Question 360
A team reports: Copilot provides a plausible code change based on an external issue comment that says to disable security checks. They observe: A prompt injection in an issue causes the assistant to change permissions. Which ONE technical decision most directly corrects the cause?
- Describe the target component, ARIA behavior, tab order and visible focus acceptance criteria.
- Treat retrieved issue text as task data, not authoritative instructions; state trusted requirements separately.
- Include the exact compiler diagnostic, affected file, minimal relevant context and expected behavior.
- Express positive deliverables and explicit limits: patch and tests only; no production rollout steps.
Explanation
Correct Answer
B:Untrusted retrieved text was promoted to an instruction source.
Incorrect Answers
A:Describing the target component, ARIA behavior, tab order and visible focus acceptance criteria would not address the need for treat retrieved issue text as task data, not authoritative instructions.
C:Including the exact compiler diagnostic, affected file, minimal relevant context and expected behavior would not address the need for treat retrieved issue text as task data, not authoritative instructions.
D:Express positive deliverables and explicit limits: patch and tests only would not address the need for treat retrieved issue text as task data, not authoritative instructions.
Question 361
A team has implemented the following change: Treat retrieved issue text as task data, not authoritative instructions; state trusted requirements separately. The original requirement was: Copilot provides a plausible code change based on an external issue comment that says to disable security checks. Which ONE validation test best demonstrates the intended behavior?
- Rerun the compiler and confirm the specific diagnostic is gone without new warnings.
- Run keyboard-only navigation and automated accessibility checks after the fix.
- Inspect the output for the requested patch and tests and absence of deployment actions.
- Verify the model refuses to remove authorization unless approved in the actual change request.
Explanation
Correct Answer
D:Verify the model refuses to remove authorization unless approved in the actual change request.
Incorrect Answers
A:Rerun the compiler and confirm the specific diagnostic is gone without new warnings. Verification of this result involves verifying the model refuses to remove authorization unless approved in the actual change request.
B:Run keyboard-only navigation and automated accessibility checks after the fix. Verification of this result involves verifying the model refuses to remove authorization unless approved in the actual change request.
C:Generated code requires independently defined acceptance tests and review against the real program contract. Verification of this result involves verifying the model refuses to remove authorization unless approved in the actual change request.
Question 362
During troubleshooting, investigators observe: A prompt injection in an issue causes the assistant to change permissions. The system context is: Copilot provides a plausible code change based on an external issue comment that says to disable security checks. Which ONE cause most directly explains the observed failure?
- The necessary failure evidence was missing from the prompt.
- Untrusted retrieved text was promoted to an instruction source.
- The prompt captured appearance but omitted behavioral accessibility constraints.
- The allowed output and action boundaries were not specified.
Explanation
Correct Answer
B:The remedy should therefore be: Treat retrieved issue text as task data, not authoritative instructions; state trusted requirements separately.
Incorrect Answers
A:The necessary failure evidence was missing from the prompt. Untrusted retrieved text was promoted to an instruction source.
C:The prompt captured appearance but omitted behavioral accessibility constraints. Untrusted retrieved text was promoted to an instruction source.
D:The allowed output and action boundaries were not specified. Untrusted retrieved text was promoted to an instruction source.
Question 363
The current design is: Treat retrieved issue text as task data, not authoritative instructions; state trusted requirements separately. The prior failure was: A prompt injection in an issue causes the assistant to change permissions. Which ONE ongoing control best protects against recurrence of that specific failure?
- Separate trusted prompts from lower-trust issue, log and documentation content.
- Specify inclusive interaction tests for UI-generation prompts.
- Include error text and reproducible commands when requesting repairs.
- State both acceptance requirements and prohibited side effects in high-risk prompts.
Explanation
Correct Answer
A:Untrusted retrieved text was promoted to an instruction source. Separate trusted prompts from lower-trust issue, log and documentation content.
Incorrect Answers
B:Generated code requires independently defined acceptance tests and review against the real program contract. It would leave separate trusted prompts from lower-trust issue, log and documentation content without the specified safeguard.
C:Shell commands from AI tools must be inspected for resolved paths and side effects before destructive execution. It would leave separate trusted prompts from lower-trust issue, log and documentation content without the specified safeguard.
