First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.
Continue in the practice tool above to load more questions, 50 at a time.
Question 1Data Governance and Ethics
Under a data-minimization principle, which practice best governs the collection of personal data for a marketing analytics project?
- Collect only the fields the stated analytics purpose requires and document why each is needed Correct answer.
- Collect every available field so future analyses are never blocked
- Collect all fields but delete them after one year regardless of use
- Collect fields requested informally by the sales team without review
Explanation
Data minimization requires that collection be limited to what is adequate, relevant, and necessary for a specified purpose. Documenting the purpose-to-field link makes the limit auditable and supports later accountability checks.
Question 2Data Governance and Ethics
Which statement correctly describes the role of a data steward in a governance operating model?
- They own day-to-day quality and definitional decisions for a domain and escalate policy conflicts Correct answer.
- They build the physical warehouse schemas and tune query performance
- They independently attest to financial controls for external regulators
- They set the enterprise-wide risk appetite and approve the annual audit plan
Explanation
Stewards operate at the domain level, resolving definitions, quality rules, and usage questions within policy. Strategic risk appetite sits with an executive council, and independent attestation belongs to audit.
Question 3Data Governance and Ethics
A dataset is used to train a model that approves loan applications. Which governance control most directly addresses disparate impact on a protected group?
- Encrypting the training dataset at rest with a managed key
- Publishing the model's source code in an internal repository
- Requiring analysts to sign an acceptable-use policy annually
- Periodic fairness testing of outcomes by group with documented thresholds and remediation Correct answer.
Explanation
Disparate impact is an outcome property, so it must be measured on decisions across groups against pre-agreed thresholds. Encryption, attestation, and transparency do not by themselves detect unequal outcomes.
Question 4Data Governance and Ethics
What distinguishes data provenance from data lineage in a governance catalog?
- Provenance records origin and chain of custody, while lineage maps transformation flows between datasets Correct answer.
- Provenance applies to unstructured data, while lineage applies only to numeric columns
- Provenance is a legal term for consent, while lineage is a billing concept
- Provenance covers only cloud storage, while lineage covers only on-premises systems
Explanation
Provenance concerns where data came from and who handled it, supporting authenticity and rights checks. Lineage traces how data moves and transforms across systems, supporting impact analysis.
Question 5Data Governance and Ethics
A retention schedule states that customer support tickets must be kept for three years after closure. A team proposes deleting them at closure to reduce storage cost. What is the sound governance response?
- Reject the deletion because the schedule defines a minimum retention that must be met Correct answer.
- Approve the deletion because storage cost reduction always overrides retention
- Reject the deletion because retention schedules prohibit any deletion ever
- Approve the deletion only if the tickets contain no personal data
Explanation
A retention schedule sets a minimum period during which records must remain available for legal, audit, or operational needs. Cost savings do not justify shortening a mandated retention period.
Question 6Data Governance and Ethics
Which consent model is most consistent with a jurisdiction requiring freely given, specific, informed, and revocable consent?
- A pre-ticked box covering all current and future processing purposes
- Implied consent derived from the user visiting the organization's website
- A single blanket consent captured at account creation with no withdrawal path
- Opt-in per purpose with an easy withdrawal mechanism and records of each grant Correct answer.
Explanation
Valid consent must be specific to purposes and as easy to withdraw as to give, which requires per-purpose grants and withdrawal tooling. Blanket, pre-ticked, or implied models fail the specificity and freedom tests.
Question 7Data Governance and Ethics
An analyst wants to join a customer table with a third-party dataset using postal code, birth date, and gender. What governance risk should be flagged first?
- Duplication of storage costs across systems
- Increased query latency from the join operation
- Loss of referential integrity in the join key
- Re-identification risk from quasi-identifier combination Correct answer.
Explanation
Combinations of quasi-identifiers can single out individuals even when direct identifiers are removed. Governance review should assess re-identification risk before approving the linkage.
Question 8Data Governance and Ethics
What is the primary purpose of a data classification scheme in an enterprise governance framework?
- To rank employees by their data literacy scores
- To calculate depreciation of data assets for accounting
- To determine which vendor supplies the storage platform
- To assign handling requirements proportionate to sensitivity and criticality Correct answer.
