4.6 - Privacy, compliance and AI limitations
CompTIA A+ Core 2 objective 4.6 covers privacy, compliance and the limits of emerging tools. When a help desk uses an AI chatbot to draft replies, the key limitation technicians must remember is that it can give confident but incorrect answers (hallucinations) and bias, so a human should review its output. Personally identifiable information (PII) and protected health information (PHI) must be handled with extra care under privacy regulations. Data that includes cardholder numbers must follow the PCI DSS standard. A software license, whether per-seat or open source, defines the legal terms of use. Expect scenario questions that describe sensitive data, a compliance standard or an AI-assisted workflow and ask what rule applies or what limitation to watch for. Handling this data carelessly can breach the law, not just company policy, so the cautious, compliant choice is the safe answer.
AI chatbot limit = confident but wrong (hallucination) + bias -> human review. Personal/health data = PII/PHI (extra care). Card numbers = PCI DSS. License (per-seat/open source) = legal terms of use.
Practice questions
1. Which type of data must be handled with extra care under privacy regulations?
- Public marketing flyers
- PII/PHI (personal/health data) (correct answer)
- Royalty-free stock photos
- Public open-source code
PII (and PHI) must be protected and handled per regulations (e.g., GDPR/HIPAA): limit access, encrypt, dispose securely.
2. What is the purpose of a software license (e.g., per-seat vs open source)?
- To make the app run faster
- To define legal terms of use (correct answer)
- To encrypt the application
- To back up the app's data
Licenses define legal usage rights: per-seat/concurrent, subscription, OEM, or open source — comply to avoid legal/security risk.
3. A help-desk team integrates an AI chatbot to draft customer replies. Which limitation should technicians be MOST aware of when relying on its answers?
- It can give confident but incorrect answers (hallucinations) (correct answer)
- It always needs a dedicated GPU on each workstation
- It cannot accept plain text as its input
- Its answers are always legally verified first
Generative AI can 'hallucinate' — produce plausible but false information — and can reflect bias in its training data. Outputs must be reviewed by a human before being trusted or sent.
4. A help desk uses an AI assistant to draft replies. Which limitation must technicians watch for MOST?
- It is unable to read any text input
- Confident but incorrect answers and bias (correct answer)
- It works without any electricity at all
- It is always legally compliant by design
Generative AI can produce plausible but false 'hallucinations' and reflect bias; outputs need human review before use.
5. Data that includes cardholder numbers must follow which compliance standard?
- HIPAA
- PCI DSS (correct answer)
- ISO 9001
- Energy Star
PCI DSS governs payment-card data handling. HIPAA covers health data; both require strict protection.
6. While working you must handle a folder of confidential HR records. What is correct?
- Copy them for later reference
- Access only what the job needs (correct answer)
- Share them with your colleagues
- Post about the case online
Treat confidential/PII data with least access, confidentiality and per-policy handling — never copy, share or disclose it.