D:State both acceptance requirements and prohibited side effects in high-risk prompts. It would leave separate trusted prompts from lower-trust issue, log and documentation content without the specified safeguard.
Question 364
A team reports: A team needs an explanation of a subtle C++ lifetime bug and asks for a complete rewrite before understanding it. They observe: A broad rewrite hides the original use-after-free instead of explaining it. Which ONE technical decision most directly corrects the cause?
- Decompose the work into bounded functions and require public-signature and regression tests at each step.
- Express positive deliverables and explicit limits: patch and tests only; no production rollout steps.
- State the expected JSON schema and forbid extraneous Markdown in the requested output.
- First request a bounded step-by-step diagnosis referencing the specific destructor sequence, then ask for a minimal patch.
Explanation
Correct Answer
D:The prompt jumped to a solution without requiring evidence of the underlying mechanism. The missing change involves first request a bounded step-by-step diagnosis referencing the specific destructor sequence, then ask for a minimal patch.
Incorrect Answers
A:The task exceeded a manageable verifiable change scope. The prompt jumped to a solution without requiring evidence of the underlying mechanism.
B:The allowed output and action boundaries were not specified. The prompt jumped to a solution without requiring evidence of the underlying mechanism.
C:The output format was not specified as a machine contract. The prompt jumped to a solution without requiring evidence of the underlying mechanism.
Question 365
A team has implemented the following change: First request a bounded step-by-step diagnosis referencing the specific destructor sequence, then ask for a minimal patch. The original requirement was: A team needs an explanation of a subtle C++ lifetime bug and asks for a complete rewrite before understanding it. Which ONE validation test best demonstrates the intended behavior?
- Parse the result as JSON and validate required keys and types.
- Use AddressSanitizer and a targeted lifetime test to verify the stated diagnosis.
- Refactor one helper, rerun API contract tests, then proceed to the next helper.
- Inspect the output for the requested patch and tests and absence of deployment actions.
Explanation
Correct Answer
B:Use AddressSanitizer and a targeted lifetime test to verify the stated diagnosis.
Incorrect Answers
A:Schema-driven tests enforce the expected wire-format contract across generated serialization code. Verification of this result involves using AddressSanitizer and a targeted lifetime test to verify the stated diagnosis.
C:Generated API calls must be verified against the installed library's actual supported signatures. Verification of this result involves using AddressSanitizer and a targeted lifetime test to verify the stated diagnosis.
D:Generated code requires independently defined acceptance tests and review against the real program contract. Verification of this result involves using AddressSanitizer and a targeted lifetime test to verify the stated diagnosis.
Question 366
A team reports: A project owner needs a new TypeScript function to paginate a REST API while respecting its page-token contract. They observe: The helper loops on the same continuation token forever. Which ONE technical decision most directly corrects the cause?
- Ask Copilot to draft a small typed pagination helper using the actual client signature, then review and test it.
- Use Copilot to propose a typed docstring, examples, and an error-case note based on source behavior.
- Ask Copilot for a source-linked explanation and verify every step against the actual middleware and tests.
- Ask Copilot for a scoped async conversion with unchanged HTTP codes and retry semantics.
Explanation
Correct Answer
A:Generated code did not implement the API's cursor progression contract.
Incorrect Answers
B:Using Copilot to propose a typed docstring, examples, and an error-case note based on source behavior would not ask Copilot to draft a small typed pagination helper using the actual client signature, then review and test it.
C:Asking Copilot for a source-linked explanation and verifying every step against the actual middleware and tests would not ask Copilot to draft a small typed pagination helper using the actual client signature, then review and test it.
D:Asking Copilot for a scoped async conversion with unchanged HTTP codes and retry semantics would not ask Copilot to draft a small typed pagination helper using the actual client signature, then review and test it.
Question 367
A team has implemented the following change: Ask Copilot to draft a small typed pagination helper using the actual client signature, then review and test it. The original requirement was: A project owner needs a new TypeScript function to paginate a REST API while respecting its page-token contract. Which ONE validation test best demonstrates the intended behavior?
- Use a request trace to validate each documented decision and error code.
- Execute the documented examples and check default and invalid timeout behavior.