Explanation
Classification tiers drive controls such as encryption, access approval, and sharing limits according to sensitivity and business criticality. It is a control-selection mechanism, not a procurement or HR tool.
Question 9Data Governance and Ethics
A vendor processing personal data on your behalf suffers a breach. Under a typical controller-processor arrangement, who bears the primary obligation to notify the regulator?
- The processor alone, with no duty to inform the controller
- The cloud infrastructure provider hosting the processor's systems
- The affected data subjects, who must self-report the incident
- The controller, informed by the processor without undue delay Correct answer.
Explanation
Processors must notify controllers promptly, but the legal notification duty to regulators and individuals generally rests with the controller. Sub-infrastructure providers sit further down the chain and do not assume that duty.
Question 10Data Governance and Ethics
Which practice best supports the principle of purpose limitation throughout a data lifecycle?
- Relying on the original collection notice for all future uses without review
- Allowing any internal team to repurpose data as long as it stays inside the company
- Tagging each dataset with approved purposes and blocking access when a request falls outside them Correct answer.
- Restricting purpose tags to the ingestion stage and dropping them afterward
Explanation
Purpose limitation requires that data be used only for the purposes specified at collection unless a new lawful basis is established. Persistent purpose tags enforced at access time make that constraint operational.
Question 11Data Governance and Ethics
In a data quality governance program, what does the role of a data owner most typically include?
- Writing every SQL transformation used in production
- Accountability for access approvals and quality standards within their domain Correct answer.
- Managing the physical security of the data center
- Performing the annual external financial audit
Explanation
Owners are accountable for a data domain, approving access and endorsing quality standards and definitions. Implementation and physical security are delegated to engineers and facilities teams.
Question 12Data Governance and Ethics
A model trained on historical hiring decisions systematically favors one demographic. Which remediation most directly targets the root cause rather than the symptom?
- Increasing the model's overall accuracy on the historical dataset
- Removing the demographic attribute from the feature set only
- Auditing and correcting biased historical labels and features before retraining Correct answer.
- Adding a disclaimer to hiring reports noting possible bias
Explanation
Biased historical outcomes contaminate labels and proxy features, so correcting them addresses the source of the disparity. Disclaimers and accuracy gains leave the underlying bias intact.
Question 13Data Governance and Ethics
Which element is essential for a data processing agreement between a controller and a processor?
- A statement that the processor assumes the controller's regulatory duties
- Binding instructions on processing scope, security measures, and sub-processor approval Correct answer.
- A clause allowing the processor to set its own retention periods freely
- An agreement that breach notification is optional for both parties
Explanation
A processing agreement must bind the processor to documented instructions and specify security, sub-processing, and assistance obligations. It cannot transfer the controller's statutory duties or waive notification.
Question 14Data Governance and Ethics
A team proposes publishing an open dataset derived from customer records. Which check is most important before release?
- Checking that column names follow the internal naming standard
- Confirming that aggregation and perturbation prevent singling out any individual Correct answer.
- Ensuring the dataset uses the newest file format available
- Verifying that the dataset compresses well for download
Explanation
Release decisions hinge on whether individuals can still be identified or inferred from the published data. Disclosure-control testing of aggregation and noise addition is the decisive safeguard.
Question 15Data Governance and Ethics
What does a data ethics review board add beyond a legal compliance review?
- Ownership of the master data management platform
- Assessment of harms and societal impacts that may be lawful but still ethically questionable Correct answer.
- Authority to overrule regulators on enforcement decisions
- Responsibility for maintaining the organization's network firewalls
Explanation
Ethics review examines harms such as exclusion, manipulation, or dignity loss that may fall outside legal minimums. It complements rather than replaces legal review and does not hold operational IT duties.
Question 16Data Governance and Ethics
Which metric best evidences the effectiveness of an access-control governance process?
- Count of help-desk tickets about login problems
- Percentage of access rights recertified on schedule with revoked excess privileges Correct answer.
- Average password length enforced by the directory
- Number of user accounts created during the year
Explanation
Recertification rates and revocation of excess rights show whether access stays aligned with need over time. Activity counts and password settings do not demonstrate periodic entitlement review.
