Governance: Databricks Generative AI Engineer Associate Practice Questions

Correct answer: D

WHY D is correct: Fixing problems at the data source — during ingestion, before the knowledge base is built — is the most effective and durable mitigation. A toxicity classifier applied per-chunk at ingest time removes problematic content from the Delta table and Vector Search index permanently. Toxic chunks never enter the knowledge base and cannot be retrieved, regardless of the query. This upstream fix is more reliable than any downstream LLM-level interventions. WHY NOT A: A UI disclaimer acknowledges the problem but does nothing to prevent toxic content from appearing in responses. It shifts liability rather than removing the risk, and user-facing disclaimers do not satisfy enterprise safety requirements. WHY NOT B: System prompt instructions are the weakest form of guardrail. The LLM may still reproduce toxic phrasing when it appears in retrieved context, especially for closely relevant queries. Instructions are not reliably followed when the context window contains strongly contradicting content. WHY NOT C: Retrieval similarity scores measure semantic relevance to the user query, not content quality or toxicity. A toxic post that is topically relevant to the user's question will score high, not low. Raising the threshold only reduces result count — it does not correlate with toxicity reduction.

Correct answer: D

WHY D is correct: Output scanning with regex and/or a PII detection model is the standard post-generation guardrail for preventing sensitive data leakage in LLM responses. It runs on every response before it reaches the user and acts as a safety net independent of whether the source documents or model behavior were properly sanitized. Regex patterns for credit card formats are highly reliable and have near-zero latency overhead. WHY NOT A: Reducing top-k decreases the chance of retrieving a PII-containing chunk but does not eliminate it. If even one retrieved chunk contains a credit card number, the model may still surface it in the response. This is a probabilistic mitigation, not a guardrail. WHY NOT B: max_tokens controls response length, not the model's tendency to copy or generate specific content. Increasing it makes no causal connection to PII suppression and would likely generate longer — not safer — responses. WHY NOT C: Re-syncing the index updates the vector embeddings but does not sanitize the source document content. Credit card numbers in the original Delta table text remain present and can still be retrieved and surfaced.

Correct answer: A

WHY A is correct: A multi-category safety classifier like Llama Guard is purpose-built for this task. It evaluates the semantic meaning of the input across a comprehensive, structured harm taxonomy, not just keyword presence. It handles obfuscation (e.g., 'how does one hypothetically build a weapon?') that keyword matching misses, provides per-category verdicts for auditability, and enforces safety before the primary LLM is invoked. WHY NOT B: A fixed keyword blocklist is easily circumvented by paraphrasing, using synonyms, inserting spaces, or using homoglyphs. It also generates high false positives (e.g., blocking 'gun control policy research' for containing 'gun'). Keyword matching cannot understand semantic context. WHY NOT C: Adding a system prompt instruction is the weakest guardrail available — it relies entirely on the primary LLM's instruction-following, which can be bypassed by creative prompt formulations. Academic research proves that system-prompt-only safety constraints are not sufficient for adversarial resistance in public applications. WHY NOT D: A daily batch review is a retrospective audit mechanism, not a real-time guardrail. Harmful content is delivered to users and processed by the LLM for up to 24 hours before detection. This approach does not prevent harm — it only detects it after the fact.

Correct answer: A

WHY A is correct: Metadata-driven lifecycle management at the data source is the correct architectural response to stale regulatory content. Tagging documents with expiration dates allows the ingestion pipeline to systematically exclude expired regulations before they are indexed — they can never be retrieved and cannot appear in responses. A scheduled refresh pipeline maintains this invariant as new expirations occur. This is a durable, programmatic fix to a structural data quality problem. WHY NOT B: A system prompt disclaimer reduces the severity of liability but does not prevent outdated regulations from being cited in responses. Legal services firms require accuracy, not hedging language. A disclaimer does not remove the business or legal risk of incorrect regulatory guidance. WHY NOT C: Embedding models learn semantic similarity during training — they cannot distinguish 'current' from 'superseded' regulations based on legal validity. A regulation replaced in 2023 will still be semantically similar to current queries about the same topic. Re-training on current regulations would not reliably deprioritize superseded versions. WHY NOT D: Retrieving more chunks statistically reduces but does not eliminate the probability that an outdated document is included. If the outdated regulation is highly relevant to the query, it will rank highly regardless of how many total chunks are retrieved. Dilution is not a reliable fix when the problematic content is topically relevant.

Correct answer: D

WHY D is correct: CC BY-NC 4.0's Non-Commercial clause prohibits using the licensed material 'primarily for commercial advantage or monetary compensation.' Using a dataset as a knowledge source in a commercial SaaS RAG product constitutes commercial use — the NC restriction applies. CDLA-Permissive-2.0 was specifically designed for data in AI/ML pipelines and permits commercial use, making Dataset B the only legally safe choice. WHY NOT A: The argument that NC restrictions 'don't apply to vector representations' is legally untested and risky. Generating embeddings from NC-licensed text is a form of processing that derives commercial value from the licensed work. Most legal interpretations consider this commercial use under CC BY-NC. WHY NOT B: In Creative Commons licensing, the BY (Attribution) clause requires credit to the creator — it does not modify or override the NC restriction. Attribution and Non-Commercial are independent licensing conditions; satisfying one does not waive the other. WHY NOT C: Creative Commons licenses are legally binding copyright licenses, enforceable in court. They are not advisory guidelines. Using NC-licensed data commercially without authorization exposes the company to copyright infringement liability.

Correct answer: A

WHY A is correct: Pre-processing masking is the only approach that prevents PII from entering the LLM's context window. An NER model or regex pipeline identifies specific entity types and replaces them with typed placeholders before the API call. The LLM processes placeholder tokens instead of real PII, satisfying the regulatory prohibition on transmission. WHY NOT B: Fine-tuning alters the model's output tendencies but does not prevent PII from being transmitted to the model in the input. The PII still crosses the network boundary to the LLM API, violating the transmission prohibition regardless of output behavior. WHY NOT C: AES-256 encryption produces ciphertext that is meaningless to the LLM — the model cannot interpret or reason about encrypted inputs. This approach would produce semantically useless responses. Encryption is used for data-at-rest or in-transit security, not for selective entity masking during LLM inference. WHY NOT D: Filtering by numeric sequence length is a heuristic retrieval filter, not a masking technique. It only affects which document chunks are retrieved from the vector store — it does not mask PII in the live user's input message before it is sent to the LLM.

Correct answer: A

WHY A is correct: GPL-3.0's copyleft (viral) clause requires that any software that is a 'derivative work' of GPL-licensed code must also be licensed under GPL. The key legal risk for a commercial RAG system is that if the LLM generates responses that reproduce verbatim or substantially similar GPL code excerpts, those outputs may be considered derivative works — potentially triggering the copyleft requirement to release the entire product under GPL. This is an active area of legal debate (Copilot litigation precedents) and represents genuine legal exposure for closed-source commercial products. WHY NOT B: GPL-3.0 does not restrict automated processing, parsing, or tokenizing of source code. The license governs distribution and derivative works, not mechanical processing for indexing or embedding purposes. WHY NOT C: GPL-3.0 does not require watermarking of outputs or attribution in every generated response. Attribution requirements of this type appear in some Creative Commons licenses (BY clause), not in GPL. WHY NOT D: GPL-3.0 is explicitly NOT a permissive license. It is one of the strongest copyleft licenses. MIT and Apache 2.0 are permissive and impose no copyleft obligations. Equating GPL with these licenses represents a fundamental misunderstanding of open-source licensing that could lead to severe legal consequences.