Question 40
The current design is: Inspect command expansion, target directory and dry-run behavior before executing anything destructive. The prior failure was: A broad path glob targets the checked-out production repository. Which ONE ongoing control best protects against recurrence of that specific failure?
- Use command approvals and backups for destructive agent or shell operations.
- Check for secret-bearing log fields during code review and run secret scanners.
- Require security scanning and injection-focused tests on authentication code before merge.
- Enforce security acceptance tests and diff review for generated fixes.
Explanation
Correct Answer
A:The command was treated as safe because it was AI-produced, not because its side effects were understood. Use command approvals and backups for destructive agent or shell operations.
Incorrect Answers
B:Redacting credentials and tokens prevents generated instrumentation from exposing secrets in logs or repositories. It would leave safe execution of generated command-line actions without the specified safeguard.
C:Generated code requires independently defined acceptance tests and review against the real program contract. It would leave safe execution of generated command-line actions without the specified safeguard.
D:Generated code requires independently defined acceptance tests and review against the real program contract. Preventing this failure involves using command approvals and backups for destructive agent or shell operations.
Question 41
A team reports: A support bot drafts code to log full HTTP Authorization headers for debugging transient authentication failures. They observe: Production logs expose reusable session credentials. Which ONE technical decision most directly corrects the cause?
- Replace string interpolation with parameterized queries and review the data-access path for injection hazards.
- Scan generated content and diffs; replace any credential-like string with managed secret references.
- Remove real personal data and use synthetic records with the same safe schema when requesting Copilot test fixtures.
- Remove credential material from logging and replace it with safe trace identifiers and masked metadata.
Explanation
Correct Answer
D:Generated instrumentation neglected secret-handling and observability boundaries.
Incorrect Answers
A:Suggested code reproduced a dangerous string-building pattern rather than safe binding. Generated instrumentation neglected secret-handling and observability boundaries.
B:Copilot output is not exempt from normal secret-leak risks. Generated instrumentation neglected secret-handling and observability boundaries.
C:The developer exposed sensitive personal information to a tool unnecessarily. Generated instrumentation neglected secret-handling and observability boundaries.
Question 42
A team has implemented the following change: Remove credential material from logging and replace it with safe trace identifiers and masked metadata. The original requirement was: A support bot drafts code to log full HTTP Authorization headers for debugging transient authentication failures. Which ONE validation test best demonstrates the intended behavior?
- Run an SQL-injection test with quotes and comments; confirm it is treated as a parameter, not query syntax.
- Exercise a request and inspect resulting logs for bearer tokens or cookies.
- Inspect the outgoing prompt and generated fixtures for actual patient identifiers before sharing them.
- Run secret scanning on the generated patch and inspect config sources before commit.
Explanation
Correct Answer
B:Exercise a request and inspect resulting logs for bearer tokens or cookies.
Incorrect Answers
A:Generated code requires independently defined acceptance tests and review against the real program contract. That check cannot demonstrate secret-safe generated logging and code.
C:Synthetic fixtures preserve a usable test schema without exposing identifiable patient records to AI prompts.
D:AI-assisted postmortem claims need links to actual commits, logs and reproducible failures. That check cannot demonstrate secret-safe generated logging and code.
Question 43
During troubleshooting, investigators observe: Production logs expose reusable session credentials. The system context is: A support bot drafts code to log full HTTP Authorization headers for debugging transient authentication failures. Which ONE cause most directly explains the observed failure?
- The developer exposed sensitive personal information to a tool unnecessarily.
- Generated instrumentation neglected secret-handling and observability boundaries.
- Copilot output is not exempt from normal secret-leak risks.
- Suggested code reproduced a dangerous string-building pattern rather than safe binding.
Explanation
Correct Answer
B:The remedy should therefore be: Remove credential material from logging and replace it with safe trace identifiers and masked metadata.
Incorrect Answers
A:The developer exposed sensitive personal information to a tool unnecessarily would not address the need for generated instrumentation neglected secret-handling and observability boundaries.
C:Copilot output is not exempt from normal secret-leak risks would not address the need for generated instrumentation neglected secret-handling and observability boundaries.
