▸case-01 When cataloging personal identifier categories for a user profile database, a developer wants to classify internal handles like '@johndoe99' strictly as non-sensitive account metadata rather than personal identifiers. What entity classification should be assigned to online usernames? | fail→fail | 9,914 | 8,130 | -18% | 1 | 1 | 0% | 1,666 | 1,632 | -2% | 0 | 0 | — |
▸case-02 An API audit checklist covers email addresses and mobile numbers under contact details, but marks physical mailing addresses as general demographic data. How should physical street addresses be classified in a PII taxonomy? | fail→fail | 10,341 | 11,785 | +14% | 1 | 1 | 0% | 1,825 | 2,335 | +28% | 0 | 0 | — |
▸case-03 A data privacy manager proposes lumping Visa credit card numbers and primary account numbers into government identification tables alongside tax ID numbers. Under standard PII categorization, where should credit card numbers be grouped? | fail→fail | 8,192 | 5,170 | -37% | 1 | 1 | 0% | 1,518 | 1,118 | -26% | 0 | 0 | — |
▸case-04 A compliance engineer lists Social Security numbers and passport numbers as government-issued identity documents, but omits state driver's license numbers. How should state driver's license numbers be classified? | fail→fail | 7,403 | 3,691 | -50% | 1 | 1 | 0% | 1,457 | 897 | -38% | 0 | 0 | — |
▸case-05 A logging system redacts patient names but leaves diagnostic codes and medical treatment history unclassified in plain text logs. Which PII category governs health information and medical data? | fail→pass | 4,786 | 3,089 | -35% | 1 | 1 | 0% | 823 | 695 | -16% | 0 | 0 | — |
▸case-06 An enterprise application needs to redact proprietary internal employee badges formatted like 'EMP-99812-X', which standard out-of-the-box regex models do not detect. What mechanism should be used to catch organization-specific formats? | fail→fail | 12,590 | 8,149 | -35% | 1 | 1 | 0% | 1,975 | 1,866 | -6% | 0 | 0 | — |
▸case-07 A developer wants to replace detected phone numbers in log output with generic asterisks '***'. What standard exact placeholder string should be used when performing masking redaction? | fail→pass | 5,192 | 1,790 | -66% | 1 | 1 | 0% | 840 | 598 | -29% | 0 | 0 | — |
▸case-08 An engineering team needs to replace real user names in staging test environments with realistic-looking synthetic names (e.g., replacing 'John Smith' with 'Alice Tremont') so downstream analytics pipelines still function without exposed identity. What redaction method is this? | fail→fail | 6,571 | 4,676 | -29% | 1 | 1 | 0% | 992 | 989 | -0% | 0 | 0 | — |
▸case-09 A customer support desk needs customer phone numbers replaced with surrogate lookup keys in public ticket threads, but authorized internal billing agents must be able to resolve those keys back to original plain text. What anonymization method provides this reversible mapping? | fail→fail | 7,398 | 7,905 | +7% | 1 | 1 | 0% | 1,340 | 1,672 | +25% | 0 | 0 | — |
▸case-10 A security requirement mandates protecting stored payload fields using algorithmic cryptographic key transformations rather than text replacement or lookup tokens. Which redaction method satisfies cryptographic data protection? | fail→fail | 7,702 | 6,070 | -21% | 1 | 1 | 0% | 1,282 | 1,383 | +8% | 0 | 0 | — |
▸case-11 A platform team is building safety controls for an LLM application to prevent user inputs containing sensitive personal details from reaching model providers. Which target process architecture covers this safety layer? | fail→fail | 10,359 | 5,434 | -48% | 1 | 1 | 0% | 1,486 | 1,287 | -13% | 0 | 0 | — |
▸case-12 A community forum architecture includes automated scanning of public post submissions for toxic content and personal sensitive leakage before publication. Which target process handles this inbound scanning workflow? | fail→fail | 7,435 | 3,072 | -59% | 1 | 1 | 0% | 1,257 | 735 | -42% | 0 | 0 | — |
▸case-13 A Python service requires an open-source detection framework to analyze input text streams and pinpoint entity spans like email addresses and credit card numbers. Which specialized Python library should be selected for analyzing entity detections? | fail→fail | 7,362 | 5,175 | -30% | 1 | 1 | 0% | 1,335 | 1,206 | -10% | 0 | 0 | — |
▸case-14 After identifying sensitive entity locations in text streams, a Python application needs a dedicated library to execute masking, pseudonymization, and hashing transformations on those detected spans. Which library handles the anonymization execution? | fail→fail | 7,636 | 4,215 | -45% | 1 | 1 | 0% | 1,401 | 1,062 | -24% | 0 | 0 | — |
▸case-15 A text processing backend needs an underlying natural language processing engine to supply tokenization and named entity recognition models for entity detection frameworks. Which NLP library should be included as a primary dependency? | fail→fail | 9,733 | 3,591 | -63% | 1 | 1 | 0% | 1,716 | 880 | -49% | 0 | 0 | — |
▸case-16 To minimize disk footprint, a data engineering team proposes discarding all operational logs produced during text transformation routines. What best practice must be maintained when processing sensitive identity data? | fail→fail | 11,655 | 8,493 | -27% | 1 | 1 | 0% | 1,627 | 1,581 | -3% | 0 | 0 | — |
▸case-17 A QA team validates an identity detection tool by running unit tests against a single synthetic file containing 100 US-based phone numbers. What best practice should be applied to test coverage? | fail→fail | 9,379 | 9,641 | +3% | 1 | 1 | 0% | 1,646 | 1,675 | +2% | 0 | 0 | — |
▸case-18 An engineer suggests hardcoding confidence score cutoffs directly inside underlying regex functions. What configurable setting should be exposed to allow tuning detection thresholds? | fail→fail | 8,043 | 6,158 | -23% | 1 | 1 | 0% | 1,371 | 1,252 | -9% | 0 | 0 | — |
▸case-19 A global web application assumes all text input is English and omits localized language processing settings. What configuration parameter must be provided to handle international text inputs? | fail→fail | 6,823 | 6,202 | -9% | 1 | 1 | 0% | 1,191 | 1,445 | +21% | 0 | 0 | — |
▸case-20 An API gateway service receives an HTTP request carrying a Bearer token in the Authorization header. How should the gateway verify the integrity and authenticity of an RS256-signed JSON Web Token before proxying the request? | fail→fail | 13,632 | 14,071 | +3% | 1 | 1 | 0% | 2,588 | 2,868 | +11% | 0 | 0 | — |
▸case-21 A backend API receives user input from a search form and constructs a PostgreSQL query dynamically. How should the application structure its database access code to prevent SQL injection vulnerabilities? | fail→fail | 13,894 | 14,256 | +3% | 1 | 1 | 0% | 2,568 | 2,894 | +13% | 0 | 0 | — |
▸case-22 A system administrator is configuring cipher suites for an NGINX reverse proxy enforcing TLS 1.3 encryption. Which cryptographic cipher suite should be configured for strong Transport Layer Security? | fail→fail | 8,751 | 6,552 | -25% | 1 | 1 | 0% | 1,827 | 1,487 | -19% | 0 | 0 | — |