A US-based company is testing a GenAI application that processes health data. The company is subject to HIPAA and wants to use a third-party GenAI service to generate test data. The service provider signs a business associate agreement (BAA). However, the company's security team is concerned that the GenAI model might memorize and regurgitate protected health information (PHI). What is the most appropriate course of action?

Ask the service provider to disable all logging and caching features

Rely on the BAA and proceed with using real PHI in the GenAI service

De-identify the PHI before sending it to the GenAI service and monitor outputs for any residual PHI

Use only synthetic data generated internally and never send real PHI to the service

What is the primary goal of data minimization in the context of generative AI testing?

Reduce the amount of sensitive data exposed to the AI model

Improve the accuracy of test results

Increase the speed of test execution

Reduce the cost of AI model usage

Certified Tester Testing with Generative AI

Domain 3Objective 3

Data Privacy and Security Risks Associated with Using Generative AI CT-GENAI Practice Questions (Page 7)

Part of the Managing Risks of Generative AI in Software Testing domain, which makes up ~18% of our current practice bank. ISTQB does not publish an official question count, but from its 60-minute exam (~25–40 total, ~5–7 in this domain), expect 1–1 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

8concepts

8 Concepts in This Objective

Identify data privacy risks in GenAI testing
Identify data security risks in GenAI testing
Apply data anonymization and pseudonymization techniques
Implement data minimization strategies
Ensure compliance with data protection regulations
Establish secure data handling and access controls
Conduct privacy impact assessments for GenAI testing
Monitor and audit GenAI outputs for data leakage

Questions 31–33

31foundation · medium
Before sending test data to a generative AI service, a tester replaces customer names with unique random identifiers. This technique is called:
Select an answer first
32expert · hard
A US-based company is testing a GenAI application that processes health data. The company is subject to HIPAA and wants to use a third-party GenAI service to generate test data. The service provider signs a business associate agreement (BAA). However, the company's security team is concerned that the GenAI model might memorize and regurgitate protected health information (PHI). What is the most appropriate course of action?
Select an answer first
33foundation · medium
What is the primary goal of data minimization in the context of generative AI testing?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CT-GENAI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-GENAI” is a trademark of its owner, used for identification only.

Data Privacy and Security Risks Associated with Using Generative AI CT-GENAI Practice Questions (Page 7)

Questions 31–33

Before sending test data to a generative AI service, a tester replaces customer names with unique random identifiers. This technique is called:

What is the primary goal of data minimization in the context of generative AI testing?

Keep studying — Managing Risks of Generative AI in Software Testing