Microsoft GH-300 Practice Test 4

Question 30

A team has implemented the following change: Assess the language and decision logic for discriminatory assumptions, then test representative eligible and ineligible profiles. The original requirement was: A mobile app team asks Copilot to write a user-facing eligibility message that could disadvantage users from certain regions. Which ONE validation test best demonstrates the intended behavior?

Run valid, invalid, and boundary-value card fixtures through tests based on the payment contract.
Run policy-grounded cases across geographic and demographic examples without storing identifying data.
Check whether analysis controls for confounders and reports appropriate uncertainty.
Compare unknown and known-account response status, timing, and rate-limit behavior.

Explanation

Correct Answer

Run policy-grounded cases across geographic and demographic examples without storing identifying data.

Incorrect Answers

Gateway-specific card validation requires tests derived from the published checksum contract, not plausible generated code.

Check whether analysis controls for confounders and reports appropriate uncertainty. It does not run policy-grounded cases across geographic and demographic examples without storing identifying data.

Compare unknown and known-account response status, timing, and rate-limit behavior. It does not run policy-grounded cases across geographic and demographic examples without storing identifying data.

Question 31

A GitHub Copilot task needs TWO complementary actions: the immediate fix and a preventive practice. Context: A mobile app team asks Copilot to write a user-facing eligibility message that could disadvantage users from certain regions. Observed failure: An eligible group receives an unjustified rejection message. Select exactly TWO decisions that together address these needs.

Run only a spelling and grammar checker on the eligibility message without testing the policy decisions it makes.
Check the generated validator against the gateway specification and independently written pass/fail vectors before shipping.
Assess the language and decision logic for discriminatory assumptions, then test representative eligible and ineligible profiles.
Add abuse-case tests for account enumeration to authentication feature checklists.
Make human policy owners approve fairness-sensitive rules and monitor downstream outcomes.

Explanation

Correct Answers

Training-set bias and prompt ambiguity can surface in generated business logic and copy. The needed intervention is assess the language and decision logic for discriminatory assumptions, then test representative eligible and ineligible profiles.

Training-set bias and prompt ambiguity can surface in generated business logic and copy. Make human policy owners approve fairness-sensitive rules and monitor downstream outcomes.

Incorrect Answers

Grammar checks cannot identify a discriminatory eligibility rule or validate policy fairness; testing the affected decision logic and human policy oversight are both necessary.

An LLM's fluent code is not proof of semantic compliance with an external specification. The missing change involves assess the language and decision logic for discriminatory assumptions, then test representative eligible and ineligible profiles.

Generated code requires independently defined acceptance tests and review against the real program contract. The combined controls instead need fair and testable decision rules across eligible user profiles.

Question 32

The current design is: Assess the language and decision logic for discriminatory assumptions, then test representative eligible and ineligible profiles. The prior failure was: An eligible group receives an unjustified rejection message. Which ONE ongoing control best protects against recurrence of that specific failure?

Make human policy owners approve fairness-sensitive rules and monitor downstream outcomes.
Add abuse-case tests for account enumeration to authentication feature checklists.
Require specification-derived automated tests and a human review for money-moving changes.
Use statistical peer review for AI-assisted claims with policy impact.

Explanation

Correct Answer

Training-set bias and prompt ambiguity can surface in generated business logic and copy. Make human policy owners approve fairness-sensitive rules and monitor downstream outcomes. Preventing this failure involves make human policy owners approve fairness-sensitive rules and monitor downstream outcomes.

Incorrect Answers

Generated code requires independently defined acceptance tests and review against the real program contract. It would leave fair and testable decision rules across eligible user profiles without the specified safeguard.

Generated code requires independently defined acceptance tests and review against the real program contract. Preventing this failure involves make human policy owners approve fairness-sensitive rules and monitor downstream outcomes. The observed condition is assess the language and decision logic for discriminatory assumptions, then test representative eligible and ineligible profiles. The prior failure was: An eligible.

Question 33

A team reports: An engineer asks Copilot to explain a repository and then pastes the entire summary into a critical incident report without verification. They observe: The incident review attributes an outage to a component that was not deployed. Which ONE technical decision most directly corrects the cause?

Cross-check the summary against exact commits, logs, and code paths; label unresolved hypotheses.
Check the generated validator against the gateway specification and independently written pass/fail vectors before shipping.
Cross-check policy names and availability in current first-party GitHub documentation before directing administrators.
Check generated API calls against pinned package version documentation and execute compatibility tests.

Explanation

Correct Answer

A plausible LLM narrative is not equivalent to evidence from the operating system.

