Question 80
The current design is: Scan generated content and diffs; replace any credential-like string with managed secret references. The prior failure was: A long-lived token is included in a generated configuration change. Which ONE ongoing control best protects against recurrence of that specific failure?
- Add abuse-case tests for account enumeration to authentication feature checklists.
- Block secret-bearing commits with scanning and protected-branch checks.
- Check for secret-bearing log fields during code review and run secret scanners.
- Require security scanning and injection-focused tests on authentication code before merge.
Explanation
Correct Answer
B:Copilot output is not exempt from normal secret-leak risks. Block secret-bearing commits with scanning and protected-branch checks.
Incorrect Answers
A:Generated code requires independently defined acceptance tests and review against the real program contract. Preventing this failure involves block secret-bearing commits with scanning and protected-branch checks.
C:Redacting credentials and tokens prevents generated instrumentation from exposing secrets in logs or repositories. It would leave evidence-grounded incident cause analysis without the specified safeguard.
D:Generated code requires independently defined acceptance tests and review against the real program contract. Preventing this failure involves block secret-bearing commits with scanning and protected-branch checks. The observed condition is scan generated content and diffs; replace any credential-like string with managed secret references. The prior failure was: A long-lived token is included in a.
Question 81
A team reports: A team relies on Copilot to synthesize license terms for a third-party SDK without consulting legal notices. They observe: The product distributes a library without a required notice. Which ONE technical decision most directly corrects the cause?
- Verify every dependency against the official registry and dependency lockfile before accepting generated imports.
- Check generated API calls against pinned package version documentation and execute compatibility tests.
- Verify the actual SDK license and its redistribution conditions from the official package and license text.
- Use available public-code matching references and review repository license terms before including matching material.
Explanation
Correct Answer
C:Generated legal summaries do not replace controlling source licenses.
Incorrect Answers
A:Verifying every dependency against the official registry and dependency lockfile would not verify the actual SDK license and its redistribution conditions from the official package and license text.
B:Checking generated API calls against pinned package version documentation and execute compatibility tests would not verify the actual SDK license and its redistribution conditions from the official package and license text.
D:Using available public-code matching references and reviewing repository license terms would not verify the actual SDK license and its redistribution conditions from the official package and license text.
Question 82
A team has implemented the following change: Verify the actual SDK license and its redistribution conditions from the official package and license text. The original requirement was: A team relies on Copilot to synthesize license terms for a third-party SDK without consulting legal notices. Which ONE validation test best demonstrates the intended behavior?
- Inspect matching-source attribution and license requirements for the specific accepted suggestion.
- Install dependencies from the trusted registry in a disposable build and check package provenance.
- Inspect the versioned LICENSE and NOTICE files for the shipped dependency.
- Compile and run the refactor against the actual installed dependency version.
Explanation
Correct Answer
C:Inspect the versioned LICENSE and NOTICE files for the shipped dependency.
Incorrect Answers
A:Public-code similarity and repository licensing must be reviewed before copying suggested code into a product. That check cannot demonstrate verified package identity and dependency provenance.
B:Approved dependency sources and lockfiles protect builds against invented or impersonated packages. Verification of this result involves inspecting the versioned LICENSE and NOTICE files for the shipped dependency.
D:Approved dependency sources and lockfiles protect builds against invented or impersonated packages. Verification of this result involves inspecting the versioned LICENSE and NOTICE files for the shipped dependency. The observed condition is a team has implemented the following change: Verify the actual SDK license and its redistribution conditions from the official package and license text. The.
Question 83
During troubleshooting, investigators observe: The product distributes a library without a required notice. The system context is: A team relies on Copilot to synthesize license terms for a third-party SDK without consulting legal notices. Which ONE cause most directly explains the observed failure?
- Generative responses can fabricate package identifiers and cannot establish supply-chain trust.
- Generated legal summaries do not replace controlling source licenses.
- The model inferred an API signature from stale or mismatched examples.
- License provenance was not assessed just because the suggestion came through an AI assistant.
Explanation
Correct Answer
B:The remedy should therefore be: Verify the actual SDK license and its redistribution conditions from the official package and license text.
