Question 70
A team has implemented the following change: Separate statistical inference from code generation and involve an analyst to validate sampling and causal claims. The original requirement was: A request asks Copilot to create analytics demonstrating that an intervention worked, but the supplied sample has selection bias. Which ONE validation test best demonstrates the intended behavior?
- Compare unknown and known-account response status, timing, and rate-limit behavior.
- Run policy-grounded cases across geographic and demographic examples without storing identifying data.
- Trace each asserted root cause to an observed log line or reproducible test.
- Check whether analysis controls for confounders and reports appropriate uncertainty.
Explanation
Correct Answer
D:Check whether analysis controls for confounders and reports appropriate uncertainty.
Incorrect Answers
A:Compare unknown and known-account response status, timing, and rate-limit behavior. It does not check whether analysis controls for confounders and reports appropriate uncertainty.
B:Run policy-grounded cases across geographic and demographic examples without storing identifying data. Verification of this result involves checking whether analysis controls for confounders and reports appropriate uncertainty.
C:AI-assisted postmortem claims need links to actual commits, logs and reproducible failures. It does not check whether analysis controls for confounders and reports appropriate uncertainty.
Question 71
During troubleshooting, investigators observe: The dashboard labels a correlation as a proven causal improvement. The system context is: A request asks Copilot to create analytics demonstrating that an intervention worked, but the supplied sample has selection bias. Which ONE cause most directly explains the observed failure?
- A plausible LLM narrative is not equivalent to evidence from the operating system.
- The generated user-experience logic overlooked information-disclosure threats.
- Training-set bias and prompt ambiguity can surface in generated business logic and copy.
- The model can produce confident narratives without a defensible experimental design.
Explanation
Correct Answer
D:The remedy should therefore be: Separate statistical inference from code generation and involve an analyst to validate sampling and causal claims.
Incorrect Answers
A:A plausible LLM narrative is not equivalent to evidence from the operating system. The model can produce confident narratives without a defensible experimental design.
B:The generated user-experience logic overlooked information-disclosure threats. The model can produce confident narratives without a defensible experimental design.
C:Representative input testing reveals discriminatory decision assumptions that plausible generated prose may conceal. That check cannot demonstrate the model can produce confident narratives without a defensible experimental design.
Question 72
The current design is: Separate statistical inference from code generation and involve an analyst to validate sampling and causal claims. The prior failure was: The dashboard labels a correlation as a proven causal improvement. Which ONE ongoing control best protects against recurrence of that specific failure?
- Add abuse-case tests for account enumeration to authentication feature checklists.
- Use statistical peer review for AI-assisted claims with policy impact.
- Require evidence links and reviewer signoff for AI-assisted postmortems.
- Make human policy owners approve fairness-sensitive rules and monitor downstream outcomes.
Explanation
Correct Answer
B:The model can produce confident narratives without a defensible experimental design. Use statistical peer review for AI-assisted claims with policy impact.
Incorrect Answers
A:Generated code requires independently defined acceptance tests and review against the real program contract. Preventing this failure involves using statistical peer review for AI-assisted claims with policy impact.
C:AI-assisted postmortem claims need links to actual commits, logs and reproducible failures. Preventing this failure involves using statistical peer review for AI-assisted claims with policy impact.
D:Representative input testing reveals discriminatory decision assumptions that plausible generated prose may conceal. It would leave tested AI-assisted changes that preserve stated requirements without the specified safeguard.
Question 73
A team reports: A junior developer pastes an AI-generated vulnerability fix but the patch disables request validation to make a failing test pass. They observe: The patched endpoint now accepts unvalidated inputs. Which ONE technical decision most directly corrects the cause?
- Remove real personal data and use synthetic records with the same safe schema when requesting Copilot test fixtures.
- Remove credential material from logging and replace it with safe trace identifiers and masked metadata.
- Verify the security requirement and run negative authorization tests, not only the originally failing positive test.
- Inspect command expansion, target directory and dry-run behavior before executing anything destructive.
Explanation
Correct Answer
C:A suggestion optimized for green tests without preserving the original threat boundary.