Incorrect Answers

Checking the generated validator against the gateway specification and independently written pass/fail vectors would not cross-check the summary against exact commits, logs, and code paths.

Cross-checking policy names and availability in current first-party GitHub documentation would not cross-check the summary against exact commits, logs, and code paths.

Checking generated API calls against pinned package version documentation and execute compatibility tests would not cross-check the summary against exact commits, logs, and code paths.

Question 34

A team has implemented the following change: Cross-check the summary against exact commits, logs, and code paths; label unresolved hypotheses. The original requirement was: An engineer asks Copilot to explain a repository and then pastes the entire summary into a critical incident report without verification. Which ONE validation test best demonstrates the intended behavior?

Compile and run the refactor against the actual installed dependency version.
Run valid, invalid, and boundary-value card fixtures through tests based on the payment contract.
Find the named setting in an authorized test organization or an official feature matrix.
Trace each asserted root cause to an observed log line or reproducible test.

Explanation

Correct Answer

Trace each asserted root cause to an observed log line or reproducible test.

Incorrect Answers

Approved dependency sources and lockfiles protect builds against invented or impersonated packages. That check cannot demonstrate evidence-grounded incident cause analysis.

Gateway-specific card validation requires tests derived from the published checksum contract, not plausible generated code. Verification of this result involves tracing each asserted root cause to an observed log line or reproducible test.

Generated code requires independently defined acceptance tests and review against the real program contract. That check cannot demonstrate evidence-grounded incident cause analysis.

Question 35

During troubleshooting, investigators observe: The incident review attributes an outage to a component that was not deployed. The system context is: An engineer asks Copilot to explain a repository and then pastes the entire summary into a critical incident report without verification. Which ONE cause most directly explains the observed failure?

A plausible LLM narrative is not equivalent to evidence from the operating system.
The model hallucinated a product capability or surface-specific control.
An LLM's fluent code is not proof of semantic compliance with an external specification.
The model inferred an API signature from stale or mismatched examples.

Explanation

Correct Answer

The remedy should therefore be: Cross-check the summary against exact commits, logs, and code paths; label unresolved hypotheses.

Incorrect Answers

The model hallucinated a product capability or surface-specific control. That does not establish a plausible LLM narrative is not equivalent to evidence from the operating system.

An LLM's fluent code is not proof of semantic compliance with an external specification. A plausible LLM narrative is not equivalent to evidence from the operating system.

The model inferred an API signature from stale or mismatched examples. A plausible LLM narrative is not equivalent to evidence from the operating system.

Question 36

The current design is: Cross-check the summary against exact commits, logs, and code paths; label unresolved hypotheses. The prior failure was: The incident review attributes an outage to a component that was not deployed. Which ONE ongoing control best protects against recurrence of that specific failure?

Require evidence links and reviewer signoff for AI-assisted postmortems.
Keep package-version context, build verification, and controlled rollouts for generated refactors.
Require specification-derived automated tests and a human review for money-moving changes.
Require current vendor documentation and test-tenant verification for administrative instructions.

Explanation

Correct Answer

A plausible LLM narrative is not equivalent to evidence from the operating system. Require evidence links and reviewer signoff for AI-assisted postmortems.

Incorrect Answers

Generated code requires independently defined acceptance tests and review against the real program contract. It would leave evidence-grounded incident cause analysis without the specified safeguard.

Generated code requires independently defined acceptance tests and review against the real program contract. Preventing this failure involves requiring evidence links and reviewer signoff for AI-assisted postmortems. The observed condition is cross-check the summary against exact commits, logs, and code paths; label unresolved hypotheses. The prior failure was: The incident review attributes an outage to.

Question 37

A team reports: An AI-generated shell command would recursively remove an obsolete workspace but the active repository path looks similar. They observe: A broad path glob targets the checked-out production repository. Which ONE technical decision most directly corrects the cause?

Replace string interpolation with parameterized queries and review the data-access path for injection hazards.
Inspect command expansion, target directory and dry-run behavior before executing anything destructive.
Verify the security requirement and run negative authorization tests, not only the originally failing positive test.
Remove credential material from logging and replace it with safe trace identifiers and masked metadata.

Explanation

Correct Answer

The command was treated as safe because it was AI-produced, not because its side effects were understood.

Incorrect Answers

Replacing string interpolation with parameterized queries and reviewing the data-access path for injection hazards would not inspect command expansion, target directory and dry-run behavior.

Verifying the security requirement and running negative authorization tests, not only the originally failing positive test would not inspect command expansion, target directory and dry-run behavior.

Removing credential material from logging and replacing it with safe trace identifiers and masked metadata would not inspect command expansion, target directory and dry-run behavior.

