- Which action would most directly address the primary ethical deficiency before the proposed analysis proceeds?
Answer: Obtain meaningful consent for the new purpose and limit the transferred variables to those demonstrably necessary.
When you encounter a question about data ethics, focus on two foundational principles: purpose limitation (data collected for one purpose shouldn't be repurposed without authorization) and informed consent (people must agree to how their data is actually used). This scenario is a textbook violation of both — customers consented to discounts and inventory management, not health-risk scoring sold to insurers.
B is correct because it directly repairs both deficiencies. Obtaining meaningful consent ensures customers knowingly agree to the new, sensitive purpose. Limiting transferred variables to only what's necessary applies data minimization, reducing harm and privacy exposure. Together, these steps make the proposed analysis ethically defensible before it begins.
A addresses security during data transfer, which is a worthwhile technical control — but encryption and access restrictions don't fix the fundamental problem that customers never agreed to this use. You can securely misuse data.
C is a classic trap. Replacing names with stable ID numbers is pseudonymization, not true anonymization. Detailed purchase histories (especially combined with insurance data) can still re-identify individuals. This cosmetic change leaves the consent violation completely intact.
D misreads the original agreement. Customers consented to personalized discounts and inventory improvement — not health profiling or sharing data with a third-party insurer for commercial resale. Stretching consent language to cover fundamentally different purposes is exactly what ethical frameworks prohibit.
Your study tip: when a question describes a repurposing of data, immediately ask "did the original consent cover this new use?" If not, no technical safeguard (encryption, pseudonymization) substitutes for obtaining proper consent first.
- Which change would best improve accountability without assuming that the bank must publish the vendor's full model?
Answer: Require actionable reason codes, input-correction procedures, audit access, and meaningful human authority to reconsider decisions.
When you see a question about AI-driven decisions in regulated industries, focus on the core pillars of accountability: explainability, correctability, auditability, and genuine human authority. The passage highlights a system where none of these exist — the vendor hides its logic, errors can't be corrected, and the loan officer's "click" is ceremonial rather than substantive.
Answer A is correct because it directly addresses every gap the passage identifies. Actionable reason codes give applicants and officers meaningful explanations. Input-correction procedures fix the problem of unresolvable data errors. Audit access lets regulators and the bank verify model behavior over time. Most importantly, meaningful human authority to reconsider decisions transforms the loan officer's role from rubber-stamp to genuine checkpoint — all without requiring the vendor to expose proprietary model internals.
Answer B is the most dangerous distractor because it describes exactly the flawed status quo and reframes it as adequate. A click that the officer cannot meaningfully exercise is not oversight — it's theatrical compliance. Regulators and frameworks like the EU AI Act specifically distinguish between nominal and substantive human review.
Answer C confuses portfolio-level accuracy with individual-level accountability. Strong aggregate metrics tell you nothing about whether a specific applicant was scored on bad data or deserves reconsideration. Individuals aren't averages.
Answer D assumes that model simplicity automatically equals accountability. Simpler models can still be ungoverned, unvalidated, and unexplained — transparency of structure doesn't substitute for process-level governance.
The key study tip: watch for questions where a procedural gesture (a click, a metric, a model swap) is presented as a substitute for substantive accountability mechanisms. Real accountability requires explainability, correction, oversight, and audit — together.
- Which conclusion is most accurate?
Answer: The dataset fails the policy; the two-record group must be suppressed or generalized, although compliance would not prevent every inference.
Whenever you see a question involving anonymization, think about k-anonymity: a dataset satisfies k-anonymity if every equivalence group (a cluster of records sharing the same quasi-identifier values) contains at least k records. The threshold applies universally — no exceptions.
Here, the company requires 3-anonymity, meaning every group must have ≥3 records. The groups contain 5, 4, 3, and 2 customers. Three of the four groups meet the threshold, but the two-record group does not. Because k-anonymity is only satisfied when all groups comply, the policy is violated. To fix this, the company must either suppress (remove) the two offending records or generalize the quasi-identifiers until that group merges with others and reaches size 3. Crucially, even after achieving compliance, an attacker who knows someone belongs to a small group can still make probabilistic inferences — so 3-anonymity limits, but does not eliminate, re-identification risk. This makes C the correct conclusion.
