Exam AB-731 Topic 1 Question 11 Discussion

Preventing generative AI from accessing confidential or classified information is primarily a data access and classification control problem. The most effective broad solution is data governance (B) -the framework of policies and controls that ensures sensitive content is identified, classified, protected, and access is restricted using least privilege. Data governance includes information classification/sensitivity labels, access control reviews, secure sharing practices, data loss prevention (DLP), and auditing-controls that directly limit what data is available to the AI through permission trimming and policy enforcement.
An information barrier (A) policy is more specific: it's intended to prevent communication and collaboration between defined user groups (often for regulatory/ethical walls). It does not comprehensively address document classification or restrict AI access to sensitive files across the tenant. A data retention policy (C) governs how long content is kept and when it's deleted; it's not a primary access-prevention mechanism. Communication monitoring (D) is a detection/oversight control; it can help identify risky activity, but it does not itself prevent access to confidential content by the AI.
Therefore, to prevent AI from surfacing confidential/classified data during summarization and analysis, you should recommend data governance as the primary control layer.