Data Privacy and Data Protection in Finance Testing CT-FT Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A test team discovers that a test database containing unmasked customer data was accidentally exposed to the internet for several hours. The team has already notified the incident response team. The incident response team is investigating whether any data was accessed. The compliance team asks for a report on the breach. What should the test team provide to the compliance team?

   • AA summary of the database schema and the types of data stored.
   • BA copy of the database backup to analyze for potential exposure.
   • CA detailed log of all access attempts to the database during the exposure period.
   • DA list of all customers whose data was in the database.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   A bank stores customer transaction data for regulatory compliance. According to the storage limitation principle, what should the bank do with this data?

   • AAnonymize the data after each transaction to allow indefinite storage
   • BRetain the data only for as long as required by law or for the purpose it was collected, then securely delete it
   • CKeep the data indefinitely to avoid any risk of non-compliance
   • DDelete the data as soon as the transaction is completed
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   When should a Privacy Impact Assessment (PIA) be conducted for a new testing initiative?

   • AOnly if a data breach occurs
   • BAt the beginning of the project, before the testing activities start
   • COnly when required by the test manager
   • DOnly after the testing is complete
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A testing team is working with a dataset that includes customer names, addresses, and social security numbers. They need to use this data for integration testing with a third-party system. The third party must be able to match records across systems, but should not be able to identify the actual customers. Which technique should the team use?

   • APseudonymization by replacing names and SSNs with consistent tokens.
   • BEncryption of the entire dataset with a shared key.
   • CMasking of all fields except the account number.
   • DAnonymization by removing all identifiers and using random values.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is a secure method for transmitting financial test data between environments?

   • ACopying the data to a USB drive and mailing it
   • BSending the data via email as an attachment
   • CUsing SFTP (SSH File Transfer Protocol) with encryption
   • DUsing FTP (File Transfer Protocol) without encryption
   Reveal Solution Discussion Select an answer first