A is wrong because removing direct identifiers (names, account numbers) is only the first step. Quasi-identifiers — combinations like age band, city, and household size — can still re-identify individuals, which is exactly what k-anonymity addresses.
B commits a "majority rules" fallacy. K-anonymity is an all-or-nothing standard; if even one group falls below k, the entire dataset fails, regardless of how many other groups comply.
D is wrong because k-anonymity requires groups of at least k records, not exactly k. Groups of 5 or 4 are perfectly acceptable.
Study tip: On anonymization questions, always check the minimum group size — if any single group falls below the threshold, the whole dataset fails. - Which retention policy best applies data-minimization and purpose-limitation principles?
Answer: Set justified deletion periods, retain only needed derived fields, and separately preserve records subject to valid legal holds.
When you encounter a data-governance question like this, anchor your thinking to two core privacy principles: data minimization (collect and keep only what you actually need) and purpose limitation (use data only for the specific purpose it was collected for). Any retention policy must satisfy both simultaneously — not trade one off against the other.
Option D does exactly this. It sets justified, time-bound deletion schedules tied to real business needs, retains only the derived fields (category, resolution time, sentiment score) that analysts actually use, and carves out a narrow exception for records under valid legal holds. This approach honors both principles without sacrificing legitimate compliance obligations.
The distractors each fail in a specific way. A is the classic "future analytics" trap — claiming that speculative, undefined future uses constitute a current operational purpose. Purpose-limitation explicitly prohibits retaining data for vague hypothetical reasons; a purpose must be documented and specific, not aspirational. B swings too far in the opposite direction: while aggressive deletion seems privacy-friendly, immediately deleting records under legal holds or unresolved disputes violates legal preservation obligations. Minimization doesn't mean destroying evidence you're legally required to keep. C reflects a common misconception about anonymization — removing direct identifiers like names is not sufficient to prevent re-identification when full transcripts remain. Voice patterns, specific complaint details, and contextual clues can all reveal identity, so this approach fails the minimization standard.
Your study tip: on data-governance questions, watch for answers that treat retention as all-or-nothing. The correct policy almost always involves proportionality — keeping what you need, for as long as you need it, with documented exceptions for legal requirements.
- Which control would most directly mitigate this privacy weakness while preserving useful aggregate reporting?
Answer: Apply complementary suppression or query-overlap controls so allowed aggregates cannot expose a suppressed subgroup by subtraction.
When a dashboard suppresses small-group results but still allows managers to query overlapping aggregates freely, a differencing attack becomes possible: subtract the "department minus team" value from the full department value to reconstruct exactly what was supposed to be hidden. The suppression threshold alone is meaningless if the system doesn't also block the queries that make subtraction possible. This question tests your understanding of statistical disclosure control in data privacy.
B is correct because complementary suppression (or query-overlap restrictions) directly closes the differencing loophole. These controls either suppress additional related cells so no subtraction can isolate the protected group, or restrict which combinations of overlapping queries a user may submit — preserving meaningful aggregate reporting while eliminating the mathematical path to re-identification.
A is wrong because password complexity is an authentication control, not an authorization or query-logic control. A manager with a stronger password still has the same ability to run the two overlapping queries and subtract them — the vulnerability is structural, not credential-based.
C is wrong because replacing names with ID numbers is a pseudonymization step that protects direct identifiers. It does nothing to prevent the differencing attack, since the attack exploits numeric aggregate values, not employee names.
D is wrong because adding decimal places is cosmetic obfuscation, not a true control. A determined manager can still subtract two precise-looking numbers; more decimal places may even make the reconstructed value more accurate, worsening the exposure.
