Question 50
A team has implemented the following change: Preserve functional invariants and verify numeric correctness before accepting performance changes. The original requirement was: Copilot proposes an optimization that improves speed but silently changes monetary rounding precision. Which ONE validation test best demonstrates the intended behavior?
- Compare old and new outputs on fractional cents, large totals, and boundary rounding modes.
- Inject a response with missing required attributes and check that the suite detects it.
- Install dependencies from the trusted registry in a disposable build and check package provenance.
- Check algorithm mode, key size, nonce handling, and policy listing independently of the chat response.
Explanation
Correct Answer
A:Compare old and new outputs on fractional cents, large totals, and boundary rounding modes.
Incorrect Answers
B:Inject a response with missing required attributes and check that the suite detects it. It does not compare old and new outputs on fractional cents, large totals, and boundary rounding modes.
C:Approved dependency sources and lockfiles protect builds against invented or impersonated packages. It does not compare old and new outputs on fractional cents, large totals, and boundary rounding modes.
D:Approved dependency sources and lockfiles protect builds against invented or impersonated packages. Verification of this result involves comparing old and new outputs on fractional cents, large totals, and boundary rounding modes.
Question 51
During troubleshooting, investigators observe: Payments calculated after the optimization differ from ledger records. The system context is: Copilot proposes an optimization that improves speed but silently changes monetary rounding precision. Which ONE cause most directly explains the observed failure?
- Surface-level test success does not validate actual contract semantics.
- A performance-looking rewrite altered a protected business invariant.
- A generated compliance claim has no authoritative approval on its own.
- Generative responses can fabricate package identifiers and cannot establish supply-chain trust.
Explanation
Correct Answer
B:The remedy should therefore be: Preserve functional invariants and verify numeric correctness before accepting performance changes.
Incorrect Answers
A:Surface-level test success does not validate actual contract semantics. A performance-looking rewrite altered a protected business invariant.
C:A generated compliance claim has no authoritative approval on its own. A performance-looking rewrite altered a protected business invariant.
D:Generative responses can fabricate package identifiers and cannot establish supply-chain trust. A performance-looking rewrite altered a protected business invariant.
Question 52
The current design is: Preserve functional invariants and verify numeric correctness before accepting performance changes. The prior failure was: Payments calculated after the optimization differ from ledger records. Which ONE ongoing control best protects against recurrence of that specific failure?
- Enforce approved-package checks, lockfile review, and dependency scanning for AI-authored changes.
- Review generated assertions for strength and add contract testing to CI.
- Require cryptography design review and traceable standards references before production adoption.
- Use benchmark-plus-correctness gates and require domain-owner review of arithmetic changes.
Explanation
Correct Answer
D:A performance-looking rewrite altered a protected business invariant. Use benchmark-plus-correctness gates and require domain-owner review of arithmetic changes.
Incorrect Answers
A:Approved dependency sources and lockfiles protect builds against invented or impersonated packages. It would leave tested AI-assisted changes that preserve stated requirements without the specified safeguard.
B:Generated code requires independently defined acceptance tests and review against the real program contract. Preventing this failure involves using benchmark-plus-correctness gates and require domain-owner review of arithmetic changes.
C:Cryptographic algorithm decisions must follow authoritative security standards rather than unverified model claims.
Question 53
A team reports: A developer asks Copilot to write a password-reset flow and receives code that reveals whether an email is registered. They observe: Attackers can enumerate customer email addresses through different reset messages. Which ONE technical decision most directly corrects the cause?
- Return a consistent response and enforce rate limits while delivering reset tokens by approved secure channel.
- Verify the security requirement and run negative authorization tests, not only the originally failing positive test.
- Scan generated content and diffs; replace any credential-like string with managed secret references.
- Remove real personal data and use synthetic records with the same safe schema when requesting Copilot test fixtures.
Explanation
Correct Answer
A:The generated user-experience logic overlooked information-disclosure threats.
Incorrect Answers
B:A suggestion optimized for green tests without preserving the original threat boundary. The generated user-experience logic overlooked information-disclosure threats.