Question 17Data Governance and Ethics
A regulation requires that automated decisions with significant effects offer meaningful human intervention. Which design satisfies this requirement most directly?
- A notice telling users that a human built the model
- A reviewer with authority and information to reverse the automated outcome before it takes effect Correct answer.
- A monthly report summarizing aggregate decision volumes
- A log file recording the model version used for each decision
Explanation
Meaningful intervention requires a human with the authority, context, and timing to change the outcome. Disclosure, logging, and reporting support transparency but do not provide intervention.
Question 18Data Governance and Ethics
Which statement best captures the accountability principle in data governance?
- Accountability applies only to the privacy team and its leadership
- The organization must be able to demonstrate compliance, not merely intend it Correct answer.
- Demonstrating compliance is required only after a regulator opens a case
- Compliance is satisfied once a policy document is published internally
Explanation
Accountability requires demonstrable evidence such as records, assessments, and controls, not just stated intent. It is an organizational obligation, not one confined to a single team.
Question 19Data Governance and Ethics
A data-sharing agreement permits a partner to use shared data for research. The partner wants to sell derived insights commercially. What governance step is required?
- Proceed because the partner already holds the data
- Reassess the permitted purposes and obtain approval or a new agreement before commercial use Correct answer.
- Proceed if the partner anonymizes the insights after selling them
- Proceed because derived insights are not the original data
Explanation
Purpose restrictions in a sharing agreement bind the recipient, and a new use requires renegotiation or a fresh lawful basis. Derived outputs may still be constrained by the original terms.
Question 20Data Governance and Ethics
Which control most effectively reduces the risk of shadow data copies spreading outside governed repositories?
- Increasing storage quotas for every team by default
- Requiring annual ethics training for all staff only
- Banning all data exports without offering any alternative
- Discovery scanning combined with sanctioned self-service channels for approved extracts Correct answer.
Explanation
Shadow copies arise when governed channels are slow or absent, so discovery plus a sanctioned path addresses both detection and cause. Prohibition without alternatives tends to push copying further underground.
Question 21Data Governance and Ethics
What is the function of a records of processing activities register?
- Recording employee attendance and leave balances
- Documenting purposes, categories, recipients, and retention for each processing operation Correct answer.
- Tracking software license renewals across the estate
- Listing the hardware assets owned by the IT department
Explanation
The register provides an inventory of processing operations and their lawful parameters, supporting accountability and regulator requests. It is not an asset, HR, or license inventory.
Question 22Data Governance and Ethics
A privacy impact assessment is initiated for a new biometric entry system. Which element is most central to the assessment?
- Selecting the vendor with the fastest installation timeline
- Estimating the capital cost of installing turnstiles
- Deciding the color scheme of the enrollment kiosk
- Evaluating necessity and proportionality of biometric capture against less intrusive alternatives Correct answer.
Explanation
A privacy impact assessment weighs whether the processing is necessary and proportionate and whether less intrusive means exist. Cost, schedule, and design aesthetics are secondary considerations.
Question 23Data Governance and Ethics
Which scenario best illustrates a conflict between data utility and privacy protection?
- Encrypting a database while keeping full analytical access for approved staff
- Publishing granular location traces that enable useful research but single out individuals Correct answer.
- Retaining data longer to improve model accuracy while increasing exposure
- Applying access controls that limit both misuse and legitimate analysis
Explanation
Utility-privacy trade-offs arise when analytical value depends on detail that also raises re-identification risk. The other options describe controls or retention decisions rather than the granularity trade-off itself.
Question 24Data Governance and Ethics
A governance council wants a single authoritative definition of "active customer" used across reporting. Which artifact should it approve?
- A copy of the source system's column comment
- A business glossary entry with an agreed definition and accountable owner Correct answer.
- A dashboard screenshot showing current figures
- An email thread where analysts debated the term
Explanation
A business glossary records the approved definition and assigns accountability, giving reporting a single reference. Source comments, screenshots, and email threads are not authoritative.
Question 25Data Governance and Ethics
An organization discovers that a model's training data included records collected without a valid lawful basis. What is the most defensible governance action?