Incorrect Answers
A:The developer exposed sensitive personal information to a tool unnecessarily. That does not establish tested AI-assisted changes that preserve stated requirements.
B:Removing credential material from logging and replacing it with safe trace identifiers and masked metadata would not verify the security requirement and run negative authorization tests, not only the originally failing positive test.
D:Inspecting command expansion, target directory and dry-run behavior would not verify the security requirement and run negative authorization tests, not only the originally failing positive test.
Question 74
A team has implemented the following change: Verify the security requirement and run negative authorization tests, not only the originally failing positive test. The original requirement was: A junior developer pastes an AI-generated vulnerability fix but the patch disables request validation to make a failing test pass. Which ONE validation test best demonstrates the intended behavior?
- Inspect the outgoing prompt and generated fixtures for actual patient identifiers before sharing them.
- Exercise a request and inspect resulting logs for bearer tokens or cookies.
- Run a non-destructive listing of the resolved path and test in an isolated fixture first.
- Send malformed and unauthorized requests and ensure rejection remains enforced.
Explanation
Correct Answer
D:Send malformed and unauthorized requests and ensure rejection remains enforced.
Incorrect Answers
A:Synthetic fixtures preserve a usable test schema without exposing identifiable patient records to AI prompts. Verification of this result involves send malformed and unauthorized requests and ensure rejection remains enforced.
B:Redacting credentials and tokens prevents generated instrumentation from exposing secrets in logs or repositories. That check cannot demonstrate send malformed and unauthorized requests and ensure rejection remains enforced.
C:Shell commands from AI tools must be inspected for resolved paths and side effects before destructive execution. That check cannot demonstrate send malformed and unauthorized requests and ensure rejection remains enforced.
Question 75
During troubleshooting, investigators observe: The patched endpoint now accepts unvalidated inputs. The system context is: A junior developer pastes an AI-generated vulnerability fix but the patch disables request validation to make a failing test pass. Which ONE cause most directly explains the observed failure?
- A suggestion optimized for green tests without preserving the original threat boundary.
- Generated instrumentation neglected secret-handling and observability boundaries.
- The developer exposed sensitive personal information to a tool unnecessarily.
- The command was treated as safe because it was AI-produced, not because its side effects were understood.
Explanation
Correct Answer
A:The remedy should therefore be: Verify the security requirement and run negative authorization tests, not only the originally failing positive test.
Incorrect Answers
B:Generated instrumentation neglected secret-handling and observability boundaries. A suggestion optimized for green tests without preserving the original threat boundary.
C:The developer exposed sensitive personal information to a tool unnecessarily. A suggestion optimized for green tests without preserving the original threat boundary.
D:The command was treated as safe because it was AI-produced, not because its side effects were understood. A suggestion optimized for green tests without preserving the original threat boundary.
Question 76
The current design is: Verify the security requirement and run negative authorization tests, not only the originally failing positive test. The prior failure was: The patched endpoint now accepts unvalidated inputs. Which ONE ongoing control best protects against recurrence of that specific failure?
- Enforce security acceptance tests and diff review for generated fixes.
- Teach data minimization and block production identifiers in AI-assisted test-generation workflows.
- Check for secret-bearing log fields during code review and run secret scanners.
- Use command approvals and backups for destructive agent or shell operations.
Explanation
Correct Answer
A:Enforce security acceptance tests and diff review for generated fixes.
Incorrect Answers
B:Generated code requires independently defined acceptance tests and review against the real program contract. Preventing this failure involves enforce security acceptance tests and diff review for generated fixes.
C:Redacting credentials and tokens prevents generated instrumentation from exposing secrets in logs or repositories. Preventing this failure involves enforce security acceptance tests and diff review for generated fixes.
D:Shell commands from AI tools must be inspected for resolved paths and side effects before destructive execution. Preventing this failure involves enforce security acceptance tests and diff review for generated fixes.
Question 77
A team reports: A codegen response includes an API key placeholder that resembles an actual committed secret from an example config. They observe: A long-lived token is included in a generated configuration change. Which ONE technical decision most directly corrects the cause?
- Replace string interpolation with parameterized queries and review the data-access path for injection hazards.
