DA Data Ethics and Governance 2 — Questions and Answers
Question 1: Which technique replaces sensitive data with a non-sensitive placeholder that cannot be reversed without a lookup key?
- Encryption
- Anonymization
- Tokenization (Correct answer)
- Masking
Correct answer: Tokenization
Tokenization substitutes sensitive data with a randomly generated token; the original value can only be retrieved via a secure token vault.
Question 2: A company shares customer data with a third-party vendor for analysis. Which data governance control is most critical to establish first?
- Row-level security in the database
- A data sharing agreement or DPA (Correct answer)
- Data deduplication procedures
- An ETL pipeline for the transfer
Correct answer: A data sharing agreement or DPA
A Data Processing Agreement (DPA) or data sharing agreement legally defines how the third party may use, protect, and dispose of the data.
Question 3: What does 'data minimization' mean in the context of privacy regulations?
- Compressing data to reduce storage costs
- Collecting only the data necessary for the specified purpose (Correct answer)
- Reducing the number of data sources in a pipeline
- Aggregating data to remove row-level details
Correct answer: Collecting only the data necessary for the specified purpose
Data minimization is a GDPR principle requiring organizations to collect and retain only the data that is strictly necessary for a defined purpose.
Question 4: Which of the following is an example of implicit bias in a dataset?
- Missing values in a timestamp column
- A training dataset that underrepresents women in leadership roles (Correct answer)
- Duplicate records caused by a data entry error
- Inconsistent date formats across data sources
Correct answer: A training dataset that underrepresents women in leadership roles
Implicit bias occurs when historical patterns or systemic inequalities are reflected in the data, causing models trained on it to perpetuate those patterns.
Question 5: What is the difference between data anonymization and data pseudonymization?
- Anonymization is reversible; pseudonymization is not
- Pseudonymization replaces identifiers with codes that can be re-linked; anonymization is irreversible (Correct answer)
- They are identical processes with different names
- Pseudonymization applies only to financial data; anonymization applies to health data
Correct answer: Pseudonymization replaces identifiers with codes that can be re-linked; anonymization is irreversible
Pseudonymization replaces direct identifiers with pseudonyms but keeps a key that allows re-identification, while anonymization irreversibly removes all identifying information.
Question 6: A data analyst wants to publish aggregate statistics from a dataset. Which attack should they be most concerned about?
- SQL injection
- Re-identification through auxiliary data (Correct answer)
- Cross-site scripting
- Man-in-the-middle attack
Correct answer: Re-identification through auxiliary data
Re-identification attacks use external auxiliary data to link aggregate statistics back to individuals, compromising anonymization.
Question 7: In data ethics, what does the concept of 'informed consent' require?
- Individuals must be notified after their data is collected
- Individuals must clearly understand and voluntarily agree to how their data will be used before collection (Correct answer)
- Organizations must publish their data usage policies annually
- Data must be encrypted before subjects consent to its collection
Correct answer: Individuals must clearly understand and voluntarily agree to how their data will be used before collection
Informed consent requires that individuals are given clear, understandable information about data usage and voluntarily agree before their data is collected.
DA Data Ethics and Governance 2
Which technique replaces sensitive data with a non-sensitive placeholder that cannot be reversed without a lookup key?