Incorrect Answers
A:Generative responses can fabricate package identifiers and cannot establish supply-chain trust would not address the need for generated legal summaries do not replace controlling source licenses.
C:The model inferred an API signature from stale or mismatched examples would not address the need for generated legal summaries do not replace controlling source licenses.
D:License provenance was not assessed just because the suggestion came through an AI assistant would not address the need for generated legal summaries do not replace controlling source licenses.
Question 84
The current design is: Verify the actual SDK license and its redistribution conditions from the official package and license text. The prior failure was: The product distributes a library without a required notice. Which ONE ongoing control best protects against recurrence of that specific failure?
- Enforce approved-package checks, lockfile review, and dependency scanning for AI-authored changes.
- Have license compliance reviewed against dependency manifests before release.
- Maintain source/reference review and automated license checks for externally resembling code.
- Keep package-version context, build verification, and controlled rollouts for generated refactors.
Explanation
Correct Answer
B:Generated legal summaries do not replace controlling source licenses. Have license compliance reviewed against dependency manifests before release.
Incorrect Answers
A:Approved dependency sources and lockfiles protect builds against invented or impersonated packages. Preventing this failure involves have license compliance reviewed against dependency manifests before release.
C:Public-code similarity and repository licensing must be reviewed before copying suggested code into a product. It would leave verified package identity and dependency provenance without the specified safeguard.
D:Generated code requires independently defined acceptance tests and review against the real program contract. Preventing this failure involves have license compliance reviewed against dependency manifests before release.
Question 85
A team reports: A model suggests an apparently valid sorting routine that becomes quadratic on an adversarial large input. They observe: A large customer import exhausts CPU despite passing small unit tests. Which ONE technical decision most directly corrects the cause?
- Expand tests to realistic multilingual input, empty strings, and normalization boundary cases before relying on the output.
- Cross-check policy names and availability in current first-party GitHub documentation before directing administrators.
- Benchmark worst-case and representative workloads; choose algorithms based on provable complexity and constraints.
- Use schema-driven tests and compare examples before merging generated serialization code.
Explanation
Correct Answer
C:The generated solution optimized sample readability rather than asymptotic resource limits.
Incorrect Answers
A:Expanding tests to realistic multilingual input, empty strings, and normalization boundary cases would not address the need for benchmark worst-case and representative workloads.
B:Cross-checking policy names and availability in current first-party GitHub documentation would not address the need for benchmark worst-case and representative workloads.
D:Generated code failed to preserve the wire-format contract. That does not establish validated approved cryptographic requirements.
Question 86
A team has implemented the following change: Benchmark worst-case and representative workloads; choose algorithms based on provable complexity and constraints. The original requirement was: A model suggests an apparently valid sorting routine that becomes quadratic on an adversarial large input. Which ONE validation test best demonstrates the intended behavior?
- Run load tests with sorted, reverse-sorted and random million-item inputs.
- Run fixtures covering missing fields, explicit null, and literal string "null" independently.
- Run explicit composed and decomposed Unicode fixtures and compare behavior to the required interface contract.
- Find the named setting in an authorized test organization or an official feature matrix.
Explanation
Correct Answer
A:Run load tests with sorted, reverse-sorted and random million-item inputs.
Incorrect Answers
B:Approved dependency sources and lockfiles protect builds against invented or impersonated packages. That check cannot demonstrate tested AI-assisted changes that preserve stated requirements.
C:Unicode behavior must be tested with composed, decomposed and boundary-case text, not only ASCII samples. Verification of this result involves running load tests with sorted, reverse-sorted and random million-item inputs.
D:Generated code requires independently defined acceptance tests and review against the real program contract. Verification of this result involves running load tests with sorted, reverse-sorted and random million-item inputs.
Question 87
During troubleshooting, investigators observe: A large customer import exhausts CPU despite passing small unit tests. The system context is: A model suggests an apparently valid sorting routine that becomes quadratic on an adversarial large input. Which ONE cause most directly explains the observed failure?
- Generated code failed to preserve the wire-format contract.
- The generated solution optimized sample readability rather than asymptotic resource limits.
- The model hallucinated a product capability or surface-specific control.
- Training examples biased toward ASCII are not evidence of general Unicode correctness.