- Delete the model's logs to limit the scope of the investigation
- Continue using the model but add a note to its documentation
- Suspend use of the model, assess affected outputs, and remediate or retrain with lawfully sourced data Correct answer.
- Wait for a regulator to raise the issue before acting
Explanation
Unlawful training data taints downstream use, so the model should be paused while impact is assessed and lawful data substitution is arranged. Documentation alone or evidence destruction compounds the exposure.
Question 26Data Governance and Ethics
Under a data minimization principle, which action is most appropriate when a marketing team requests access to a customer database for a campaign?
- Provide access only to the specific fields needed for the campaign and for the duration of the campaign. Correct answer.
- Provide access to a subset of fields that includes all personally identifiable information.
- Provide access to all fields but require the team to sign a confidentiality agreement.
- Provide full access to all customer fields to avoid future requests.
Explanation
Data minimization requires that personal data be adequate, relevant, and limited to what is necessary for the specific purpose. Granting access only to the fields needed for the campaign and limiting the duration aligns with this principle. Broad access, even with confidentiality agreements, does not satisfy minimization because it exceeds what is necessary.
Question 27Data Governance and Ethics
What is the primary role of a data steward in a data governance framework?
- To define the strategic vision for data use across the enterprise.
- To approve the overall data governance budget.
- To ensure data quality and compliance with policies within a specific domain. Correct answer.
- To develop machine learning models using organizational data.
Explanation
A data steward is typically responsible for day-to-day management of data within a domain, including quality, metadata, and policy adherence. Strategic vision and budget approval are usually handled by higher-level councils or executives. Model development is a separate technical role.
Question 28Data Governance and Ethics
An organization wants to use customer email addresses for a new analytics initiative. The original collection notice mentioned only order processing. Which governance action is most appropriate before proceeding?
- Proceed if the analytics team anonymizes the email addresses before use.
- Conduct a legitimate interest assessment and update the privacy notice if relying on that basis. Correct answer.
- Proceed because email addresses are not considered personal data.
- Use the data without changes because analytics is a compatible purpose with order processing.
Explanation
When data is used for a purpose not covered by the original notice, the organization must establish a lawful basis for the new use. A legitimate interest assessment can justify the new purpose, and transparency requires updating the notice. Assuming compatibility without assessment or claiming email is not personal data is incorrect.
Question 29Data Governance and Ethics
Which approach best embeds ethics into the design of a new data product from the start?
- Requiring users to accept terms and conditions that cover ethical use.
- Conducting a post-launch audit to identify ethical issues.
- Adding a disclaimer that the organization is not responsible for ethical outcomes.
- Performing a privacy and ethics impact assessment during the design phase. Correct answer.
Explanation
Embedding ethics by design means proactively assessing potential impacts before the product is built. A privacy and ethics impact assessment during design identifies risks and mitigations early. Post-launch audits and disclaimers are reactive and do not prevent harm.
Question 30Data Governance and Ethics
A data governance council is evaluating a proposal to share aggregated location data with a research partner. The aggregation is by postal code and week. Which residual risk requires the most careful governance review?
- The partner might use the data for commercial purposes instead of research.
- The partner might share the data with other researchers without permission.
- The aggregation process might introduce errors in the location data.
- Individuals in sparsely populated postal codes could be re-identified from the aggregates. Correct answer.
Explanation
Aggregation by postal code and week can still allow re-identification when groups are small, such as in sparsely populated areas. This is a known privacy risk that governance must address through minimum group size thresholds or other disclosure controls. While other risks exist, re-identification is the most direct privacy harm from aggregated location data.
Question 31Statistics and Probability
A data science team records the number of support tickets received each day for 60 days. Which type of variable is the daily ticket count?
- Continuous quantitative variable
- Discrete quantitative variable Correct answer.
- Nominal categorical variable
- Ordinal categorical variable
Explanation
A count can only take whole-number values such as 0, 1, 2, and so on, so it is quantitative and discrete. Continuous variables would require values measurable at any precision within a range, which ticket counts are not.
Question 32Statistics and Probability
A survey asks respondents to choose their preferred programming language from Python, R, SQL, or Julia. Which measure of central tendency is most appropriate for summarizing these responses?
- The mean of the coded values
- The mode Correct answer.
