CCAO-F questions and answers — Domain 6: Governance, Risk and Responsible Use

9 practice questions on Governance, Risk and Responsible Use, the domain weighted at 15% of the CCAO-F exam. Every answer explains why the distractors fail — that is the part that transfers to questions you have not seen before.

Question 1

Which use requires both qualified human review and disclosure that AI was involved?

1. Drafting an internal team newsletter
2. Preparing an insurance claim determination
3. Summarising a public webinar
4. Reformatting a spreadsheet

Answer: B. Insurance determinations are one of the recognised high-risk categories — alongside legal, healthcare, financial advice, employment, housing and lending, academic assessment and journalism — where a qualified professional must review the output and the people affected must be told AI was used.

Question 2

An employee wants to paste a customer list including names, emails and purchase history into Claude to draft segmented messaging. What should happen first?

1. Nothing; the tool is company-approved
2. Check what the organisation's policy permits for this data class, and remove or anonymise identifiers that the task does not need
3. Use incognito chat, which makes it acceptable
4. Get the customers' permission

Answer: B. Tool approval and data classification are separate questions, and data minimisation applies regardless: segmentation logic rarely needs real names and addresses. Incognito controls retention and training use, not whether you were permitted to process the data at all.

Question 3

On a Free or Pro plan, how are conversations treated for model improvement by default?

1. They are always used for training
2. Training on conversations is opt-in and off unless the user turns it on
3. They are used only if the conversation is deleted
4. They are used after 30 days

Answer: B. On consumer plans it is an opt-in setting, off by default. Where a user has enabled it, data may be retained de-identified in training pipelines for up to five years, and deleting a conversation stops future use. Incognito chats are excluded regardless of the setting.

Question 4

Which statement about commercial plans is correct?

1. Team and Enterprise data is used for training unless you opt out
2. Customer content on Team, Enterprise and the API is not used to train models by default
3. Commercial plans have the same training defaults as consumer plans
4. Only Enterprise excludes training use

Answer: B. Not training on commercial customer content by default is precisely what makes those plans appropriate for company work. It does not, however, remove obligations under GDPR, HIPAA or contractual confidentiality — those attach to the data, not the vendor's retention practice.

Question 5

A user asks Claude to help identify security weaknesses in a competitor's public-facing systems. How should this be classified?

1. Acceptable, since the systems are public-facing
2. A prohibited use — probing systems you are not authorised to test
3. Acceptable if the findings are reported to the competitor
4. Acceptable if no exploit is actually run

Answer: B. Discovering vulnerabilities without authorisation is prohibited outright. Public accessibility is not authorisation, and intending to disclose responsibly afterwards does not make unauthorised probing permitted.

Question 6

Which is the correct handling of AI-assisted content in a customer-facing chatbot?

1. Disclosure is optional if the responses are high quality
2. Users must be told at the outset that they are interacting with an AI
3. Disclosure is only needed if the user asks
4. Disclosure is required only in regulated industries

Answer: B. Consumer-facing chatbots must make AI involvement clear at the start of the interaction. Quality of responses, whether the user thinks to ask, and industry are all irrelevant to that requirement.

Question 7

A colleague uploads a client's confidential report, covered by an NDA, to get a summary. What is the concern?

1. The summary may be inaccurate
2. Sharing material you are not licensed to share, regardless of how the AI vendor handles retention
3. It will use too much of the usage allowance
4. There is no concern if the plan is commercial

Answer: B. The contractual restriction attaches to the document. Whether a vendor trains on data is a separate question from whether you were permitted to disclose it to a third-party service in the first place, and a commercial plan does not override an NDA.

Question 8

Where does responsibility sit when Claude-assisted output turns out to contain an error that reached a customer?

1. With Anthropic, as the model provider
2. With the person who sent it
3. It is shared, since AI was involved
4. With whoever wrote the prompt

Answer: B. Accountability for output follows the person who acted on it. This is the principle underneath the whole exam: Claude drafts, and the person who sends, files or decides remains responsible.

Question 9

Which of these is permitted with safeguards rather than prohibited outright?

1. Generating malware for a security demonstration
2. Producing a first draft of legal analysis for a qualified solicitor to review
3. Creating synthetic media of a political figure
4. Building a system to track individuals without their consent

Answer: B. Legal work sits in the high-risk category: permitted when a qualified professional reviews and owns the output and AI involvement is disclosed. The other three fall under prohibited categories, and a stated benign purpose does not move them.

← Previous: Questions & answers — Domain 5  |  Next: Questions & answers — Domain 7 →