Risks of Shadow AI CT-GENAI Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A test engineer uses a personal AI assistant to summarize long bug reports before writing a summary for the team. The engineer does not share any code or data with the assistant, only the text of the bug reports. The bug reports contain no personal data. Is this Shadow AI?

   • ANo, because the engineer is using their personal device and account.
   • BYes, but only if the engineer shares the summaries with the team.
   • CNo, because the bug reports contain no personal data, so there is no risk.
   • DYes, because the engineer is using an AI tool for work-related tasks without approval.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A QA manager at a healthcare company discovers that a contractor has been using a public AI tool to summarize patient test data for a test report. The tool is not approved, and the data was anonymized before being uploaded. The manager must decide how to respond. The company has a strict data privacy policy but no specific AI governance policy. What is the most appropriate action?

   • AReport the incident, assess the actual data exposure risk, and use it as a catalyst to develop an AI governance policy.
   • BTerminate the contractor's contract immediately for violating the data privacy policy.
   • CIssue a verbal warning and require the contractor to redo the report using an approved method.
   • DQuietly ask the contractor to delete the data from the AI tool and promise not to do it again.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A QA team lead discovers that several testers have been using a popular AI code-generation tool to write automated test scripts. The tool was not approved by the IT department. The test scripts work well and have improved coverage. The team lead wants to address the situation. What is the most important first step?

   • AQuietly allow the team to continue using the tool since the results are positive.
   • BAsk the testers to sign a waiver accepting responsibility for any issues with the generated code.
   • CReport the usage to management and IT, and initiate a formal review of the tool's security, compliance, and licensing.
   • DImmediately stop all use of the tool and delete all generated scripts.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company wants to reduce the risks of Shadow AI in its testing department. The testers are highly skilled and value their autonomy. Which mitigation strategy is most likely to be effective while maintaining tester productivity?

   • AProvide a curated list of approved AI tools and offer training on their safe and effective use.
   • BImplement a strict policy that completely bans all external AI tools and services.
   • CIncrease network monitoring to detect and block any unauthorized AI tool usage.
   • DRequire all testers to sign a document acknowledging the risks of Shadow AI.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A QA team is known for being innovative and frequently tries new tools. The company wants to encourage this innovation while managing Shadow AI risks. What is the best way to foster a culture of safe innovation?

   • AAllow the team to use new tools but only for non-critical testing tasks.
   • BEncourage the team to try any tool and report back on its usefulness.
   • CEstablish an 'AI sandbox' environment where new tools can be tested safely and evaluated.
   • DRequire all new tool ideas to go through a six-month approval process.
   Reveal Solution Discussion Select an answer first