstruction request.

Why B is wrong: Bias detection addresses fairness across groups and is part of responsible AI, but it does not trace an individual decision back to its specific data version and artefact, so it answers a different governance question.

Why C is correct: Lineage and traceability record the chain from source data through transformations to the specific model artefact, letting the team reconstruct exactly which inputs and version produced any past decision, which is what the auditor demands.

Why D is wrong: Access control governs who may call the model and is a sound security control, yet it stores no record of which data and version generated a particular historical decision, so it cannot reconstruct the audit trail.

A European retailer plans to run a generative AI customer-service assistant on AWS. Its data protection regulator requires that customer personal data processed by the assistant must be stored and processed only within the European Union. The team must choose how this requirement shapes the deployment. Which decision most directly satisfies this regulatory constraint?

• AEncrypt all customer data at rest with a customer-managed key so the regulator's residency expectation is met regardless of where the workload runs.
• BDeploy the assistant and its data stores in an AWS Region located within the European Union and restrict processing to that Region.check_circle Correct
• CEnable detailed request logging in AWS CloudTrail so every access to customer data is recorded for the regulator to inspect later.
• DApply a content guardrail that redacts personal data from model outputs before responses reach the customer.

Why A is wrong: Encryption with a customer-managed key protects confidentiality and supports access control, but it does not control the physical location where data is stored or processed, so it does not satisfy a data-residency obligation.

Why B is correct: Data-residency rules are about geographic location, and selecting an in-region AWS Region with processing confined to it keeps the personal data inside the required jurisdiction, which is exactly what the regulator demands.

Why C is wrong: Audit logging creates a record of access and supports accountability, but recording where data went after the fact does not keep the data inside the required jurisdiction, which is the actual obligation here.

Why D is wrong: Output redaction reduces the leakage of personal data into responses, but the underlying data is still stored and processed somewhere, so it does not address where processing physically occurs as residency law requires.