iSQI Updated CT-GenAI Exam Questions and Answers by philippa

Understanding the hierarchy of LLM types is vital for selecting the right tool for specific testing tasks.Foundation LLMsare trained on massive datasets to predict the next token; they excel at broad, creative "ideation" (Statement i) but often struggle with following specific instructions or constraints (making Statement iv incorrect).Instruction-tuned LLMshave undergone additional training (Fine-tuning) to follow explicit commands and templates. They are highly effective at structured tasks like converting requirements into Gherkin feature files (Statement ii).Reasoning LLMs(or those utilizing specialized prompting like Chain-of-Thought) are designed to handle complex, multi-stage logic. This makes them the superior choice for diagnostic tasks like root-cause analysis, where the model must synthesize information across logs and requirements to find a defect's origin (Statement iii). Statement v is incorrect because while instruction-tuned models are capable, complex "stepwise reasoning" usually requires specific prompting techniques or the inherent logic of specialized reasoning models. Therefore, the combination of i, ii, and iii represents the correct alignment of model capability to testing functionality.

Shadow AIrefers to the use of artificial intelligence tools and services within an organization without explicit approval or oversight from the IT or Security departments. In a software testing environment, this often occurs when testers use public, consumer-grade LLMs to analyze proprietary code or sensitive requirement documents to speed up their work. The primary compliance concern is theviolation of established data handling and regulatory compliance standards(such as GDPR, HIPAA, or SOC2). When sensitive test data is fed into a "shadow" AI tool, that data may be stored on external servers or used to train future iterations of the model, leading to massive data leaks and legal exposure. This bypasses the organization's security controls, such as data masking and role-based access. Unlike "authorized" AI which undergoes a rigorous vendor risk assessment, Shadow AI creates an invisible attack surface. For a test organization, mitigating this risk involves providing approved, secure AI alternatives and implementing strict policies and monitoring to ensure that internal intellectual property is never processed by unvetted external services.

A Retrieval-Augmented Generation (RAG) workflow is designed to "ground" an LLM's output in specific, verifiable data. The logical flow begins with an initial input or "focused query" (Step iv) that defines the tester's goal—in this case, generating cases for a new payments rule. The system then uses this query to perform a semantic search in avector database(Step i) to find the most relevant "chunks" of the new API specification. Following this, the system retrieves complementary data from therelational database(Step iii), such as historical test cases that might provide structural patterns or regression context. Finally, all the retrieved information—the new specs and the historical context—is bundled together and "fed" into the LLM as part of an augmented prompt (Step ii). This ensures the LLM doesn't hallucinate rules but instead synthesizes the new requirements with established organizational testing standards. Following the order in Option B ensures that the model is provided with the most relevant and logically organized context prior to generating the final testware.

According to the strategic frameworks for AI adoption (as detailed in the CT-GenAI and related ISO/IEC 42001 standards), the journey toward organizational AI maturity follows three primary phases. TheDiscoveryphase involves identifying potential use cases, assessing current technical readiness, and understanding the legal/risk landscape. TheInitiation and Usage Definitionphase is where the organization sets the "ground rules"—defining which tools are approved, establishing system prompts, creating prompt libraries, and training the staff on prompt engineering. This phase transitions the AI from a novelty into a structured capability. Finally, theUtilization and Iterationphase is the ongoing process where GenAI is used in daily testing activities, and its outputs are constantly monitored, measured, and improved through feedback loops. This ensures the strategy remains dynamic and adapts to new model capabilities or changing project requirements. Options B, C, and D represent standard project management or IT lifecycles but do not capture the specific "learning and refinement" nature required for successful Generative AI integration in a testing department.