Data Privacy and Security Risks Associated with Using Generative AI CT-GENAI Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A multinational company is testing a new feature with GenAI and wants to use customer data from its European Union (EU) users. The GenAI service is hosted in a data center located in the United States. The company's legal team is concerned about GDPR compliance. What is the most appropriate action to align with GDPR requirements?

   • AObtain explicit consent from every EU customer before testing
   • BStore the data in the EU and access it remotely from the US service
   • CUse the US-hosted service because the company has a legitimate interest in testing
   • DAnonymize the EU customer data before sending it to the US-hosted GenAI service
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A testing team needs to use a GenAI tool to generate edge-case test data for a customer relationship management (CRM) system. The data contains customer names, email addresses, and purchase history. The team wants to protect individual identities while preserving the realistic distribution of purchase amounts for testing. Which data protection technique should they apply?

   • AEncrypt the entire dataset and provide the GenAI tool with the decryption key
   • BRound all purchase amounts to the nearest thousand to add noise
   • CReplace customer names and email addresses with fictional values while keeping purchase amounts unchanged
   • DRemove all purchase history data and keep only the customer names
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A team is building a GenAI testing tool that will be accessed by multiple internal teams. The tool will have access to a central test data repository. The security team requires that each team can only access the data relevant to their projects, and that all access is logged. What is the most appropriate access control model?

   • AGrant all teams the same level of access to simplify administration
   • BUse attribute-based access control (ABAC) with policies based on project, team, and data classification
   • CUse a single shared service account for all teams to access the repository
   • DEncrypt the repository and give the decryption key to all team leads
   Reveal Solution Discussion Select an answer first
5. 14foundation · medium

   Which of the following is an example of an access control measure for test data used with generative AI?

   • AUsing a public cloud service for all test data
   • BAnonymizing all data before use
   • CRole-based access control (RBAC) that limits who can view or use the data
   • DEncrypting data at rest
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company subject to CCPA is using a GenAI tool to generate test data for a marketing application. The tool is hosted in a third-party cloud. The company wants to ensure that the data used for testing does not include personal information of California residents. What is the most appropriate action?

   • AObtain consent from all California residents whose data is used
   • BAnonymize the data so it no longer qualifies as personal information under CCPA
   • CUse only data from non-California residents for testing
   • DStore the data in a secure on-premises environment and access the GenAI tool remotely
   Reveal Solution Discussion Select an answer first