C:Copilot output is not exempt from normal secret-leak risks. The generated user-experience logic overlooked information-disclosure threats.
D:The developer exposed sensitive personal information to a tool unnecessarily. The generated user-experience logic overlooked information-disclosure threats.
Question 54
A team has implemented the following change: Return a consistent response and enforce rate limits while delivering reset tokens by approved secure channel. The original requirement was: A developer asks Copilot to write a password-reset flow and receives code that reveals whether an email is registered. Which ONE validation test best demonstrates the intended behavior?
- Compare unknown and known-account response status, timing, and rate-limit behavior.
- Send malformed and unauthorized requests and ensure rejection remains enforced.
- Inspect the outgoing prompt and generated fixtures for actual patient identifiers before sharing them.
- Run secret scanning on the generated patch and inspect config sources before commit.
Explanation
Correct Answer
A:Compare unknown and known-account response status, timing, and rate-limit behavior.
Incorrect Answers
B:Send malformed and unauthorized requests and ensure rejection remains enforced. It does not compare unknown and known-account response status, timing, and rate-limit behavior.
C:Synthetic fixtures preserve a usable test schema without exposing identifiable patient records to AI prompts. Verification of this result involves comparing unknown and known-account response status, timing, and rate-limit behavior.
D:AI-assisted postmortem claims need links to actual commits, logs and reproducible failures. It does not compare unknown and known-account response status, timing, and rate-limit behavior.
Question 55
During troubleshooting, investigators observe: Attackers can enumerate customer email addresses through different reset messages. The system context is: A developer asks Copilot to write a password-reset flow and receives code that reveals whether an email is registered. Which ONE cause most directly explains the observed failure?
- The generated user-experience logic overlooked information-disclosure threats.
- The developer exposed sensitive personal information to a tool unnecessarily.
- Copilot output is not exempt from normal secret-leak risks.
- A suggestion optimized for green tests without preserving the original threat boundary.
Explanation
Correct Answer
A:The remedy should therefore be: Return a consistent response and enforce rate limits while delivering reset tokens by approved secure channel.
Incorrect Answers
B:The developer exposed sensitive personal information to a tool unnecessarily. The generated user-experience logic overlooked information-disclosure threats.
C:Copilot output is not exempt from normal secret-leak risks. The generated user-experience logic overlooked information-disclosure threats.
D:A suggestion optimized for green tests without preserving the original threat boundary. The generated user-experience logic overlooked information-disclosure threats.
Question 56
The current design is: Return a consistent response and enforce rate limits while delivering reset tokens by approved secure channel. The prior failure was: Attackers can enumerate customer email addresses through different reset messages. Which ONE ongoing control best protects against recurrence of that specific failure?
- Teach data minimization and block production identifiers in AI-assisted test-generation workflows.
- Add abuse-case tests for account enumeration to authentication feature checklists.
- Enforce security acceptance tests and diff review for generated fixes.
- Block secret-bearing commits with scanning and protected-branch checks.
Explanation
Correct Answer
B:The generated user-experience logic overlooked information-disclosure threats. Add abuse-case tests for account enumeration to authentication feature checklists.
Incorrect Answers
A:Generated code requires independently defined acceptance tests and review against the real program contract. Preventing this failure involves adding abuse-case tests for account enumeration to authentication feature checklists.
C:Generated code requires independently defined acceptance tests and review against the real program contract. Preventing this failure involves adding abuse-case tests for account enumeration to authentication feature checklists. The observed condition is return a consistent response and enforce rate limits while delivering reset tokens by approved secure channel. The prior failure was: Attackers can enumerate.
D:AI-assisted postmortem claims need links to actual commits, logs and reproducible failures. Preventing this failure involves adding abuse-case tests for account enumeration to authentication feature checklists.
Question 57
A team reports: Copilot-generated tests assert only that an API returns HTTP 200; a regression now silently discards most response fields. They observe: CI remains green when mandatory API fields disappear. Which ONE technical decision most directly corrects the cause?
