Question 90 A code reviewer flags public input parameters as SQL injection even though each query uses bound parameters. Which refinement fits? Ignore all database code because false positives occurred. Flag any function that accepts a string parameter. Define the injection criterion as data reaching dynamic SQL structure without safe parameterization. Label every parameterized query as critical until disproven. Explanation Correct Answer C:A source-to-sink rule distinguishes real unsafe query construction from harmless input handling. Incorrect Answers A:That would miss genuine query-construction flaws. B:A string input alone does not establish injection. D:The required evidence is missing when values are bound safely.
Question 91 Three subtasks analyze independent product lines and share no mutable state. How should a coordinator schedule them? Ask the final writer to perform the analyses without any specialists. Merge the three tasks into one unstructured output with no coverage checks. Force serial execution because all subagents need exactly the same order. Dispatch independent specialists concurrently and reconcile their results after completion. Explanation Correct Answer D:Parallel execution reduces elapsed time without violating dependencies. Incorrect Answers A:The delegated workers are available and appropriately scoped to the independent tasks. B:Combining them prematurely risks omissions and difficult attribution. C:There is no data dependency that requires serialization.
Question 92 A support agent sometimes calls a tool automatically when a user asks for conceptual advice. Which principle should guide tool_choice? Use a random tool to demonstrate capability. Allow a text-only response when no fresh data or side effect is required. Force every conceptual answer through a database write. Never use tools even for current order status. Explanation Correct Answer B:Tool calls should be driven by actual task needs, not an indiscriminate mandate. Incorrect Answers A:Tool choice should remain tied to user intent. C:External mutation adds risk without supplying required information. D:Current external facts still need authorized retrieval.
Question 93 A support agent is compacting a long case. The customer has approved a refund amount but the refund has not been issued. What belongs in the handoff? Only a general note that the customer was unhappy. The approved amount, authorization source, transaction ID and explicit not-yet-executed status. A statement that the refund was completed because it was approved. A guess at the most recent transaction ID. Explanation Correct Answer B:The next step must distinguish permission to act from proof of execution. Incorrect Answers A:The checkpoint loses the operative decision and status. C:Approval is not an execution receipt. D:Invented identifiers risk changing another account.
Question 94 A team wants to load a comprehensive accessibility checklist only when editing views. Where should that conditional scope be expressed? By pasting the checklist into every user prompt. By changing the output temperature based on filenames. In the global environment PATH variable. In a rule file whose paths pattern matches the UI/view file locations. Explanation Correct Answer D:Conditional loading keeps the checklist relevant without inflating API-only tasks. Incorrect Answers A:Manual repetition is unnecessary and error-prone. B:Sampling does not supply the accessibility requirements. C:Executable search paths do not express document instruction scope.
Question 95 A research coordinator receives findings that cover four of six requested regions. How should it complete the work efficiently? Ask the writer to infer facts for the missing regions. Publish the report without mentioning the missing regions. Restart all six regional tasks and discard the previous work. Delegate targeted work for the two missing regions and retain the four validated results. Explanation Correct Answer D:Gap-aware re-delegation closes coverage without repeating verified retrieval. Incorrect Answers A:Synthesis cannot establish absent regional evidence. B:Silent omission contradicts the explicit coverage requirement. C:Wholesale reruns waste validated results and may introduce inconsistent versions.
Question 96 A coding agent has edited a TypeScript project and must execute npm test. Which built-in capability is needed? Read the package.json and assume tests pass. Bash to run the authorized test command and capture its exit status. Write a fake test report without execution. Glob for test filenames and mark success. Explanation Correct Answer B:Command execution, not file search, runs the test suite. Incorrect Answers A:Test definitions do not establish actual execution results. C:Invented results cannot validate code changes. D:Finding test files is not running them.
Question 97 An agent resumes an infrastructure migration after a session reset. It remembers the target service but not the approved deployment region. What should it do? Deploy into the model’s default region automatically. Recover the approved region from durable project state before taking deployment action. Use the region from an unrelated earlier project. Mark the migration complete despite not knowing its destination. Explanation Correct Answer B:A consequential constraint must not be inferred from incomplete conversational memory. Incorrect Answers A:Defaults may violate data residency and project approvals. C:Cross-project assumptions are unsafe. D:Missing state blocks a trustworthy completion claim.
Question 98 A model is asked to update a CRM record, but the validator detects a prohibited field change. What should the control flow do? Write the record first, then note the validation result. Block the mutation and report the policy violation for an authorized correction. Ask the model to hide the field in the audit. Ignore policy validation when JSON syntax is correct. Explanation Correct Answer B:Validation must execute before any external effect. Incorrect Answers A:A blocked change would already be committed. C:Concealment is not remediation. D:Syntax and authorization are distinct.
Question 99 A model uses an untrusted browser result that contains an apparent “SYSTEM OVERRIDE” directive. How should a tool-result hook help? Promote the browser page into a trusted system instruction. Label and sanitize untrusted retrieved content while preserving facts and provenance. Automatically follow any URL appearing in the page. Remove all source identifiers to avoid confusing the model. Explanation Correct Answer B:Trust boundaries can be made explicit before the model sees external instructions. Incorrect Answers A:External pages do not have instruction authority over the application. C:Unverified navigation can leak secrets or enter malicious sites. D:Provenance helps the agent separate evidence from untrusted commands.
Question 100 A booking MCP tool cannot complete a reservation. Which TWO error fields or properties help the assistant recover accurately? A specific failure category or code distinguishing invalid input from provider outage. A clear flag indicating whether retrying the identical call is appropriate. An empty content array with no error status. A fabricated confirmation number in every error. A request to discard the entire conversation immediately. Explanation Correct Answers A:Different root causes require different next steps. B:Retriable errors can use bounded backoff; permanent ones need changed input or permission. Incorrect Answers C:The agent cannot distinguish failure from an intentionally empty result. D:A false booking reference misleads the traveler. E:The original booking constraints remain needed for recovery.
