Governance, Risk, and Responsible Use

Question 1 · 6.1

A mortgage adviser at a building society wants to speed up applications. She proposes pasting each applicant’s income and credit summary into Claude and asking whether the application should be approved, then sending the answer to underwriting.

What is the best assessment of this proposal?

• AAcceptable, because underwriting still sees the file afterwards.
• BProhibited outright by the Usage Policy, as lending is on the banned list.
• CHigh-risk: allowed only with a qualified human deciding and AI use disclosed to the applicant.
• DFine as long as she removes the applicant’s name before pasting the details.

Question 2 · 6.1

An operations manager asks Claude, in a plain chat with nothing attached, what his company’s supplier payment terms are. Claude answers confidently with a 45-day figure. The real terms are 30 days.

Which gate did this task fail, and what is the fix?

• AGate 1, permission — internal finance data is off limits.
• BGate 3, fitness — the answer had no source, so attach the supplier agreement and ask again.
• CNo gate — Claude was simply out of date and a newer model would know.
• DGate 2, high-risk — payment terms are a financial decision.

Question 3 · 6.1

A hospital communications team wants a public-facing chatbot on its website that answers questions about clinic opening times, parking and how to book, using content from the hospital’s own pages.

Which two requirements apply most directly to this deployment? (Select 2.)

• AThe chatbot must disclose to users that they are interacting with an AI.
• BIts answers must be grounded in the hospital’s own published content rather than the model’s general knowledge.
• CThe deployment is prohibited because healthcare is a banned domain.
• DEvery answer must be reviewed by a clinician before it is shown.
• EThe hospital must obtain written consent from each visitor before they use it.

Question 4 · 6.1

Your team is writing its green/amber/red use-case list. Which entry is correctly placed?

• AAmber: rewriting an internal meeting summary you dictated.
• BGreen: answering customer emails automatically without anyone reading them.
• CRed: compiling a dossier on a named private individual from public sources.
• DRed: drafting a press release from an approved fact sheet.

Question 5 · 6.2

A clinic administrator on a Team plan wants help rewording a patient’s appointment letter. The letter names the patient and states their diagnosis. She asks whether switching on an incognito chat makes this acceptable.

What is the best response?

• AYes — incognito chats are excluded from training and not saved to history.
• BNo — remove the name and diagnosis and describe what the letter must convey instead.
• CYes, provided she deletes the chat immediately after copying the result.
• DNo — but upgrading the organisation to Enterprise would make it acceptable.

Question 6 · 6.2

An employee on a Team plan has been using incognito chats for personal job-hunting conversations, believing the organisation cannot see them.

Which statement about that belief is correct?

• AIt is correct; incognito chats are never visible to the organisation.
• BIt is incorrect; on Team and Enterprise these chats still appear in organisational data exports.
• CIt is correct as long as model improvement is switched off in privacy settings.
• DIt is incorrect because incognito chats are unavailable on Team plans.

Question 7 · 6.2

Which two ideas from the GDPR map most directly onto everyday use of an AI assistant at work? (Select 2.)

• AData minimisation — personal data must be limited to what is necessary.
• BThe right not to be subject to a decision based solely on automated processing.
• CThe requirement to appoint a data protection officer in every company.
• DThe obligation to store all personal data inside the European Union.
• EThe rule that consent is always required before processing personal data.

Question 8 · 6.2

A team lead is writing a one-page rule for using Claude with customer correspondence. She has four candidate first lines and can only fit one at the top.

Which line should lead the page?

• AAlways use an incognito chat for customer correspondence.
• BCheck the privacy settings on your account every month.
• CRemove names, addresses and account numbers before you paste anything.
• DNever use Claude for anything involving a customer.

Question 9 · 6.3

A marketing manager’s employer has an AI policy allowing Claude for internal drafting only, with anything customer-facing reviewed by the brand lead. She is under deadline, the brand lead is on leave, and the campaign email is clearly harmless.

What should she do?

• ASend it — the policy’s purpose is to catch risky content, and this is not risky.
• BFind the escalation route or a stand-in approver, and flag it if there is none.
• CUse an incognito chat so the draft is not retained, then send it.
• DAsk Claude whether the email complies with the company policy.

Question 10 · 6.3

An Enterprise Primary Owner has been asked to reduce how long conversation data is kept, from the default to ninety days, ahead of an audit.

Which two statements about doing this are correct? (Select 2.)

• AThe default is indefinite retention until a custom period is set.
• BData falling outside the new period is scheduled for permanent, irreversible deletion.
• CDeletion happens immediately when the setting is saved.
• DAny organisation member can change the retention period.
• ESetting a retention period also removes the need for organization instructions.

Question 11 · 6.3

A team lead wants every chat in her organisation to avoid using client names and to remind staff that advice drafts need partner sign-off.

What is the appropriate mechanism, and what is its main limitation?

• AA project with those rules in its instructions; the limitation is that projects expire.
• BA monthly email reminder; the limitation is that people delete emails.
• CCustom data retention controls; the limitation is the thirty-day minimum.
• DOrganization instructions set by an Owner; the limitation is that they guide rather than enforce.

Question 12 · 6.3

An operations analyst has been pasting extracts of supplier contracts into his own personal Claude subscription for two years. His employer has just rolled out a Team account and an AI policy.

What is the most appropriate response to his past use?

• AMove his work to the company account, and tell the data owner what went through the personal one.
• BNothing needs to change, since the Usage Policy permitted everything he did.
• CDelete the personal chats quietly so there is no record of the breach.
• DKeep using the personal account until the Team account has all the same features.

Question 13 · 6.4

A bereavement team at a utility company uses Claude to draft condolence letters to the families of deceased account holders. The letters are warm, accurate and signed by the customer care director, who does not read them individually.

What is the strongest ethical objection?

• AThe letters process personal data about a deceased person without consent.
• BThe signature implies personal attention the recipient did not receive.
• CThe Usage Policy prohibits AI-generated correspondence to consumers.
• DClaude cannot write with genuine emotion, so the letters will read as hollow.

Question 14 · 6.4

A lettings agency asks Claude to summarise each tenancy application and say whether the applicant “seems like a reliable tenant”. An analyst suspects the summaries are not treating all applicants alike.

What is the most effective way to find out, and the best remedy?

• AAsk Claude whether its own summaries are biased, and then act on the answer it gives.
• BSwitch to a larger model, since stronger models exhibit less bias.
• CRun two applications differing only in name, then ask for evidence against fixed criteria.
• DAdd “be unbiased and fair to all applicants” to the prompt.

Question 15 · 6.4

A local council plans a website assistant that answers residents’ questions about bin collections, council tax bands and planning applications, drawing on published council pages.

Which two obligations follow most directly from the ethical and policy considerations in this lesson? (Select 2.)

• AResidents must be told they are interacting with an AI rather than a person.
• BA named officer must remain answerable for what the assistant tells residents.
• CEvery resident must give consent before their question is processed.
• DThe assistant must refuse all planning questions as a high-risk legal use.
• EThe council must publish the model’s training data before launch.

Question 16 · 6.4

Which statement best describes the relationship between Anthropic’s safeguards and a user’s responsibility?

• ASafeguards handle harm at scale; the user still owns the accuracy and fairness of their own output.
• BBecause Claude is evaluated for bias before release, user-side bias checks are unnecessary.
• CReal-time classifiers block any output that would harm someone, so review is a formality.
• DResponsibility rests with Anthropic, since it controls the model’s behaviour.