A QA team is using a GenAI model to generate test data for a banking application. The team is concerned that the model might output real customer account numbers that it learned during training. What is the most effective way to detect this issue?

Manually review a sample of the generated test data

Ask the model to avoid generating real account numbers in the prompt

Implement an automated scan that checks generated outputs against a list of known account numbers

Use a different GenAI model that is known to have less memorization

Which of the following is typically included in a privacy impact assessment for a GenAI testing initiative?

A cost-benefit analysis of using GenAI

A list of all test cases to be executed

A description of the personal data involved and how it will be processed

A comparison of different AI model architectures

A QA team uses a public generative AI chatbot to help generate test data for a healthcare application. They paste real patient records into the chat to get realistic variations. After several sessions, they notice the chatbot occasionally reproduces exact fragments of the original patient data in its responses. Which combination of actions should the team take FIRST to address this issue?

Add a disclaimer to the test report stating that data was used for testing purposes

Stop using real patient data, apply pseudonymization to the data before input, and monitor outputs for leakage

Ask the chatbot vendor to disable output caching for the session

Switch to a private enterprise version of the chatbot and continue using real patient data

A QA team is setting up a GenAI testing pipeline that processes sensitive customer data. The data is stored in a central repository, and the team needs to control who can access it and how it is transmitted to the GenAI service. Which set of controls is most appropriate?

Encrypt the data at rest but allow unencrypted transmission to the GenAI service for performance

Store the data in a public cloud bucket with a signed URL that expires in 30 days

Use role-based access control (RBAC) for the repository and encrypt data in transit with TLS

Grant all QA team members full access to the repository and use a shared API key for the GenAI service

Certified Tester Testing with Generative AI

Domain 3Objective 3

Data Privacy and Security Risks Associated with Using Generative AI CT-GENAI Practice Questions (Page 1)

Part of the Managing Risks of Generative AI in Software Testing domain, which makes up ~18% of our current practice bank. ISTQB does not publish an official question count, but from its 60-minute exam (~25–40 total, ~5–7 in this domain), expect 1–1 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

8concepts

8 Concepts in This Objective

Identify data privacy risks in GenAI testing
Identify data security risks in GenAI testing
Apply data anonymization and pseudonymization techniques
Implement data minimization strategies
Ensure compliance with data protection regulations
Establish secure data handling and access controls
Conduct privacy impact assessments for GenAI testing
Monitor and audit GenAI outputs for data leakage

Questions 1–5

1foundation · medium
A company based in the EU uses generative AI to test software that processes personal data of EU citizens. Which regulation is most directly applicable to this activity?
Select an answer first
2application · medium
A QA team is using a GenAI model to generate test data for a banking application. The team is concerned that the model might output real customer account numbers that it learned during training. What is the most effective way to detect this issue?
Select an answer first
3foundation · medium
Which of the following is typically included in a privacy impact assessment for a GenAI testing initiative?
Select an answer first
4application · medium
A QA team uses a public generative AI chatbot to help generate test data for a healthcare application. They paste real patient records into the chat to get realistic variations. After several sessions, they notice the chatbot occasionally reproduces exact fragments of the original patient data in its responses. Which combination of actions should the team take FIRST to address this issue?
Select an answer first
5application · medium
A QA team is setting up a GenAI testing pipeline that processes sensitive customer data. The data is stored in a central repository, and the team needs to control who can access it and how it is transmitted to the GenAI service. Which set of controls is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-GENAI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-GENAI” is a trademark of its owner, used for identification only.

Data Privacy and Security Risks Associated with Using Generative AI CT-GENAI Practice Questions (Page 1)

Questions 1–5

A company based in the EU uses generative AI to test software that processes personal data of EU citizens. Which regulation is most directly applicable to this activity?

A QA team is using a GenAI model to generate test data for a banking application. The team is concerned that the model might output real customer account numbers that it learned during training. What is the most effective way to detect this issue?

Which of the following is typically included in a privacy impact assessment for a GenAI testing initiative?

A QA team is setting up a GenAI testing pipeline that processes sensitive customer data. The data is stored in a central repository, and the team needs to control who can access it and how it is transmitted to the GenAI service. Which set of controls is most appropriate?

Keep studying — Managing Risks of Generative AI in Software Testing