Question 20
The current design is: Remove real personal data and use synthetic records with the same safe schema when requesting Copilot test fixtures. The prior failure was: A support conversation contains production patient names and record numbers. Which ONE ongoing control best protects against recurrence of that specific failure?
- Teach data minimization and block production identifiers in AI-assisted test-generation workflows.
- Enforce security acceptance tests and diff review for generated fixes.
- Use command approvals and backups for destructive agent or shell operations.
- Check for secret-bearing log fields during code review and run secret scanners.
Explanation
Correct Answer
A:The developer exposed sensitive personal information to a tool unnecessarily. Teach data minimization and block production identifiers in AI-assisted test-generation workflows.
Incorrect Answers
B:Generated code requires independently defined acceptance tests and review against the real program contract. Preventing this failure involves teach data minimization and block production identifiers in AI-assisted test-generation workflows.
C:Shell commands from AI tools must be inspected for resolved paths and side effects before destructive execution. Preventing this failure involves teach data minimization and block production identifiers in AI-assisted test-generation workflows.
D:Redacting credentials and tokens prevents generated instrumentation from exposing secrets in logs or repositories. Preventing this failure involves teach data minimization and block production identifiers in AI-assisted test-generation workflows.
Question 21
A team reports: A reviewer sees Copilot's confident assertion that a cryptographic algorithm is approved for the organization's compliance profile. They observe: The implementation uses a deprecated mode despite the assistant calling it compliant. Which ONE technical decision most directly corrects the cause?
- Verify every dependency against the official registry and dependency lockfile before accepting generated imports.
- Check generated API calls against pinned package version documentation and execute compatibility tests.
- Treat AI review as supplementary; require human security review plus tests and scanners for release.
- Confirm algorithm approval and parameter requirements against the applicable standard and security team guidance.
Explanation
Correct Answer
D:A generated compliance claim has no authoritative approval on its own.
Incorrect Answers
A:Verifying every dependency against the official registry and dependency lockfile would not confirm algorithm approval and parameter requirements against the applicable standard and security team guidance.
B:Checking generated API calls against pinned package version documentation and execute compatibility tests would not confirm algorithm approval and parameter requirements against the applicable standard and security team guidance.
C:Treat AI review as supplementary would not confirm algorithm approval and parameter requirements against the applicable standard and security team guidance.
Question 22
A team has implemented the following change: Confirm algorithm approval and parameter requirements against the applicable standard and security team guidance. The original requirement was: A reviewer sees Copilot's confident assertion that a cryptographic algorithm is approved for the organization's compliance profile. Which ONE validation test best demonstrates the intended behavior?
- Compile and run the refactor against the actual installed dependency version.
- Check algorithm mode, key size, nonce handling, and policy listing independently of the chat response.
- Install dependencies from the trusted registry in a disposable build and check package provenance.
- Confirm a human reviewer checked authentication, authorization, and dependency changes independently.
Explanation
Correct Answer
B:Check algorithm mode, key size, nonce handling, and policy listing independently of the chat response.
Incorrect Answers
A:Approved dependency sources and lockfiles protect builds against invented or impersonated packages. Verification of this result involves checking algorithm mode, key size, nonce handling, and policy listing independently of the chat response.
C:Approved dependency sources and lockfiles protect builds against invented or impersonated packages. Verification of this result involves checking algorithm mode, key size, nonce handling, and policy listing independently of the chat response. The observed condition is a team has implemented the following change: Confirm algorithm approval and parameter requirements against the applicable standard and security team guidance. The.
D:Approved dependency sources and lockfiles protect builds against invented or impersonated packages. Verification of this result involves checking algorithm mode, key size, nonce handling, and policy listing independently of the chat response. The observed condition is a team has implemented the following change: Confirm algorithm approval and parameter requirements against the applicable standard and security team guidance. The. Verification of this result involves checking algorithm mode, key size, nonce handling, and policy listing independently of the chat response. The named alternative instead concerns confirming a human reviewer checked authentication, authorization, and dependency changes independently.
Question 23
During troubleshooting, investigators observe: The implementation uses a deprecated mode despite the assistant calling it compliant. The system context is: A reviewer sees Copilot's confident assertion that a cryptographic algorithm is approved for the organization's compliance profile. Which ONE cause most directly explains the observed failure?
