CCAO-F practice questions: Governance, risk, and responsible use.

A colleague wants to paste a customer's full medical file into a consumer chat account to summarize it. What is the right response?

• Paste it, get the summary, and delete the conversation from the account history afterwards
• Remove the customer's name and date of birth, then paste the rest into the consumer account
• Ask the customer for written consent by email first, then paste the file into the consumer account
• Check the data policy first and use an approved workspace with the right settings, if one exists

Claude drafts screening criteria for job applicants. What must happen before they are used?

• A review for bias and legality by the people who are accountable for the hiring decision
• A check that each criterion appears in the job posting so applicants know how they are assessed
• A comparison against the criteria a competitor lists publicly to make sure nothing is missing
• A trial run against last year's applicant pool to confirm the criteria produce a sensible shortlist

Which content should not be pasted into a tool your organization has not approved for it?

• Product descriptions that are already on the public website
• Your own meeting notes from an internal planning session
• Customer personal data, health records, or confidential financials
• Press releases the company published in the last quarter

Why does responsible use require a named person accountable for AI-assisted decisions?

• Because it gives the organization a single person to hold responsible when the model makes a costly error
• Because the vendor's terms of service transfer liability for outputs to the customer
• Because the model cannot be accountable; a person must be able to explain and stand behind the outcome
• Because regulators require a named AI officer to be listed for every automated decision

Claude drafts performance review language for an employee. Which risk is highest?

• Formatting that does not match the HR system's review template and has to be redone by hand
• Language so generic that it gives the employee nothing concrete to act on in the coming year
• Bias in the language or reasoning affecting a person's career, so it needs careful human review
• Length that runs well past what managers are expected to write for an annual review

What does an acceptable use policy typically prohibit?

• Using the tool for harmful, deceptive, or otherwise prohibited purposes
• Asking questions about topics that are unrelated to your job role
• Sharing outputs with anyone outside the team that produced them
• Using the tool for any task that involves customer names or contact details

A vendor claims its AI tool 'never makes mistakes'. Your response?

• Ask the vendor for the accuracy benchmarks behind the claim and accept it if they look strong
• Include the claim in the contract so the vendor bears the cost of any mistakes
• Treat the claim as false and design review steps into the workflow anyway
• Run a two-week pilot and drop the review steps once the pilot shows no errors

What should you do if Claude produces content that seems to reproduce a copyrighted text at length?

• Shorten the passage so that it falls under what fair use typically allows
• Use it, since content produced by an AI tool is not subject to copyright
• Cite Claude as the author so the original rights holder is not misrepresented
• Do not use it verbatim; rewrite or source it properly, and flag the case

Which practice supports transparency when AI helped produce a document?

• Keeping AI-assisted drafts out of the document history so reviewers see only the final
• Disclosing AI assistance where your organization's policy or the audience expects it
• Publishing under a team name rather than an individual so no one is misattributed
• Adding a footnote naming the model version used on every document you produce