Explanation
Correct Answer
B:The remedy should therefore be: Benchmark worst-case and representative workloads; choose algorithms based on provable complexity and constraints.
Incorrect Answers
A:Generated code failed to preserve the wire-format contract. The generated solution optimized sample readability rather than asymptotic resource limits.
C:The model hallucinated a product capability or surface-specific control. That does not establish tested AI-assisted changes that preserve stated requirements.
D:Training examples biased toward ASCII are not evidence of general Unicode correctness. The generated solution optimized sample readability rather than asymptotic resource limits.
Question 88
The current design is: Benchmark worst-case and representative workloads; choose algorithms based on provable complexity and constraints. The prior failure was: A large customer import exhausts CPU despite passing small unit tests. Which ONE ongoing control best protects against recurrence of that specific failure?
- Maintain representative accessibility and internationalization regression cases in CI.
- Require current vendor documentation and test-tenant verification for administrative instructions.
- Require contract-based tests and code owner checks for payload-format changes.
- Use complexity reviews and production-size benchmarks for scale-sensitive changes.
Explanation
Correct Answer
D:The generated solution optimized sample readability rather than asymptotic resource limits. Use complexity reviews and production-size benchmarks for scale-sensitive changes.
Incorrect Answers
A:Maintain representative accessibility and internationalization regression cases in CI. Preventing this failure involves using complexity reviews and production-size benchmarks for scale-sensitive changes.
B:Generated code requires independently defined acceptance tests and review against the real program contract. Preventing this failure involves using complexity reviews and production-size benchmarks for scale-sensitive changes.
C:Generated code requires independently defined acceptance tests and review against the real program contract. Preventing this failure involves using complexity reviews and production-size benchmarks for scale-sensitive changes. The observed condition is benchmark worst-case and representative workloads; choose algorithms based on provable complexity and constraints. The prior failure was: A large customer import.
Question 89
A team reports: Copilot summarizes a complex access-control change correctly but mentions a fictional GitHub policy setting in the remediation steps. They observe: The team wastes time searching for a policy toggle that does not exist. Which ONE technical decision most directly corrects the cause?
- Cross-check the summary against exact commits, logs, and code paths; label unresolved hypotheses.
- Check the generated validator against the gateway specification and independently written pass/fail vectors before shipping.
- Check generated API calls against pinned package version documentation and execute compatibility tests.
- Cross-check policy names and availability in current first-party GitHub documentation before directing administrators.
Explanation
Correct Answer
D:The model hallucinated a product capability or surface-specific control.
Incorrect Answers
A:Cross-checking the summary against exact commits, logs, and code paths would not cross-check policy names and availability in current first-party GitHub documentation.
B:Checking the generated validator against the gateway specification and independently written pass/fail vectors would not cross-check policy names and availability in current first-party GitHub documentation.
C:Checking generated API calls against pinned package version documentation and execute compatibility tests would not cross-check policy names and availability in current first-party GitHub documentation.
Question 90
A team has implemented the following change: Cross-check policy names and availability in current first-party GitHub documentation before directing administrators. The original requirement was: Copilot summarizes a complex access-control change correctly but mentions a fictional GitHub policy setting in the remediation steps. Which ONE validation test best demonstrates the intended behavior?
- Find the named setting in an authorized test organization or an official feature matrix.
- Compile and run the refactor against the actual installed dependency version.
- Run valid, invalid, and boundary-value card fixtures through tests based on the payment contract.
- Trace each asserted root cause to an observed log line or reproducible test.
Explanation
Correct Answer
A:Find the named setting in an authorized test organization or an official feature matrix.
Incorrect Answers
B:Approved dependency sources and lockfiles protect builds against invented or impersonated packages. Verification of this result involves find the named setting in an authorized test organization or an official feature matrix.
C:Gateway-specific card validation requires tests derived from the published checksum contract, not plausible generated code. Verification of this result involves find the named setting in an authorized test organization or an official feature matrix.
D:AI-assisted postmortem claims need links to actual commits, logs and reproducible failures. Verification of this result involves find the named setting in an authorized test organization or an official feature matrix.
GitHub Copilot (GH-300) Practice Tests