- Generative responses can fabricate package identifiers and cannot establish supply-chain trust.
- A generated compliance claim has no authoritative approval on its own.
- Automated reviewers can miss defects and offer false positives; silence is not certification.
- The model inferred an API signature from stale or mismatched examples.
Explanation
Correct Answer
B:The remedy should therefore be: Confirm algorithm approval and parameter requirements against the applicable standard and security team guidance.
Incorrect Answers
A:Generative responses can fabricate package identifiers and cannot establish supply-chain trust. A generated compliance claim has no authoritative approval on its own.
C:Automated reviewers can miss defects and offer false positives; silence is not certification. A generated compliance claim has no authoritative approval on its own.
D:The model inferred an API signature from stale or mismatched examples. A generated compliance claim has no authoritative approval on its own.
Question 24
The current design is: Confirm algorithm approval and parameter requirements against the applicable standard and security team guidance. The prior failure was: The implementation uses a deprecated mode despite the assistant calling it compliant. Which ONE ongoing control best protects against recurrence of that specific failure?
- Require cryptography design review and traceable standards references before production adoption.
- Keep package-version context, build verification, and controlled rollouts for generated refactors.
- Keep required human reviewer protections and security gates for sensitive paths.
- Enforce approved-package checks, lockfile review, and dependency scanning for AI-authored changes.
Explanation
Correct Answer
A:A generated compliance claim has no authoritative approval on its own. Require cryptography design review and traceable standards references before production adoption.
Incorrect Answers
B:Generated code requires independently defined acceptance tests and review against the real program contract. It would leave validated approved cryptographic requirements without the specified safeguard.
C:Generated code requires independently defined acceptance tests and review against the real program contract. Preventing this failure involves requiring cryptography design review and traceable standards references before production adoption.
D:Approved dependency sources and lockfiles protect builds against invented or impersonated packages. It would leave validated approved cryptographic requirements without the specified safeguard.
Question 25
A team reports: A code suggestion includes a long routine resembling an open-source project that may have license obligations. They observe: An audit flags included code with potential incompatible licensing obligations. Which ONE technical decision most directly corrects the cause?
- Use available public-code matching references and review repository license terms before including matching material.
- Scan generated content and diffs; replace any credential-like string with managed secret references.
- Remove credential material from logging and replace it with safe trace identifiers and masked metadata.
- Verify the actual SDK license and its redistribution conditions from the official package and license text.
Explanation
Correct Answer
A:License provenance was not assessed just because the suggestion came through an AI assistant.
Incorrect Answers
B:Copilot output is not exempt from normal secret-leak risks. That does not establish known licensing provenance for included code.
C:Removing credential material from logging and replacing it with safe trace identifiers and masked metadata would not meet the need for available public-code matching references and review repository license terms.
D:Verifying the actual SDK license and its redistribution conditions from the official package and license text would not meet the need for available public-code matching references and review repository license terms.
Question 26
A team has implemented the following change: Use available public-code matching references and review repository license terms before including matching material. The original requirement was: A code suggestion includes a long routine resembling an open-source project that may have license obligations. Which ONE validation test best demonstrates the intended behavior?
- Inspect the versioned LICENSE and NOTICE files for the shipped dependency.
- Run secret scanning on the generated patch and inspect config sources before commit.
- Exercise a request and inspect resulting logs for bearer tokens or cookies.
- Inspect matching-source attribution and license requirements for the specific accepted suggestion.
Explanation
Correct Answer
D:Inspect matching-source attribution and license requirements for the specific accepted suggestion.
Incorrect Answers
A:Approved dependency sources and lockfiles protect builds against invented or impersonated packages. That check cannot demonstrate known licensing provenance for included code.
B:AI-assisted postmortem claims need links to actual commits, logs and reproducible failures. That check cannot demonstrate known licensing provenance for included code.
C:Redacting credentials and tokens prevents generated instrumentation from exposing secrets in logs or repositories. That check cannot demonstrate known licensing provenance for included code.
Question 27
During troubleshooting, investigators observe: An audit flags included code with potential incompatible licensing obligations. The system context is: A code suggestion includes a long routine resembling an open-source project that may have license obligations. Which ONE cause most directly explains the observed failure?
