What is the primary purpose of a privacy impact assessment (PIA) in the context of generative AI testing?

Ensure the AI model is free from bias

Document the test cases generated by the AI

Identify and mitigate privacy risks associated with the use of GenAI

Measure the performance of the AI model

A team is planning to use generative AI to generate test cases from a production database. Which approach best implements data minimization?

Use a random sample of all data without filtering

Use only data that is publicly available

Use the entire production database to ensure comprehensive test coverage

Extract only the fields and records necessary for the specific test scenario

A QA team is using a GenAI tool to generate test scripts. The tool is connected to the company's internal code repository. An attacker manages to insert a malicious comment into a code file that instructs the GenAI tool to exfiltrate the repository's contents to an external server. What type of attack is this, and what is the best mitigation?

Prompt injection; restrict the GenAI tool's access to only the necessary files and monitor its outputs

Denial of service; increase the tool's rate limits

Model poisoning; retrain the model on clean data

Data exfiltration; disconnect the tool from the repository

A team needs to use a GenAI tool to generate test data for a new e-commerce platform. The data must include customer names, addresses, and order histories. The team wants to protect customer privacy while maintaining the data's usefulness for testing. What is the most appropriate technique?

Delete all customer data and use only generic placeholder values

Use data masking to replace real names and addresses with fictional ones while preserving the format

Use real customer data but restrict access to the test environment

Encrypt the data and use the encrypted values in the test

Certified Tester Testing with Generative AI

Domain 3Objective 3

Data Privacy and Security Risks Associated with Using Generative AI CT-GENAI Practice Questions (Page 2)

Part of the Managing Risks of Generative AI in Software Testing domain, which makes up ~18% of our current practice bank. ISTQB does not publish an official question count, but from its 60-minute exam (~25–40 total, ~5–7 in this domain), expect 1–1 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

8concepts

8 Concepts in This Objective

Identify data privacy risks in GenAI testing
Identify data security risks in GenAI testing
Apply data anonymization and pseudonymization techniques
Implement data minimization strategies
Ensure compliance with data protection regulations
Establish secure data handling and access controls
Conduct privacy impact assessments for GenAI testing
Monitor and audit GenAI outputs for data leakage

Questions 6–10

6foundation · medium
What is the primary purpose of a privacy impact assessment (PIA) in the context of generative AI testing?
Select an answer first
7foundation · medium
A team is planning to use generative AI to generate test cases from a production database. Which approach best implements data minimization?
Select an answer first
8application · medium
A QA team is using a GenAI tool to generate test scripts. The tool is connected to the company's internal code repository. An attacker manages to insert a malicious comment into a code file that instructs the GenAI tool to exfiltrate the repository's contents to an external server. What type of attack is this, and what is the best mitigation?
Select an answer first
9application · medium
A team needs to use a GenAI tool to generate test data for a new e-commerce platform. The data must include customer names, addresses, and order histories. The team wants to protect customer privacy while maintaining the data's usefulness for testing. What is the most appropriate technique?
Select an answer first
10foundation · medium
A tester regularly reviews the outputs of a generative AI model used for test data generation to check for any unintended inclusion of personal information. This practice is known as:
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-GENAI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-GENAI” is a trademark of its owner, used for identification only.

Data Privacy and Security Risks Associated with Using Generative AI CT-GENAI Practice Questions (Page 2)

Questions 6–10

What is the primary purpose of a privacy impact assessment (PIA) in the context of generative AI testing?

A team is planning to use generative AI to generate test cases from a production database. Which approach best implements data minimization?

A team needs to use a GenAI tool to generate test data for a new e-commerce platform. The data must include customer names, addresses, and order histories. The team wants to protect customer privacy while maintaining the data's usefulness for testing. What is the most appropriate technique?

A tester regularly reviews the outputs of a generative AI model used for test data generation to check for any unintended inclusion of personal information. This practice is known as:

Keep studying — Managing Risks of Generative AI in Software Testing