D:Suggested code reproduced a dangerous string-building pattern rather than safe binding would not address the need for generated instrumentation neglected secret-handling and observability boundaries.
Question 44
The current design is: Remove credential material from logging and replace it with safe trace identifiers and masked metadata. The prior failure was: Production logs expose reusable session credentials. Which ONE ongoing control best protects against recurrence of that specific failure?
- Teach data minimization and block production identifiers in AI-assisted test-generation workflows.
- Check for secret-bearing log fields during code review and run secret scanners.
- Require security scanning and injection-focused tests on authentication code before merge.
- Block secret-bearing commits with scanning and protected-branch checks.
Explanation
Correct Answer
B:Generated instrumentation neglected secret-handling and observability boundaries. Check for secret-bearing log fields during code review and run secret scanners.
Incorrect Answers
A:Generated code requires independently defined acceptance tests and review against the real program contract. It would leave secret-safe generated logging and code without the specified safeguard.
C:Generated code requires independently defined acceptance tests and review against the real program contract. Preventing this failure involves checking for secret-bearing log fields during code review and run secret scanners.
D:AI-assisted postmortem claims need links to actual commits, logs and reproducible failures. It would leave secret-safe generated logging and code without the specified safeguard.
Question 45
A team reports: A team uses Copilot to refactor a licensed library integration, but the resulting API call uses a method removed in the current major release. They observe: The refactored service crashes with method-not-found after deployment. Which ONE technical decision most directly corrects the cause?
- Check generated API calls against pinned package version documentation and execute compatibility tests.
- Expand assertions to the documented response schema and meaningful business invariants.
- Check the generated validator against the gateway specification and independently written pass/fail vectors before shipping.
- Treat AI review as supplementary; require human security review plus tests and scanners for release.
Explanation
Correct Answer
A:The model inferred an API signature from stale or mismatched examples.
Incorrect Answers
B:Expanding assertions to the documented response schema and meaningful business invariants would not check generated API calls against pinned package version documentation and execute compatibility tests.
C:Checking the generated validator against the gateway specification and independently written pass/fail vectors would not check generated API calls against pinned package version documentation and execute compatibility tests.
D:Treat AI review as supplementary would not check generated API calls against pinned package version documentation and execute compatibility tests.
Question 46
A team has implemented the following change: Check generated API calls against pinned package version documentation and execute compatibility tests. The original requirement was: A team uses Copilot to refactor a licensed library integration, but the resulting API call uses a method removed in the current major release. Which ONE validation test best demonstrates the intended behavior?
- Compile and run the refactor against the actual installed dependency version.
- Inject a response with missing required attributes and check that the suite detects it.
- Confirm a human reviewer checked authentication, authorization, and dependency changes independently.
- Run valid, invalid, and boundary-value card fixtures through tests based on the payment contract.
Explanation
Correct Answer
A:Compile and run the refactor against the actual installed dependency version.
Incorrect Answers
B:Inject a response with missing required attributes and check that the suite detects it. That check cannot demonstrate verified package identity and dependency provenance.
C:Approved dependency sources and lockfiles protect builds against invented or impersonated packages. Verification of this result involves compile and run the refactor against the actual installed dependency version.
D:Gateway-specific card validation requires tests derived from the published checksum contract, not plausible generated code. Verification of this result involves compile and run the refactor against the actual installed dependency version.
Question 47
During troubleshooting, investigators observe: The refactored service crashes with method-not-found after deployment. The system context is: A team uses Copilot to refactor a licensed library integration, but the resulting API call uses a method removed in the current major release. Which ONE cause most directly explains the observed failure?
- Surface-level test success does not validate actual contract semantics.
- An LLM's fluent code is not proof of semantic compliance with an external specification.
- The model inferred an API signature from stale or mismatched examples.
- Automated reviewers can miss defects and offer false positives; silence is not certification.
Explanation
Correct Answer
C:The remedy should therefore be: Check generated API calls against pinned package version documentation and execute compatibility tests.