- License provenance was not assessed just because the suggestion came through an AI assistant.
- Copilot output is not exempt from normal secret-leak risks.
- Generated instrumentation neglected secret-handling and observability boundaries.
- Generated legal summaries do not replace controlling source licenses.
Explanation
Correct Answer
A:The remedy should therefore be: Use available public-code matching references and review repository license terms before including matching material.
Incorrect Answers
B:Copilot output is not exempt from normal secret-leak risks would not address the need for license provenance was not assessed just because the suggestion came through an AI assistant.
C:Generated instrumentation neglected secret-handling and observability boundaries would not address the need for license provenance was not assessed just because the suggestion came through an AI assistant.
D:Generated legal summaries do not replace controlling source licenses would not address the need for license provenance was not assessed just because the suggestion came through an AI assistant.
Question 28
The current design is: Use available public-code matching references and review repository license terms before including matching material. The prior failure was: An audit flags included code with potential incompatible licensing obligations. Which ONE ongoing control best protects against recurrence of that specific failure?
- Have license compliance reviewed against dependency manifests before release.
- Check for secret-bearing log fields during code review and run secret scanners.
- Block secret-bearing commits with scanning and protected-branch checks.
- Maintain source/reference review and automated license checks for externally resembling code.
Explanation
Correct Answer
D:License provenance was not assessed just because the suggestion came through an AI assistant. Maintain source/reference review and automated license checks for externally resembling code.
Incorrect Answers
A:Approved dependency sources and lockfiles protect builds against invented or impersonated packages. It would leave known licensing provenance for included code without the specified safeguard.
B:Redacting credentials and tokens prevents generated instrumentation from exposing secrets in logs or repositories. It would leave known licensing provenance for included code without the specified safeguard.
C:AI-assisted postmortem claims need links to actual commits, logs and reproducible failures. It would leave known licensing provenance for included code without the specified safeguard.
Question 29
A team reports: A mobile app team asks Copilot to write a user-facing eligibility message that could disadvantage users from certain regions. They observe: An eligible group receives an unjustified rejection message. Which ONE technical decision most directly corrects the cause?
- Return a consistent response and enforce rate limits while delivering reset tokens by approved secure channel.
- Separate statistical inference from code generation and involve an analyst to validate sampling and causal claims.
- Check the generated validator against the gateway specification and independently written pass/fail vectors before shipping.
- Assess the language and decision logic for discriminatory assumptions, then test representative eligible and ineligible profiles.
Explanation
Correct Answer
D:Training-set bias and prompt ambiguity can surface in generated business logic and copy.
Incorrect Answers
A:The generated user-experience logic overlooked information-disclosure threats. Training-set bias and prompt ambiguity can surface in generated business logic and copy.
B:The model can produce confident narratives without a defensible experimental design. Training-set bias and prompt ambiguity can surface in generated business logic and copy.
C:An LLM's fluent code is not proof of semantic compliance with an external specification. Training-set bias and prompt ambiguity can surface in generated business logic and copy.
Question 30
A team has implemented the following change: Assess the language and decision logic for discriminatory assumptions, then test representative eligible and ineligible profiles. The original requirement was: A mobile app team asks Copilot to write a user-facing eligibility message that could disadvantage users from certain regions. Which ONE validation test best demonstrates the intended behavior?
- Run valid, invalid, and boundary-value card fixtures through tests based on the payment contract.
- Run policy-grounded cases across geographic and demographic examples without storing identifying data.
- Check whether analysis controls for confounders and reports appropriate uncertainty.
- Compare unknown and known-account response status, timing, and rate-limit behavior.
Explanation
Correct Answer
B:Run policy-grounded cases across geographic and demographic examples without storing identifying data.
Incorrect Answers
A:Gateway-specific card validation requires tests derived from the published checksum contract, not plausible generated code.
C:Check whether analysis controls for confounders and reports appropriate uncertainty. It does not run policy-grounded cases across geographic and demographic examples without storing identifying data.
D:Compare unknown and known-account response status, timing, and rate-limit behavior. It does not run policy-grounded cases across geographic and demographic examples without storing identifying data.
GitHub Copilot (GH-300) Practice Tests