AI Safety, Security, and Governance

AIP-C01 · 40 questions

• A city youth-services chatbot must block toxic and self-harm content in resident chats. Which safety control should be enabled first?
• A county permitting assistant must not invent criminal penalties that do not appear in local code. Which output safety approach best addresses that risk?
• A transit chatbot should explain delays using Knowledge Base facts and escalate low-confidence drafts for human review. Which safety pattern implements that behavior?
• A public-health GenAI stack wants layered misuse protection beyond a single filter. Which architecture best reflects defense-in-depth safety?
• A clerk system must catch adversarial instructions hidden inside uploaded PDF text before those chunks enter retrieval. Which defensive control should be applied?
• A housing chatbot must refuse attempts that try to make it ignore fair-housing policy constraints. Which safety behavior is required?
• A water utility allows a GenAI assistant to query operational metrics but must prevent unsafe free-form SQL from the model. Which control reduces that risk?
• A 311 product team wants safety assurance before each resident-assistant release. Which practice should be part of the release gate?
• A parks kiosk GenAI experience must block user prompts that request disallowed adult content in real time. Which control applies?
• A school-district assistant drafts parent emails that must be screened for toxic language before send. Which output safety technique fits?
• An emergency-management app must ensure every FM-generated alert draft includes severity and affected-area fields. Which accuracy and safety control enforces that structure?
• A municipal security operations center wants early warning when resident-facing bots keep receiving the same prompt-injection patterns. Which operational control best surfaces that threat signal?
• A city wants its permitting RAG corpora to reach Amazon Bedrock without placing those corpora on a public internet path. Which data-security pattern best meets that requirement?
• A county health department needs GenAI apps used by authorized analysts to read case tables while other city bots cannot. Which control best enforces that granular access?
• A transit authority must keep rider phone numbers and addresses out of foundation-model interaction logs. Which privacy control should the team apply in the messaging pipeline?
• A public-health chatbot must avoid echoing Social Security numbers that residents sometimes paste into chat. Which privacy-preserving control best addresses that risk?
• A clerk’s office must expire prompt and response logs according to municipal records-retention schedules. Which data-security practice best aligns GenAI logs to that policy?
• A housing authority wants to use real case notes to evaluate prompt changes without exposing tenant identities in the evaluation dataset. Which privacy approach is most appropriate?
• A water utility GenAI assistant should answer service FAQs but must not read unrestricted customer billing tables. Which IAM design best enforces that boundary?
• A 311 platform needs to notice if GenAI service roles suddenly pull unusually large volumes of resident case data. Which monitoring approach best supports that data-security goal?
• A parks membership bot summarizes support tickets that sometimes include payment card numbers. What should the pipeline do before any foundation-model summarization?
• A school district wants GenAI tutoring aids to help with coursework without default access to full student record systems. Which privacy-by-design choice best matches that goal?
• A city wants each resident-facing foundation-model application to carry clear documentation of purpose, data, and known limits for governance reviews. Which artifact best satisfies that need?
• A county counsel’s office must show how an ordinance PDF became the text behind a RAG answer during a records review. Which governance mechanism best supports that traceability?
• A transit authority wants every generated rider notice to show which standard operating procedure supplied the guidance. Which governance practice enables that systematic attribution?
• A public-health board requires new GenAI features to pass an organizational Responsible AI checklist before go-live. Which governance action best implements that requirement?
• A clerk’s office needs audit-ready evidence of who changed prompt templates for the filing assistant. Which control best supports that compliance review?
• A housing GenAI program drafts denial-letter language and must watch for unfair wording shifts across ZIP codes over time. Which governance control should the team implement?
• A water utility needs ongoing detection when FM outputs violate published communication policy, plus a path to fix them. Which governance pattern fits?
• A 311 team will wire retrieval only to knowledge sources that governance has formally approved. What should happen before those sources connect to the GenAI app?
• A parks commission must retain GenAI interaction logs for public-records requests while preventing sensitive tokens from being disclosed. Which advanced governance control fits?
• An emergency-management agency must present evidence that its GenAI alerting stack was monitored and governed during an audit. Which preparation best supports that review?
• A city wants 311 bot replies to help residents understand why an answer was given without exposing internal tooling details. Which Responsible AI transparency practice fits?
• A county permitting assistant should quantify how uncertain recommendations are so staff can intervene on low-confidence cases. Which Responsible AI practice supports that goal?
• A transit team worries that delay messages might treat some language communities less clearly than others. Which fairness-oriented evaluation approach should they use?
• A public-health unit needs scalable checks that outreach drafts meet fairness rubrics before campaigns launch. Which automated evaluation approach best supports that Responsible AI goal?
• A municipal clerk bot sometimes returns contested answers that staff must defend. Leadership wants agent reasoning traces available to clerks for audit review, but not automatically shown on the public resident portal. Which Responsible AI approach best fits that requirement?
• A housing authority ships an eviction-prevention assistant and must document where the foundation model can fail so caseworkers do not treat drafts as binding legal advice. Which Responsible AI practice best addresses that need?
• A water utility generates boil-water advisory drafts with a foundation model, then a Lambda step must block publication if required policy checks fail. Which approach best implements Responsible AI compliance for those outputs?
• A school district wants Amazon Bedrock Guardrails topics to reflect board-approved student-safety policies rather than generic defaults alone. Which Responsible AI alignment step should the GenAI team take?