Data Privacy and Data Protection in Finance Testing CT-FT Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A bank's test team needs to create a test dataset for a new credit scoring model. The dataset must include realistic income, credit score, and debt-to-income ratio values to ensure the model's accuracy. However, the team must also ensure that the data cannot be traced back to real customers. The team has decided to use data masking. Which masking strategy best balances realism and privacy?

   • AEncrypt the data and store the decryption key in the test environment.
   • BUse only synthetic data generated from scratch without any relation to real data.
   • CSubstitute real values with random values from the same statistical distribution.
   • DReplace all values with a constant value, such as the average income.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A fintech company is preparing a test dataset for a new payment feature. The dataset includes customer names, email addresses, and transaction histories. Under GDPR, the company wants to use this data for testing while minimizing the risk of re-identification. Which technique should they apply to the dataset?

   • AEncryption of the entire dataset with a strong algorithm and storing the key separately.
   • BTokenization of email addresses only, leaving names and transaction histories unchanged.
   • CAnonymization by removing all direct identifiers and applying k-anonymity to quasi-identifiers.
   • DPseudonymization by replacing names with unique codes and keeping the mapping table in the test environment.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the key difference between anonymization and pseudonymization?

   • AAnonymization removes the ability to re-identify individuals, while pseudonymization allows re-identification with additional information
   • BAnonymization is a legal requirement, while pseudonymization is optional
   • CAnonymization is used only for financial data, while pseudonymization is used for all data
   • DAnonymization is reversible, while pseudonymization is irreversible
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   A financial institution is designing a new credit scoring system. According to the data protection principle of data minimization, which of the following is the most appropriate approach?

   • ACollect all available customer data to ensure the model is as accurate as possible
   • BCollect data with the customer's consent and use it for any future purposes
   • CCollect data and later delete any fields that are not used
   • DCollect only the data fields that are strictly necessary for the credit scoring purpose
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   During a load test, a tester discovers that a test database containing unmasked customer data was accidentally exposed to the internet for a brief period. The exposure was logged, but the tester is unsure if any data was accessed. What should the tester do first?

   • ADelete the exposed database and restore from a backup.
   • BImmediately notify the incident response team and the data protection officer.
   • CWait to see if any data is actually accessed before reporting.
   • DChange the database password and continue testing.
   Reveal Solution Discussion Select an answer first