An insurance company is designing access controls and data-security practices for a new GenAI claims-review assistant that references customer medical and financial records. Select the TWO practices that are appropriate business-level governance decisions. (Select TWO.)
Select all correct answers, then click Submit.
Short Explanation
Think of it like a hospital chart: not everyone who works there needs to see everything in it. Classify what kind of data you're dealing with, then only hand the assistant the slice each role actually needs — that's the policy call a business owner makes, not a technical one.
Full Explanation
Restricting the assistant's access to only the claims data needed for the roles that use it, and defining what data classification applies to each type of record, are both decisions a business owner is expected to make — they set the policy boundaries without requiring technical configuration. Having business leaders personally configure encryption keys is a hands-on technical task that falls outside what a business professional is expected to do and outside this exam's scope. Relying solely on the vendor's default access settings without reviewing them against company policy abdicates the company's own responsibility to ensure access matches its actual needs and risk tolerance. Allowing the assistant unrestricted access to all customer records to speed up claims processing sacrifices necessary controls over highly sensitive medical and financial data for a convenience that isn't worth the exposure. The general principle: appropriate business-level governance sets classification and access-scope policy, while it leaves technical configuration to technical teams and never accepts unreviewed defaults or unrestricted access as shortcuts.