- The interquartile range
- The median
Explanation
Preferred language is a nominal variable, so the only meaningful summary of center is the most frequent category, which is the mode. Means and medians require an ordered or numeric scale.
Question 33Statistics and Probability
For a roughly symmetric distribution of model training times, which pair of statistics best describes center and spread together?
- Median and interquartile range
- Mode and range
- Mean and standard deviation Correct answer.
- Minimum and maximum
Explanation
When a distribution is roughly symmetric and free of strong outliers, the mean and standard deviation jointly describe center and spread efficiently. Median and IQR are preferred when the data are skewed or contain outliers.
Question 34Statistics and Probability
An analyst computes the sample standard deviation of a dataset of 25 observations using n in the denominator instead of n minus 1. How does this error affect the result?
- The computed value is smaller than the correct sample standard deviation Correct answer.
- The computed value is larger than the correct sample standard deviation
- The computed value is unchanged
- The computed value becomes negative
Explanation
Dividing the same sum of squared deviations by n rather than n minus 1 gives a smaller quotient, so the computed standard deviation is biased downward. The correction by n minus 1 accounts for the loss of one degree of freedom when the sample mean is estimated.
Question 35Statistics and Probability
A dataset of household incomes is strongly right-skewed with a few very large values. Which statement about its summary statistics is correct?
- The median exceeds the mean
- The standard deviation is zero
- The mean exceeds the median Correct answer.
- The mean and median are equal
Explanation
In a right-skewed distribution the long right tail of large values pulls the mean upward, so the mean lies above the median. The median stays near the bulk of the data because it depends on position rather than magnitude.
Question 36Statistics and Probability
A fair six-sided die is rolled once. What is the probability of rolling a number greater than 4?
- One third Correct answer.
- One sixth
- One half
- Two thirds
Explanation
The outcomes greater than 4 are 5 and 6, giving two favorable outcomes out of six equally likely outcomes. The probability is two sixths, which simplifies to one third.
Question 37Statistics and Probability
Events A and B satisfy P(A) = 0.5, P(B) = 0.4, and P(A and B) = 0.2. What is P(A or B)?
- 0.9
- 0.3
- 0.5
- 0.7 Correct answer.
Explanation
The addition rule states that P(A or B) equals P(A) plus P(B) minus P(A and B). Substituting gives 0.5 plus 0.4 minus 0.2, which equals 0.7.
Question 38Statistics and Probability
Two events A and B are independent with P(A) = 0.3 and P(B) = 0.6. What is P(A and B)?
- 0.5
- 0.45
- 0.18 Correct answer.
- 0.9
Explanation
For independent events the multiplication rule gives P(A and B) equals P(A) times P(B). Multiplying 0.3 by 0.6 yields 0.18.
Question 39Statistics and Probability
In a medical screening test, which probability does the positive predictive value of the test represent?
- The probability of testing positive given that the person has the disease
- The probability of testing positive given that the person does not have the disease
- The probability of having the disease given that the person tested positive Correct answer.
- The probability that the test agrees with the true disease status
Explanation
Positive predictive value is the conditional probability of disease given a positive result, so it reverses the conditioning used in sensitivity. It depends on disease prevalence as well as on the test's sensitivity and specificity.
Question 40Statistics and Probability
A random variable X takes value 0 with probability 0.6 and value 10 with probability 0.4. What is the expected value of X?
- 4 Correct answer.
- 6
- 10
- 5
Explanation
The expectation is the probability-weighted sum of the possible values. Computing 0 times 0.6 plus 10 times 0.4 gives 4.
Question 41Statistics and Probability
A random variable has mean 50 and standard deviation 5. Using Chebyshev's inequality, what can be guaranteed about the probability that an observation lies within 2 standard deviations of the mean?
- At most 0.25
- At least 0.95
- At least 0.75 Correct answer.
- Exactly 0.68
Explanation
Chebyshev's inequality states that the probability of being within k standard deviations of the mean is at least 1 minus 1 over k squared. For k equal to 2 this bound is 1 minus 0.25, which equals 0.75.
Question 42Statistics and Probability
A binomial experiment consists of 10 independent trials, each with success probability 0.2. What is the mean number of successes?