Incorrect Answers
A:Surface-level test success does not validate actual contract semantics. The model inferred an API signature from stale or mismatched examples.
B:An LLM's fluent code is not proof of semantic compliance with an external specification. The model inferred an API signature from stale or mismatched examples.
D:Automated reviewers can miss defects and offer false positives; silence is not certification. The model inferred an API signature from stale or mismatched examples.
Question 48
The current design is: Check generated API calls against pinned package version documentation and execute compatibility tests. The prior failure was: The refactored service crashes with method-not-found after deployment. Which ONE ongoing control best protects against recurrence of that specific failure?
- Require specification-derived automated tests and a human review for money-moving changes.
- Keep required human reviewer protections and security gates for sensitive paths.
- Keep package-version context, build verification, and controlled rollouts for generated refactors.
- Review generated assertions for strength and add contract testing to CI.
Explanation
Correct Answer
C:The model inferred an API signature from stale or mismatched examples. Keep package-version context, build verification, and controlled rollouts for generated refactors.
Incorrect Answers
A:Generated code requires independently defined acceptance tests and review against the real program contract. Preventing this failure involves keep package-version context, build verification, and controlled rollouts for generated refactors.
B:Generated code requires independently defined acceptance tests and review against the real program contract. Preventing this failure involves keep package-version context, build verification, and controlled rollouts for generated refactors. The observed condition is check generated API calls against pinned package version documentation and execute compatibility tests. The prior failure was: The refactored service crashes with.
D:Generated code requires independently defined acceptance tests and review against the real program contract. Preventing this failure involves keep package-version context, build verification, and controlled rollouts for generated refactors. The observed condition is check generated API calls against pinned package version documentation and execute compatibility tests. The prior failure was: The refactored service crashes with. Preventing this failure involves keep package-version context, build verification, and controlled rollouts for generated refactors. The named alternative instead concerns reviewing generated assertions for strength and add contract testing to ci.
Question 49
A team reports: Copilot proposes an optimization that improves speed but silently changes monetary rounding precision. They observe: Payments calculated after the optimization differ from ledger records. Which ONE technical decision most directly corrects the cause?
- Expand assertions to the documented response schema and meaningful business invariants.
- Preserve functional invariants and verify numeric correctness before accepting performance changes.
- Confirm algorithm approval and parameter requirements against the applicable standard and security team guidance.
- Verify every dependency against the official registry and dependency lockfile before accepting generated imports.
Explanation
Correct Answer
B:A performance-looking rewrite altered a protected business invariant.
Incorrect Answers
A:Expanding assertions to the documented response schema and meaningful business invariants would not preserve functional invariants and verify numeric correctness.
C:Confirming algorithm approval and parameter requirements against the applicable standard and security team guidance would not preserve functional invariants and verify numeric correctness.
D:Verifying every dependency against the official registry and dependency lockfile would not preserve functional invariants and verify numeric correctness.
Question 50
A team has implemented the following change: Preserve functional invariants and verify numeric correctness before accepting performance changes. The original requirement was: Copilot proposes an optimization that improves speed but silently changes monetary rounding precision. Which ONE validation test best demonstrates the intended behavior?
- Compare old and new outputs on fractional cents, large totals, and boundary rounding modes.
- Inject a response with missing required attributes and check that the suite detects it.
- Install dependencies from the trusted registry in a disposable build and check package provenance.
- Check algorithm mode, key size, nonce handling, and policy listing independently of the chat response.
Explanation
Correct Answer
A:Compare old and new outputs on fractional cents, large totals, and boundary rounding modes.
Incorrect Answers
B:Inject a response with missing required attributes and check that the suite detects it. It does not compare old and new outputs on fractional cents, large totals, and boundary rounding modes.
C:Approved dependency sources and lockfiles protect builds against invented or impersonated packages. It does not compare old and new outputs on fractional cents, large totals, and boundary rounding modes.
D:Approved dependency sources and lockfiles protect builds against invented or impersonated packages. Verification of this result involves comparing old and new outputs on fractional cents, large totals, and boundary rounding modes.
GitHub Copilot (GH-300) Practice Tests