Module 09 Knowledge Check
5 questions. Pass mark 4 out of 5. Answer every question before checking the answer key below, then retry after reading the feedback.
1. Access control in a knowledge assistant must be applied…
- A. In the system prompt
- B. At retrieval, so restricted content never enters the context
- C. After generation
- D. By the user
2. When a source document is deleted, the retrieval index must…
- A. Be left alone
- B. Have its chunks and embeddings removed too
- C. Be rebuilt yearly
- D. Keep a copy
3. Embeddings of confidential text should be treated as…
- A. Anonymous numbers
- B. Sensitive derived data that can leak information about the source
- C. Public
- D. Temporary
4. Logging user questions and retrieved passages is useful but requires…
- A. Nothing special
- B. A retention policy and access controls, because logs now contain sensitive content
- C. Only more storage
- D. Encryption of the model
5. Data minimisation in RAG means…
- A. Fewer documents overall
- B. Indexing only what the use case actually requires, and excluding unnecessary personal fields
- C. Shorter answers
- D. Smaller embeddings
---
Answer Key and Explanations
Check these only after attempting every question.
1. B - At retrieval, so restricted content never enters the context
Once restricted text is in the context window, you are relying on model compliance rather than a control.
2. B - Have its chunks and embeddings removed too
Orphaned chunks keep answering from content that no longer exists - a real deletion and compliance problem.
3. B - Sensitive derived data that can leak information about the source
Embeddings are not anonymisation; treat the index with the same care as the documents behind it.
4. B - A retention policy and access controls, because logs now contain sensitive content
Debug logs quietly become a second copy of your confidential corpus plus user intent.
5. B - Indexing only what the use case actually requires, and excluding unnecessary personal fields
The smallest sufficient corpus limits the blast radius of any leak or mis-scoped retrieval.
Practical Check
Apply this module to your own work: complete the module activity for *Privacy, Access Control, and Document Lifecycle*, then write one sentence naming what your result shows and one naming what it does not.
Strong Answer Pattern
A strong answer names the task, the evidence used, the check performed, and the remaining limitation. It avoids "proved", "guaranteed", or "always" unless the evidence genuinely supports it.