Compliance
47 bites tagged Compliance — interview questions with model answers, and 60-second explainers.
Modeling TCO and risk for a new market
Enumerate build, compliance, and run costs; quantify technical risk and timelines; tie payback to revenue. Whether you connect engineering cost to business viability.
Data lineage and machine unlearning for a fine-tuned LLM
Version and fingerprint datasets, record transforms and which checkpoint saw what, and enable unlearning via retraining, data sharding, or approximate gradient methods. Auditable lineage plus practical unlearning.
Audit an ML pipeline for GDPR compliance
Inventory data and check minimization, verify processing matches stated purpose, build lineage to trace any prediction's inputs. applying GDPR principles technically.
Automatically moderate user-generated ad copy
A layered pipeline of fast keyword/regex filters plus an ML text classifier, with human review for borderline cases. moderation design and tradeoffs. a keyword blocklist alone, which misses context and is easily evaded.
Balance agility and compliance in regulated cloud
PaaS for speed where allowed, IaaS where control is required, enforced by encryption, IAM least privilege, network isolation, policy-as-code guardrails, and continuous audit logging. compliance-aware architecture.
Lifecycle storage tiering for compliance logs
Hot tier for 7-day query window, lifecycle rules transitioning to infrequent-access then archive, expiration at one year. object storage lifecycle design.
Enforce a cloud resource compliance policy
Prevent at creation with org policies or admission checks, detect violations via continuous config scanning, and auto-remediate by stripping the IP or alerting owners. policy-as-code guardrails. manual periodic audits only.
Architecting for HIPAA or PCI DSS compliance
Isolate sensitive data in restricted networks and accounts, encrypt at rest and in transit with managed keys, enforce least-privilege access, and keep immutable audit logs. building auditable, compliant data handling.
Automating a no-public-IP governance rule
Use organization-level policy guardrails (SCP, Azure Policy, Org Policy) to deny public IP attachment before creation, applied across all accounts. preventive policy-as-code governance.
Service-managed vs customer-managed vs BYOK keys
Service-managed keys are automatic but opaque; CMK gives you control over rotation, policy, and revocation in a KMS; BYOK imports your own key material for compliance. key management control versus burden.
When hybrid cloud beats public or private
Give a scenario like regulated data plus bursty compute; keep sensitive data and legacy systems on-prem, run scalable or customer-facing workloads in public cloud. justifying hybrid with a concrete case.
Enforcing GDPR Right to be Forgotten at scale
Map the subject's data, then crypto-shred the lake, DELETE in the warehouse, and evict caches via an auditable, idempotent workflow. Privacy engineering across stores. Assuming one DELETE suffices everywhere.
Design a globally compliant, low-latency research backend architecture
Partition by region with local storage, ingest at the edge, aggregate anonymized metrics cross-border. Geo-distributed architecture under strict data sovereignty.
How do you fulfill a GDPR erasure request across data stores?
This tests cross-system deletion under GDPR's 30-day SLA. A strong answer maps PII lineage across S3, databases, and analytics; uses soft deletes for backups; and handles dashboards via reprocessing.
Implement verifiable informed consent before a remote usability test
This tests whether you treat GDPR consent as an architectural gate. Strong answers cover CMP-powered pre-session disclosure, gating the test on active consent, server-side recording for auditability, and first-party data alignment.
Informed Consent Is Comprehension, Not Paperwork
Informed consent means understanding risks and alternatives before agreeing. It applies whenever researchers collect sensitive data or expose people to risk. The footgun is treating a signature as proof of understanding; comprehension beats paperwork.
How would GDPR requirements influence experiment tracking and model management design?
Immutable data lineage, user exclusion lists, audit logs, versioned explainability. designing for compliance as a systems constraint, not an afterthought. manual deletion without model unlearning or provenance.
Model Risk Management: The Immune System for Production Models
Model Risk Management treats every deployed model as a liability that can silently decay. Banks use it to stop bad predictions from becoming bad decisions. The footgun is treating validation as a one-time checkbox instead of continuous governance.
NIST AI RMF for LLM Deployment
The NIST AI RMF is a pre-flight checklist for organizational AI risk, not just code bugs. Teams use it to justify LLM deployment across legal, security, and fairness dimensions.
Apple HIG Compliance
Apple's HIG is the rulebook for native iOS and macOS apps. Compliance means matching platform conventions for layout and navigation. The footgun is treating it as a visual skin while ignoring interaction patterns, making apps that look right but feel wrong.
How would you handle a DMCA takedown notice for image uploads?
Tests forensic logging and compliance workflow. A strong answer covers immutable upload hashes, content-addressable storage, a legal-hold workflow, and counter-notice handling. Red flag: suggesting hard deletion without preserving evidence or due process.
Describe the technical steps for displaying and enforcing a cookie consent banner.
Tests privacy-first frontend architecture. Outline: check consent record, render banner if absent, classify scripts as essential or non-essential, persist choice, and inject tracking only after explicit opt-in.
Design a GDPR 'Right to be Forgotten' System
Tests your ability to design a verifiable data deletion system. A good answer outlines an index metastore, an orchestrated workflow, and auditing. A red flag is focusing only on the primary database, ignoring the data lake, warehouse, and caches.
GDPR for UX Research: Beyond the Consent Form
GDPR forces you to treat user data with respect: collect only what you need for a specific purpose and keep it safe. It applies to all research involving personal data from EU residents. The biggest footgun is collecting data "just in case."
Get Compliance bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
Open testing — you’ll join as an early tester.