Data Privacy and Security Risks Associated with Using Generative AI CT-GENAI Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   Before deploying a new GenAI-based test data generator that will process personal data, a company's privacy team wants to systematically evaluate the potential privacy impacts and document mitigation measures. What is the appropriate process to follow?

   • AConduct a privacy impact assessment (PIA) and document the data flows, risks, and mitigations
   • BReview the company's existing data retention policy
   • CAsk the GenAI vendor for a list of all training data sources
   • DRun a penetration test on the GenAI service to check for vulnerabilities
   Reveal Solution Discussion Select an answer first
2. 17foundation · medium

   When sending test data to a generative AI service over the internet, which control is essential to protect the data during transmission?

   • APseudonymization
   • BData minimization
   • COutput monitoring
   • DEncryption in transit (e.g., TLS)
   Reveal Solution Discussion Select an answer first
4. 18foundation · medium

   Which of the following is a data privacy risk specific to using generative AI in software testing?

   • AThe model might require more storage space for test artifacts
   • BThe model might run slower when processing large test datasets
   • CThe model might produce inaccurate test results
   • DThe model might memorize and later reveal sensitive test data used in prompts
   Reveal Solution Discussion Select an answer first
5. 19foundation · medium

   During a testing session, a generative AI model unexpectedly reproduces a snippet of personal data that was part of its training data. This phenomenon is best described as:

   • APrompt injection
   • BModel poisoning
   • CData minimization
   • DOutput regurgitation
   Reveal Solution Discussion Select an answer first
6. 20expert · medium

   A QA team is using a GenAI tool to generate test cases from production logs. The logs contain user session data, including IP addresses and user agent strings. The team wants to reduce the privacy risk while still being able to test for issues related to different browsers and devices. What is the most effective data minimization strategy?

   • AReplace IP addresses with random values but keep the user agent strings
   • BRemove IP addresses and keep only the user agent strings
   • CAggregate the logs by user agent and discard individual session records
   • DKeep the full logs because they are needed for accurate test case generation
   Reveal Solution Discussion Select an answer first