- 5
- 2 Correct answer.
- 8
- 0.2
Explanation
The mean of a binomial random variable equals n times p. Multiplying 10 trials by a success probability of 0.2 gives an expected 2 successes.
Question 43Statistics and Probability
For a binomial distribution with n = 200 and p = 0.5, which normal approximation is most appropriate when applying the continuity correction?
- Mean 100 and standard deviation 50
- Mean 200 and standard deviation 10
- Mean 100 and standard deviation 7.07 Correct answer.
- Mean 50 and standard deviation 100
Explanation
The normal approximation to the binomial uses mean np and standard deviation the square root of np times 1 minus p. Here that gives mean 100 and standard deviation the square root of 50, about 7.07.
Question 44Statistics and Probability
In a sampling distribution of the sample mean, what happens to the standard error as the sample size increases from 100 to 400, assuming the population standard deviation is fixed?
- It stays the same
- It doubles
- It quadruples
- It halves Correct answer.
Explanation
The standard error equals the population standard deviation divided by the square root of n. Quadrupling n doubles the denominator, so the standard error is halved.
Question 45Statistics and Probability
A population has mean 80 and standard deviation 20. For samples of size 25, what is the standard deviation of the sampling distribution of the sample mean?
- 0.8
- 4 Correct answer.
- 20
- 80
Explanation
The standard error of the mean equals sigma divided by the square root of n. Here 20 divided by the square root of 25, which is 5, gives 4.
Question 46Statistics and Probability
A 95 percent confidence interval for a population mean is computed as 12.4 plus or minus 1.8. Which interpretation is correct?
- There is a 95 percent probability that the population mean lies between 10.6 and 14.2
- 95 percent of the sample observations lie between 10.6 and 14.2
- The sample mean lies between 10.6 and 14.2 with 95 percent confidence
- In repeated sampling, about 95 percent of intervals constructed this way would contain the population mean Correct answer.
Explanation
The confidence level describes the long-run coverage of the procedure: about 95 percent of intervals built by this method capture the fixed population mean. Once a specific interval is computed, the population mean is either inside it or not.
Question 47Statistics and Probability
A hypothesis test is conducted at the 5 percent significance level. What does the significance level represent?
- The probability of rejecting a true null hypothesis Correct answer.
- The probability that the null hypothesis is true
- The probability that the alternative hypothesis is true
- The probability of failing to reject a false null hypothesis
Explanation
The significance level alpha is the maximum tolerated probability of a Type I error, meaning rejecting the null hypothesis when it is actually true. It is chosen before seeing the data and does not state the probability that either hypothesis is true.
Question 48Statistics and Probability
A test yields a p-value of 0.03. Which conclusion is appropriate at the 5 percent significance level?
- Increase the sample size before deciding
- Accept the null hypothesis as true
- Conclude that the effect is practically important
- Reject the null hypothesis Correct answer.
Explanation
A p-value of 0.03 is below the 0.05 threshold, so the null hypothesis is rejected in favor of the alternative. Failing to reject would require a p-value larger than the significance level.
Question 49Statistics and Probability
A two-sample t-test returns a 95 percent confidence interval for the difference in means of negative 0.4 to 2.9. What does this interval imply about a test of no difference at the 5 percent level?
- The null hypothesis of no difference is rejected
- The test is invalid because the interval contains zero
- The null hypothesis is accepted as true
- The null hypothesis of no difference is not rejected Correct answer.
Explanation
The interval includes zero, so zero is a plausible value for the difference in means and the null hypothesis is not rejected at the 5 percent level. A confidence interval and a two-sided test at the matching level always agree in this way.
Question 50Statistics and Probability
A researcher tests whether the mean delivery time differs from 30 minutes and obtains a test statistic of t = 2.1 with 19 degrees of freedom. For a two-sided test, which region describes the p-value?
- The area between negative 2.1 and 2.1
- Twice the area to the right of 2.1 Correct answer.
- The area to the right of 2.1 only
- The area to the left of negative 2.1 only
Explanation
A two-sided test counts extreme values in both tails, so the p-value is twice the one-tailed area beyond the observed statistic. The t distribution is symmetric, which makes doubling the upper-tail area correct.