Data Privacy and Data Protection in Finance Testing CT-FT Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A bank's test team needs to refresh the QA environment with production data containing customer names, account numbers, and transaction amounts. The QA environment is shared with an external vendor for UAT. The team must preserve realistic data distributions for performance testing while ensuring the vendor cannot identify real customers. Which approach best meets these requirements?

   • AUse only synthetic transaction data and exclude all customer-related fields from the test environment.
   • BApply irreversible masking to names and account numbers while preserving the format and distribution of transaction amounts.
   • CReplace all customer names with random names, and use a reversible format-preserving encryption for account numbers.
   • DEncrypt the entire database and provide the vendor with the decryption key for testing.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A financial institution is subject to the California Consumer Privacy Act (CCPA) because it collects personal information from California residents. Which of the following is a specific requirement that the CCPA imposes on the institution regarding the handling of that personal information?

   • AAppointing a Data Protection Officer (DPO) in all cases
   • BProviding consumers with the right to request deletion of their personal information
   • CConducting a Data Protection Impact Assessment (DPIA) for every processing activity
   • DObtaining explicit opt-in consent before collecting any personal information
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A credit union is developing a new loan approval system. The test team needs to verify the system's logic using historical loan applications that include income, credit score, and account balance. The team only needs the data for one week of testing. According to the data protection principle of storage limitation, what should the team do?

   • AKeep the data for future regression testing to avoid recreating it.
   • BStore the data in a secure archive for audit purposes.
   • CAnonymize the data and keep it indefinitely for analysis.
   • DDelete the test data after the one-week testing period is complete.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   In the context of financial data, which of the following is an example of personally identifiable information (PII) that is also considered sensitive?

   • ACustomer's social security number (or national ID)
   • BCustomer's city of residence
   • CCustomer's first name
   • DCustomer's email address
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A financial institution's test team is required to maintain an audit trail of all access to test data containing personal information. The compliance team has asked for evidence that the audit trail is effective. What should the test team implement to meet this requirement?

   • AConduct regular backups of the test data.
   • BRestrict access to test data to only the test manager.
   • CEnable detailed logging of all access to test data, including user, timestamp, and action.
   • DUse encryption to protect the test data from unauthorized access.
   Reveal Solution Discussion Select an answer first