- Preserve functional invariants and verify numeric correctness before accepting performance changes.
- Expand tests to realistic multilingual input, empty strings, and normalization boundary cases before relying on the output.
- Expand assertions to the documented response schema and meaningful business invariants.
- Use schema-driven tests and compare examples before merging generated serialization code.
Explanation
Correct Answer
C:Surface-level test success does not validate actual contract semantics.
Incorrect Answers
A:Preserving functional invariants and verifying numeric correctness would not expand assertions to the documented response schema and meaningful business invariants.
B:Expanding tests to realistic multilingual input, empty strings, and normalization boundary cases would not expand assertions to the documented response schema and meaningful business invariants.
D:Generated code failed to preserve the wire-format contract.
Question 58
A team has implemented the following change: Expand assertions to the documented response schema and meaningful business invariants. The original requirement was: Copilot-generated tests assert only that an API returns HTTP 200; a regression now silently discards most response fields. Which ONE validation test best demonstrates the intended behavior?
- Run explicit composed and decomposed Unicode fixtures and compare behavior to the required interface contract.
- Compare old and new outputs on fractional cents, large totals, and boundary rounding modes.
- Run fixtures covering missing fields, explicit null, and literal string "null" independently.
- Inject a response with missing required attributes and check that the suite detects it.
Explanation
Correct Answer
D:Inject a response with missing required attributes and check that the suite detects it.
Incorrect Answers
A:Unicode behavior must be tested with composed, decomposed and boundary-case text, not only ASCII samples.
B:Compare old and new outputs on fractional cents, large totals, and boundary rounding modes. That check cannot demonstrate inject a response with missing required attributes and check that the suite detects it.
C:Approved dependency sources and lockfiles protect builds against invented or impersonated packages. That check cannot demonstrate inject a response with missing required attributes and check that the suite detects it.
Question 59
During troubleshooting, investigators observe: CI remains green when mandatory API fields disappear. The system context is: Copilot-generated tests assert only that an API returns HTTP 200; a regression now silently discards most response fields. Which ONE cause most directly explains the observed failure?
- Training examples biased toward ASCII are not evidence of general Unicode correctness.
- A performance-looking rewrite altered a protected business invariant.
- Surface-level test success does not validate actual contract semantics.
- Generated code failed to preserve the wire-format contract.
Explanation
Correct Answer
C:The remedy should therefore be: Expand assertions to the documented response schema and meaningful business invariants.
Incorrect Answers
A:Training examples biased toward ASCII are not evidence of general Unicode correctness would not address the need for surface-level test success does not validate actual contract semantics.
B:A performance-looking rewrite altered a protected business invariant would not address the need for surface-level test success does not validate actual contract semantics.
D:Generated code failed to preserve the wire-format contract would not address the need for surface-level test success does not validate actual contract semantics.
Question 60
The current design is: Expand assertions to the documented response schema and meaningful business invariants. The prior failure was: CI remains green when mandatory API fields disappear. Which ONE ongoing control best protects against recurrence of that specific failure?
- Require contract-based tests and code owner checks for payload-format changes.
- Use benchmark-plus-correctness gates and require domain-owner review of arithmetic changes.
- Review generated assertions for strength and add contract testing to CI.
- Maintain representative accessibility and internationalization regression cases in CI.
Explanation
Correct Answer
C:Surface-level test success does not validate actual contract semantics. Review generated assertions for strength and add contract testing to CI.
Incorrect Answers
A:Generated code requires independently defined acceptance tests and review against the real program contract. Preventing this failure involves reviewing generated assertions for strength and add contract testing to CI.
B:Generated code requires independently defined acceptance tests and review against the real program contract. Preventing this failure involves reviewing generated assertions for strength and add contract testing to CI. The observed condition is expand assertions to the documented response schema and meaningful business invariants. The prior failure was: CI remains green when mandatory API fields disappear.
D:Maintain representative accessibility and internationalization regression cases in CI. It would leave tested AI-assisted changes that preserve stated requirements without the specified safeguard.
GitHub Copilot (GH-300) Practice Tests