Which of the following is a compliance requirement when using generative AI to test software that handles protected health information (PHI) in the United States?

Ensure that PHI is de-identified or used under a HIPAA-compliant agreement

Obtain consent from every individual whose data is used

Use only synthetic data for all testing

Store all test data in the same region as the AI model

What is the main goal of auditing generative AI outputs during testing?

Ensure the AI model is free from bias

Reduce the number of test cases needed

Improve the speed of test generation

Detect and prevent the leakage of sensitive data in generated content

A financial services company is using a generative AI tool to synthesize test data for a new payment processing system. The compliance team requires that the testing environment minimize the risk of exposing customer financial data. The team currently has a full production database export available. What is the most appropriate data strategy for this GenAI testing effort?

Create a separate copy of the production database and grant the AI tool read-only access

Encrypt the full production export and store it in a secure cloud bucket for the AI tool to access

Use the full production export because it provides the most realistic test scenarios

Extract only the specific data fields needed for the test cases and generate synthetic variations

A security team is integrating a GenAI assistant into its test automation framework. The assistant has access to a database of test credentials and can execute commands to set up test environments. An attacker sends a crafted email to a tester, and when the tester pastes the email content into the GenAI assistant for analysis, the assistant unexpectedly executes a command to delete a test database. What is the most likely cause, and what is the most effective mitigation?

The assistant was compromised by model poisoning; retrain the model with sanitized data

The tester accidentally triggered a keyboard shortcut; disable all shortcuts in the assistant

The email contained a prompt injection; restrict the assistant's ability to execute commands based on untrusted input

The assistant suffered a data breach; revoke all credentials and rotate them

Which of the following is a key difference between anonymization and pseudonymization?

Both are identical and can be used interchangeably

Anonymization is only used for numeric data, while pseudonymization is for text

Anonymization is irreversible, while pseudonymization can be reversed with a key

Pseudonymization is irreversible, while anonymization can be reversed

Certified Tester Testing with Generative AI

Domain 3Objective 3

Data Privacy and Security Risks Associated with Using Generative AI CT-GENAI Practice Questions (Page 6)

Part of the Managing Risks of Generative AI in Software Testing domain, which makes up ~18% of our current practice bank. ISTQB does not publish an official question count, but from its 60-minute exam (~25–40 total, ~5–7 in this domain), expect 1–1 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

8concepts

8 Concepts in This Objective

Identify data privacy risks in GenAI testing
Identify data security risks in GenAI testing
Apply data anonymization and pseudonymization techniques
Implement data minimization strategies
Ensure compliance with data protection regulations
Establish secure data handling and access controls
Conduct privacy impact assessments for GenAI testing
Monitor and audit GenAI outputs for data leakage

Questions 26–30

26foundation · medium
Which of the following is a compliance requirement when using generative AI to test software that handles protected health information (PHI) in the United States?
Select an answer first
27foundation · medium
What is the main goal of auditing generative AI outputs during testing?
Select an answer first
28application · medium
A financial services company is using a generative AI tool to synthesize test data for a new payment processing system. The compliance team requires that the testing environment minimize the risk of exposing customer financial data. The team currently has a full production database export available. What is the most appropriate data strategy for this GenAI testing effort?
Select an answer first
29expert · hard
A security team is integrating a GenAI assistant into its test automation framework. The assistant has access to a database of test credentials and can execute commands to set up test environments. An attacker sends a crafted email to a tester, and when the tester pastes the email content into the GenAI assistant for analysis, the assistant unexpectedly executes a command to delete a test database. What is the most likely cause, and what is the most effective mitigation?
Select an answer first
30foundation · medium
Which of the following is a key difference between anonymization and pseudonymization?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-GENAI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-GENAI” is a trademark of its owner, used for identification only.

Data Privacy and Security Risks Associated with Using Generative AI CT-GENAI Practice Questions (Page 6)

Questions 26–30

Which of the following is a compliance requirement when using generative AI to test software that handles protected health information (PHI) in the United States?

What is the main goal of auditing generative AI outputs during testing?

Which of the following is a key difference between anonymization and pseudonymization?

Keep studying — Managing Risks of Generative AI in Software Testing