P5 · 8 questions

Governance, Safety & Risk Management — Attempt 2

CCAR-P P5 practice. Some items are “select all that apply” — they tell you how many to pick and are graded all-or-nothing. Commit before revealing, then read every explanation.

0 of 8 answered

P5 · Q1PII/PHI redaction and retention
A chatbot logs full conversation transcripts, which frequently contain customer SSNs and card numbers, to a general analytics store kept for two years. Which control most appropriately reduces data risk?
P5 · Q2Human oversight for irreversible actions
An ops agent can delete cloud resources to save cost. Which design most appropriately governs this capability?
P5 · Q3Regulated deployment (BAA, data residency, audit trails)
A US healthcare provider wants to use a hosted LLM to summarize patient notes. All of the following sound reasonable; which is the disqualifying requirement that must be satisfied before any PHI is sent?
P5 · Q4Model/prompt change management and rollback
A prompt tweak that improved a demo is pushed straight to production, and complaint volume spikes. Which practice would most appropriately have contained this?
P5 · Q5Must-hold rules in deterministic code
A trading assistant must never place an order that exceeds a client's regulatory position limit. Engineers propose several ways to enforce it. Which is the most defensible?
P5 · Q6Guardrails: input and output filteringSelect 2
A public assistant needs layered guardrails. Which two statements correctly describe how input and output filtering should be positioned?
P5 · Q7Data-egress controlsSelect 2
An internal agent has web-browsing and file-read tools and handles confidential documents. Which two controls best prevent unintended data egress?
P5 · Q8Signal triage checkpointSort each into a bucket
Route each production signal to the most appropriate destination.
A slow, steady rise in average tool-latency that is still within SLO
A guardrail failing open under load, letting unfiltered outputs through
A newly enacted regulation that changes the retention obligation for stored transcripts
A single 200-OK health-check ping logged every minute as expected
Injection attempts spiking against the input filter, all currently blocked

More P5 attempts