The study takeaway: whenever a question describes a differencing or subtraction attack on suppressed data, the fix must address the query overlap itself — not access credentials, not identifier masking, and not display formatting.
- Under basic sequential composition, which assessment is correct?
Answer: The release exceeds the budget by ε=0.05, so its cost must be reduced or another release omitted.
Whenever you see a question involving differential privacy and multiple data releases, your instinct should be to apply sequential composition: when you run several privacy mechanisms on the same individuals, the total privacy cost is the sum of all individual costs — not the maximum, not just the largest.
Here, the team has already spent ε1+ε2=0.35+0.40=0.75 of the ε=1.00 budget. That leaves a remaining allowance of 1.00−0.75=0.25. The proposed third release costs ε3=0.30, which exceeds that remaining allowance by 0.30−0.25=0.05. So the release is impermissible unless its cost is trimmed or a prior release is dropped — making D the correct assessment.
Choice A is wrong because the rule is never "each query stays under the total budget individually." That interpretation ignores the accumulation of privacy risk across queries; every release chips away at the same pool of protection for the same people.
Choice B describes a parallel composition rule, which applies only when queries target disjoint subsets of the data. Since all three releases concern the same individuals, parallel composition does not apply, and you cannot take just the maximum cost.
Choice C overstates the damage. The first two queries cost 0.75, not the full 1.00, so 0.25 of budget remains. Claiming the budget is fully consumed — and therefore the overage is 0.30 — is an arithmetic error.
Study tip: Always check whether queries share the same individuals (use summation) or cover disjoint groups (use maximum). Confusing parallel and sequential composition is the most common trap on differential-privacy exam questions. - What is the most responsible next step before using the recommendations?
Answer: Add explicit access or fairness constraints, test sensitivity and long-term effects, and document the resulting trade-offs.
When a prescriptive model optimizes a single objective — like revenue — without constraints, it will ruthlessly exploit whatever patterns exist in historical data, even if those patterns reflect past discrimination or systemic exclusion. That's exactly what's happening here: the model learned from biased campaign history and is now recommending that bias be repeated at scale. Responsible deployment requires recognizing that validating revenue predictions alone is not enough to call a model "ready."
B is correct because it addresses the full picture. Adding fairness or access constraints forces the model to balance revenue against equitable reach. Sensitivity analysis reveals whether small budget shifts dramatically change group-level outcomes, and testing long-term effects guards against compounding harm. Documenting trade-offs ensures decision-makers understand what is being sacrificed for what gain — which is essential for accountability.
A is wrong because budget constraints being "objective" doesn't make the allocation ethical. Limited resources make prioritization choices more consequential, not less — precisely because someone is actively being excluded. Validation of revenue predictions says nothing about fairness or systemic harm.
C is wrong because equal amounts aren't automatically equitable. Equal spending ignores differing neighborhood sizes, needs, or baseline access levels. Mandating identical allocation regardless of context is a rigid rule masquerading as ethics and may actually produce worse outcomes for underserved groups.
D is wrong because removing neighborhood labels while keeping historical response variables is a classic fairness theater trap. Correlated variables (income proxies, zip-code features) will reconstruct the same biased recommendations through the back door.
Study tip: When a question involves optimization models trained on historical data, always ask: what did history exclude, and does the model perpetuate that? Fairness constraints and trade-off documentation are the responsible answer almost every time.
- Which recommendation best reflects responsible experimentation?
Answer: Redesign the treatment to preserve informed choice and evaluate unintended renewals, comprehension, and complaints before adoption.
When you see a question about A/B testing that involves potentially manipulative design, shift your thinking beyond statistical validity toward ethical experimentation standards. Responsible experimentation requires measuring a full picture of outcomes — not just the metric that flatters the treatment.
The treatment here uses dynamic interface manipulation (repeatedly shifting button placement and wording) to frustrate users into abandoning cancellation. Even if random assignment is valid, the design undermines informed choice. Option C is correct because it addresses both problems simultaneously: it calls for redesigning the treatment to restore user autonomy and expanding measurement to include unintended renewals, comprehension, and complaints. These "hidden" outcomes are exactly what responsible experimenters must capture before scaling a result.