- Return a consistent response and enforce rate limits while delivering reset tokens by approved secure channel.
- Remove credential material from logging and replace it with safe trace identifiers and masked metadata.
- Scan generated content and diffs; replace any credential-like string with managed secret references.
Explanation
Correct Answer
D:Copilot output is not exempt from normal secret-leak risks.
Incorrect Answers
A:Suggested code reproduced a dangerous string-building pattern rather than safe binding. Copilot output is not exempt from normal secret-leak risks.
B:The generated user-experience logic overlooked information-disclosure threats. Copilot output is not exempt from normal secret-leak risks.
C:Generated instrumentation neglected secret-handling and observability boundaries. Copilot output is not exempt from normal secret-leak risks.
Question 78
A team has implemented the following change: Scan generated content and diffs; replace any credential-like string with managed secret references. The original requirement was: A codegen response includes an API key placeholder that resembles an actual committed secret from an example config. Which ONE validation test best demonstrates the intended behavior?
- Run secret scanning on the generated patch and inspect config sources before commit.
- Compare unknown and known-account response status, timing, and rate-limit behavior.
- Exercise a request and inspect resulting logs for bearer tokens or cookies.
- Run an SQL-injection test with quotes and comments; confirm it is treated as a parameter, not query syntax.
Explanation
Correct Answer
A:Run secret scanning on the generated patch and inspect config sources before commit.
Incorrect Answers
B:Compare unknown and known-account response status, timing, and rate-limit behavior. That check cannot demonstrate evidence-grounded incident cause analysis.
C:Redacting credentials and tokens prevents generated instrumentation from exposing secrets in logs or repositories. That check cannot demonstrate evidence-grounded incident cause analysis.
D:Generated code requires independently defined acceptance tests and review against the real program contract. Verification of this result involves running secret scanning on the generated patch and inspect config sources before commit.
Question 79
During troubleshooting, investigators observe: A long-lived token is included in a generated configuration change. The system context is: A codegen response includes an API key placeholder that resembles an actual committed secret from an example config. Which ONE cause most directly explains the observed failure?
- Copilot output is not exempt from normal secret-leak risks.
- Generated instrumentation neglected secret-handling and observability boundaries.
- Suggested code reproduced a dangerous string-building pattern rather than safe binding.
- The generated user-experience logic overlooked information-disclosure threats.
Explanation
Correct Answer
A:The remedy should therefore be: Scan generated content and diffs; replace any credential-like string with managed secret references.
Incorrect Answers
B:Generated instrumentation neglected secret-handling and observability boundaries would not address the need for copilot output is not exempt from normal secret-leak risks.
C:Suggested code reproduced a dangerous string-building pattern rather than safe binding would not address the need for copilot output is not exempt from normal secret-leak risks.
D:The generated user-experience logic overlooked information-disclosure threats would not address the need for copilot output is not exempt from normal secret-leak risks.
Question 80
The current design is: Scan generated content and diffs; replace any credential-like string with managed secret references. The prior failure was: A long-lived token is included in a generated configuration change. Which ONE ongoing control best protects against recurrence of that specific failure?
- Add abuse-case tests for account enumeration to authentication feature checklists.
- Block secret-bearing commits with scanning and protected-branch checks.
- Check for secret-bearing log fields during code review and run secret scanners.
- Require security scanning and injection-focused tests on authentication code before merge.
Explanation
Correct Answer
B:Copilot output is not exempt from normal secret-leak risks. Block secret-bearing commits with scanning and protected-branch checks.
Incorrect Answers
A:Generated code requires independently defined acceptance tests and review against the real program contract. Preventing this failure involves block secret-bearing commits with scanning and protected-branch checks.
C:Redacting credentials and tokens prevents generated instrumentation from exposing secrets in logs or repositories. It would leave evidence-grounded incident cause analysis without the specified safeguard.
D:Generated code requires independently defined acceptance tests and review against the real program contract. Preventing this failure involves block secret-bearing commits with scanning and protected-branch checks. The observed condition is scan generated content and diffs; replace any credential-like string with managed secret references. The prior failure was: A long-lived token is included in a.
GitHub Copilot (GH-300) Practice Tests