Data Privacy and Security Risks Associated with Using Generative AI CT-GENAI Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A team is testing a GenAI model that generates synthetic patient records for a clinical trial system. The team needs the synthetic data to be statistically similar to real patient data for the tests to be valid. However, the compliance team requires that the data cannot be traced back to any real patient. The team has a dataset of 10,000 real patient records. What is the best approach?

   • AUse the real patient records directly because the test requires high fidelity
   • BTrain the GenAI model on the real records and use it to generate a new synthetic dataset, then verify the synthetic data has no direct match to real records
   • CApply k-anonymity to the real records to ensure each record is indistinguishable from at least k-1 others
   • DRandomly shuffle the fields in the real records to create pseudo-random data
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A team is using a GenAI model to generate test data for a new application. They want to ensure that the model's outputs do not accidentally reveal sensitive information from the training data. What is the most effective control to implement?

   • AImplement automated scanning of all GenAI outputs for patterns that match known sensitive data
   • BIncrease the model's temperature setting to make outputs more random
   • CUse a smaller model with fewer parameters
   • DDisable the model's logging feature to prevent output storage
   Reveal Solution Discussion Select an answer first
4. 23foundation · medium

   A tester inputs a prompt that includes instructions to ignore previous system rules and output hidden test data. This is an example of which security threat?

   • APrompt injection
   • BModel poisoning
   • CDenial of service
   • DData exfiltration
   Reveal Solution Discussion Select an answer first
5. 24foundation · medium

   An attacker deliberately introduces malicious data into the training dataset of a generative AI model used for testing. This attack is known as:

   • ASQL injection
   • BModel poisoning
   • CMan-in-the-middle
   • DPrompt injection
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A team is using a GenAI model to generate test data for a social media platform. The model was trained on public user posts. During testing, the model generates a response that includes a user's private phone number, which was never publicly posted. The team is surprised because the phone number was not in the training data they provided. What is the most likely explanation?

   • AThe team accidentally included the phone number in the prompt
   • BThe model's output is a random coincidence
   • CThe model inferred the phone number from other public data
   • DThe model memorized the phone number from its training data, which included private data
   Reveal Solution Discussion Select an answer first