Option A is a classic trap. Random assignment does establish causality, but causality alone doesn't justify adoption — it only tells you that the screen caused retention, not whether the retention is legitimate or ethically acceptable. Option B compounds the problem by doubling down on a flawed experiment: extending runtime while keeping a single biased metric doesn't improve the study's integrity, it just accumulates more evidence of a metric that obscures harm. Option D is perhaps the most seductive distractor — targeting sounds like harm reduction, but applying a manipulative design selectively doesn't make the manipulation ethical; it just narrows the population being deceived.
Study tip: On business analytics questions involving experimentation ethics, watch for answers that conflate statistical rigor with ethical soundness. A well-designed experiment can still be irresponsible if it measures only favorable outcomes and ignores consumer harm signals.
- Based only on these results, which statement is supported?
Answer: The model satisfies equal opportunity in this sample, but it does not have exactly equal overall approval rates.
Whenever you see a fairness question about a predictive model, your first move should be to calculate the two key metrics separately: the true-positive rate (TPR) for equal opportunity, and the overall approval rate for demographic parity.
Here, the TPR (approved among creditworthy applicants) for group X is 8064=0.80, and for group Y it is 5040=0.80. The rates are identical, so the model satisfies equal opportunity — it gives creditworthy applicants the same approval chance regardless of group. Now check overall approval rates: group X has 20088=0.44 and group Y has 10045=0.45. These differ slightly, meaning demographic parity is not met. That combination is exactly what answer A describes, making it the supported conclusion.
Answer B gets the facts backwards — it claims demographic parity is satisfied and TPRs differ, but the data show the opposite on both counts. Answer C confuses absolute counts with rates. Yes, group X had more creditworthy applicants approved in raw numbers (64 vs. 40), but equal opportunity is measured with proportions, not totals; the 80% rate is the same in both groups. Answer D overstates what equal TPRs can prove. Equal opportunity is one fairness criterion among several (demographic parity, calibration, etc.), and no single metric is universally sufficient to declare a model "ethically fair."
Study tip: Always distinguish between rate-based metrics (TPR, precision) and count-based comparisons — exams frequently use large vs. small group sizes as a trap to make equal rates look unequal in absolute terms. - What is the most appropriate next step before deployment?
Answer: Audit proxy effects and group-specific error rates, then revise features or thresholds based on job-related validity.
When a predictive model uses variables that correlate strongly with protected characteristics — like postal code or university attended — those variables can act as proxies for race or ethnicity even after the protected attributes themselves are removed. This is the core concept being tested: disparate impact through proxy variables. Whenever you see a scenario where protected attributes are excluded but group-specific error rates still diverge, your alarm should trigger around proxy effects and fairness auditing.
Option C is correct because it addresses the actual problem systematically. Similar overall accuracy masks the real issue: one group suffers substantially more false rejections, meaning qualified candidates are being screened out at a higher rate. The right response is to audit which features are driving those group-specific errors, assess whether those features have genuine job-related validity, and then adjust features or decision thresholds accordingly. This balances legal compliance, ethical fairness, and predictive usefulness.
Option A is wrong because overall accuracy parity is not a sufficient fairness standard. Aggregate metrics can hide serious subgroup disparities — this is sometimes called the "accuracy paradox." Excluding protected attributes alone does not eliminate proxy discrimination.
Option B overcorrects dangerously. Removing every variable correlated with group membership could strip out legitimate, job-relevant predictors, gutting the model's usefulness. The goal is not zero correlation with group membership but rather justified, job-related validity.
Option D is a common misconception: more data does not automatically fix a biased feature set. If a proxy variable is structurally biased, scaling the data only entrenches the disparity further.
Study tip: On fairness questions, always distinguish between overall accuracy and subgroup error rates — they can tell completely different stories, and exams will exploit that gap.
