Data Privacy and Data Protection in Finance Testing CT-FT Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A financial institution is developing a new feature that uses customer spending patterns to offer personalized financial advice. The test team wants to use real customer data to test the feature. The ethics committee has raised concerns about the potential for harm if the data is misused. The team has decided to use pseudonymized data. What additional measure should the team implement to address the ethical concerns?

   • AImplement strict access controls and ensure that the pseudonymization key is stored separately and securely.
   • BPublish the pseudonymization key in the test environment for transparency.
   • CObtain consent from all customers before using their data.
   • DUse a weaker pseudonymization technique to make the data easier to work with.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following is considered sensitive financial data that requires higher protection under data privacy regulations?

   • ACustomer's shoe size
   • BCustomer's public social media posts
   • CCustomer's account number
   • DCustomer's favorite color
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   During a testing activity, a tester discovers that sensitive financial data has been accidentally exposed to an unauthorized person. What is the first step in the data breach response process?

   • ADelete all test data to prevent further exposure
   • BIgnore the incident if it was only a test environment
   • CNotify all customers immediately
   • DContain the breach to prevent further exposure
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A bank is planning to use a new data analytics tool that will process customer transaction data for testing fraud detection algorithms. The tool will be hosted in a cloud environment, and the data includes sensitive financial information. The bank's privacy officer requires an assessment of the privacy risks before proceeding. What should the test team do?

   • AProceed with the tool since it is for fraud detection, which is a legitimate purpose.
   • BConduct a privacy impact assessment (PIA) to evaluate the risks and identify mitigation measures.
   • CRely on the cloud provider's security certifications to ensure compliance.
   • DAnonymize the data before uploading it to the cloud tool.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A tester discovers that a test database containing real customer data was accidentally left accessible on a public cloud storage bucket for several hours. The tester immediately removes public access. According to GDPR breach notification requirements, what should the tester do next?

   • AWait to see if any data was actually accessed before reporting.
   • BDelete the database and all backups to prevent further exposure.
   • CNotify the data protection officer (DPO) and the incident response team.
   • DInform the customers whose data was exposed.
   Reveal Solution Discussion Select an answer first