Question 38

A team has implemented the following change: Inspect command expansion, target directory and dry-run behavior before executing anything destructive. The original requirement was: An AI-generated shell command would recursively remove an obsolete workspace but the active repository path looks similar. Which ONE validation test best demonstrates the intended behavior?

Run a non-destructive listing of the resolved path and test in an isolated fixture first.
Exercise a request and inspect resulting logs for bearer tokens or cookies.
Run an SQL-injection test with quotes and comments; confirm it is treated as a parameter, not query syntax.
Send malformed and unauthorized requests and ensure rejection remains enforced.

Explanation

Correct Answer

Run a non-destructive listing of the resolved path and test in an isolated fixture first.

Incorrect Answers

Redacting credentials and tokens prevents generated instrumentation from exposing secrets in logs or repositories. That check cannot demonstrate safe execution of generated command-line actions.

Generated code requires independently defined acceptance tests and review against the real program contract. That check cannot demonstrate safe execution of generated command-line actions.

Send malformed and unauthorized requests and ensure rejection remains enforced. That check cannot demonstrate safe execution of generated command-line actions.

Question 39

During troubleshooting, investigators observe: A broad path glob targets the checked-out production repository. The system context is: An AI-generated shell command would recursively remove an obsolete workspace but the active repository path looks similar. Which ONE cause most directly explains the observed failure?

A suggestion optimized for green tests without preserving the original threat boundary.
Suggested code reproduced a dangerous string-building pattern rather than safe binding.
Generated instrumentation neglected secret-handling and observability boundaries.
The command was treated as safe because it was AI-produced, not because its side effects were understood.

Explanation

Correct Answer

The remedy should therefore be: Inspect command expansion, target directory and dry-run behavior before executing anything destructive.

Incorrect Answers

A suggestion optimized for green tests without preserving the original threat boundary. The command was treated as safe because it was AI-produced, not because its side effects were understood.

Suggested code reproduced a dangerous string-building pattern rather than safe binding. The command was treated as safe because it was AI-produced, not because its side effects were understood.

Generated instrumentation neglected secret-handling and observability boundaries. The command was treated as safe because it was AI-produced, not because its side effects were understood.

Question 40

The current design is: Inspect command expansion, target directory and dry-run behavior before executing anything destructive. The prior failure was: A broad path glob targets the checked-out production repository. Which ONE ongoing control best protects against recurrence of that specific failure?

Use command approvals and backups for destructive agent or shell operations.
Check for secret-bearing log fields during code review and run secret scanners.
Require security scanning and injection-focused tests on authentication code before merge.
Enforce security acceptance tests and diff review for generated fixes.

Explanation

Correct Answer

The command was treated as safe because it was AI-produced, not because its side effects were understood. Use command approvals and backups for destructive agent or shell operations.

Incorrect Answers

Redacting credentials and tokens prevents generated instrumentation from exposing secrets in logs or repositories. It would leave safe execution of generated command-line actions without the specified safeguard.

Generated code requires independently defined acceptance tests and review against the real program contract. It would leave safe execution of generated command-line actions without the specified safeguard.

Generated code requires independently defined acceptance tests and review against the real program contract. Preventing this failure involves using command approvals and backups for destructive agent or shell operations.

GitHub Copilot (GH-300) Practice Tests

Microsoft GH-300 Practice Test 2 - 10 Questions (Last Reviewed 12-Nov-2026)
Microsoft GH-300 Practice Test 3 - 10 Questions (Last Reviewed 11-Nov-2026)
Microsoft GH-300 Practice Test 4 - 10 Questions (Last Reviewed 10-Nov-2026)
Microsoft GH-300 Practice Test 5 - 10 Questions (Last Reviewed 09-Nov-2026)
Microsoft GH-300 Practice Test 6 - 10 Questions (Last Reviewed 08-Nov-2026)

Pass Your Microsoft GH-300 Exam Easy!

Question 30

Explanation

Correct Answer

Incorrect Answers

Question 31

Explanation

Correct Answers

Incorrect Answers

Question 32

Explanation

Correct Answer

Incorrect Answers

Question 33

Explanation

Correct Answer

Incorrect Answers

Question 34

Explanation

Correct Answer

Incorrect Answers

Question 35

Explanation

Correct Answer

Incorrect Answers

Question 36

Explanation

Correct Answer

Incorrect Answers

Question 37

Explanation

Correct Answer

Incorrect Answers

Question 38

Explanation

Correct Answer

Incorrect Answers

Question 39

Explanation

Correct Answer

Incorrect Answers

Question 40

Explanation

Correct Answer

Incorrect Answers

GitHub Copilot (GH-300) Practice Tests