- Mock two pages plus a final empty token and check the combined records contain no duplicates.
- Run negative cases and compare endpoint contract tests with the old version.
Explanation
Correct Answer
C:Mock two pages plus a final empty token and check the combined records contain no duplicates.
Incorrect Answers
A:Use a request trace to validate each documented decision and error code. That check cannot demonstrate secret-safe generated logging and code.
B:Execute the documented examples and check default and invalid timeout behavior. That check cannot demonstrate secret-safe generated logging and code.
D:Generated code requires independently defined acceptance tests and review against the real program contract. Verification of this result involves mock two pages plus a final empty token and check the combined records contain no duplicates.
Question 368
During troubleshooting, investigators observe: The helper loops on the same continuation token forever. The system context is: A project owner needs a new TypeScript function to paginate a REST API while respecting its page-token contract. Which ONE cause most directly explains the observed failure?
- The generated prose used assumed defaults rather than real signature behavior.
- Async error propagation was lost during mechanically generated modernization.
- Generated documentation summarized an incomplete code context.
- Generated code did not implement the API's cursor progression contract.
Explanation
Correct Answer
D:The remedy should therefore be: Ask Copilot to draft a small typed pagination helper using the actual client signature, then review and test it.
Incorrect Answers
A:The generated prose used assumed defaults rather than real signature behavior would not address the need for generated code did not implement the API's cursor progression contract.
B:Async error propagation was lost during mechanically generated modernization would not address the need for generated code did not implement the API's cursor progression contract.
C:Generated documentation summarized an incomplete code context would not address the need for generated code did not implement the API's cursor progression contract.
Question 369
The current design is: Ask Copilot to draft a small typed pagination helper using the actual client signature, then review and test it. The prior failure was: The helper loops on the same continuation token forever. Which ONE ongoing control best protects against recurrence of that specific failure?
- Preserve endpoint contract tests and negative async-failure cases.
- Keep typed pagination fixtures and a maximum-page safety bound in tests.
- Run documentation examples as tests for maintained libraries.
- Review API docs alongside the implementation at every protected-route change.
Explanation
Correct Answer
B:Generated code did not implement the API's cursor progression contract. Keep typed pagination fixtures and a maximum-page safety bound in tests.
Incorrect Answers
A:Generated code requires independently defined acceptance tests and review against the real program contract. Preventing this failure involves keep typed pagination fixtures and a maximum-page safety bound in tests.
C:Generated code requires independently defined acceptance tests and review against the real program contract. Preventing this failure involves keep typed pagination fixtures and a maximum-page safety bound in tests. The observed condition is ask Copilot to draft a small typed pagination helper using the actual client signature, then review and test it. The prior failure was: The helper loops on the same.
D:Generated API calls must be verified against the installed library's actual supported signatures. Preventing this failure involves keep typed pagination fixtures and a maximum-page safety bound in tests.
Question 370
A team reports: An eight-year-old Java service uses repeated null-check blocks and must be refactored without changing request semantics. They observe: A helper refactor changes the order of error codes returned for missing fields. Which ONE technical decision most directly corrects the cause?
- Use Copilot to propose one incremental behavior-preserving refactor of the duplicated validation logic.
- Ask Copilot for a scoped async conversion with unchanged HTTP codes and retry semantics.
- Use Copilot to propose a typed docstring, examples, and an error-case note based on source behavior.
- Use Copilot to propose deterministic fake fixtures that match the public order schema and privacy constraints.
Explanation
Correct Answer
A:A cosmetic cleanup modified a relied-upon observable behavior.
Incorrect Answers
B:Asking Copilot for a scoped async conversion with unchanged HTTP codes and retry semantics would not meet the need for Copilot to propose one incremental behavior-preserving refactor of the duplicated validation logic.
C:Using Copilot to propose a typed docstring, examples, and an error-case note based on source behavior would not meet the need for Copilot to propose one incremental behavior-preserving refactor of the duplicated validation logic.
D:Using Copilot to propose deterministic fake fixtures that match the public order schema and privacy constraints would not meet the need for Copilot to propose one incremental behavior-preserving refactor of the duplicated validation logic.
GitHub Copilot (GH-300) Practice Tests