A city bus-transfer tester sorts two briefings: (1) yesterday’s prompt still sits on a vendor disk, and (2) an outsider might reach the test-tool account. How should these concerns be mapped?
Select an answer to reveal the explanation.
Short Explanation
Privacy asks what the tool sees and keeps; security asks who can break in and abuse it. A prompt stuck on a vendor disk is a control-of-data worry. An outsider reaching the test-tool account is an access worry.
Full Explanation
Bus-transfer testers must map concerns to the right domain. A prompt that still sits on a vendor disk maps to privacy / lack of control over data usage. An outsider who might reach the test-tool account maps to security / unauthorized access. Privacy asks what is seen and kept; security asks who can break in and abuse the tool.
Treating both as only temperature problems fails by concept. Mapping (1) to malicious code generation and (2) to request manipulation mislabels both events. Calling them identical GDPR metrics for neuron coverage collapses unrelated ideas.
Exam caveat: a single incident may involve both privacy and security, but the stem asks for correct primary mapping of each briefing item.
Operational check: maintain separate intake labels for privacy retention issues versus access-control incidents; route vendor-disk retention to privacy/legal; route account compromise paths to security; record both when a bus-transfer tool incident spans custody and access. Transfer-center runbooks should include two playbooks—one for vendor retention disputes and one for compromised test-tool credentials—so responders do not apply the wrong control set. Keep the civic test basis authoritative over fluent model wording whenever the two disagree.