Question 20 An infrastructure team asks Copilot to help automate cloud account provisioning. A developer asks an agent to apply resource changes with no approval boundary. Which response best satisfies the requirement? Require an explicit reviewed plan and scoped execution authorization Inspect the actual diff and run independent security checks before approval Revoke and rotate the exposed token and replace it with secure secret retrieval Diagnose certificate trust or network configuration without disabling peer verification Explanation Correct Answer A:Agent-generated infrastructure changes can be consequential and should not bypass change control. Incorrect Answers B:The alternative inspect the actual diff and run independent security checks before approval addresses a code review summary claims the patch has no security impact despite changes to authorization (generated summaries are aids, not evidence that sensitive code paths were correctly reviewed), whereas the present requirement is a developer asks an agent to apply resource changes with no approval boundary. C:For the situation where a generated shell script embeds a real production API token in its output, revoke and rotate the exposed token and replace it with secure secret retrieval is appropriate since deleting a visible token from a script does not revoke credentials already disclosed; it does not resolve a developer asks an agent to apply resource changes with no approval boundary. D:Diagnose certificate trust or network configuration without disabling peer verification has a different scope: ignoring TLS validation permits impersonation and active interception when a suggestion disables TLS verification to bypass a transient build error; the current scenario instead concerns a developer asks an agent to apply resource changes with no approval boundary.
Question 21 A public-service portal team checks the reliability of generated recommendations. A code-generation response uses an old authentication flow that was retired. What should the team do next? Run accessibility checks and test keyboard and assistive-technology behavior Benchmark representative inputs and analyze algorithmic bounds independently Remove the disclosure and investigate unauthorized context or retrieval access Validate the pattern against current issuer guidance and supported SDK versions Explanation Correct Answer D:Model training and retrieval can lag behind product changes, making old security flows unsafe. Incorrect Answers A:Run accessibility checks and test keyboard and assistive-technology behavior has a different scope: code completion does not guarantee accessible focus order or interaction semantics when a proposed interface is unusable by keyboard-only users; the current scenario instead concerns a code-generation response uses an old authentication flow that was retired. B:Benchmark representative inputs and analyze algorithmic bounds independently is useful when an AI assistant misstates the time complexity of a proposed search method because a plausible explanation can hide worse-than-expected scaling behavior; this case instead asks how to address a code-generation response uses an old authentication flow that was retired. C:The alternative remove the disclosure and investigate unauthorized context or retrieval access addresses a generated chatbot response includes a private volunteer phone number (a generated response can leak personal data supplied in an unsafe prompt or context), whereas the present requirement is a code-generation response uses an old authentication flow that was retired.
Question 22 A public-service portal team checks the reliability of generated recommendations. A response cites a nonexistent internal design memo as proof of compatibility. Which GitHub Copilot practice is most appropriate? Validate the pattern against current issuer guidance and supported SDK versions Benchmark representative inputs and analyze algorithmic bounds independently Locate and inspect the original evidence instead of trusting the citation Compare the API to version-specific vendor documentation and executable tests Explanation Correct Answer C:Fabricated references cannot substitute for a source that actually supports a claim. Incorrect Answers A:For the situation where a code-generation response uses an old authentication flow that was retired, validate the pattern against current issuer guidance and supported SDK versions is appropriate since model training and retrieval can lag behind product changes, making old security flows unsafe; it does not resolve a response cites a nonexistent internal design memo as proof of compatibility. B:Benchmark representative inputs and analyze algorithmic bounds independently has a different scope: a plausible explanation can hide worse-than-expected scaling behavior when an AI assistant misstates the time complexity of a proposed search method; the current scenario instead concerns a response cites a nonexistent internal design memo as proof of compatibility. D:The alternative compare the API to version-specific vendor documentation and executable tests addresses the assistant describes a nonexistent framework method with persuasive confidence (fluent answers can hallucinate API signatures or imply features that the installed version lacks), whereas the present requirement is a response cites a nonexistent internal design memo as proof of compatibility.
Question 23 A public-service portal team checks the reliability of generated recommendations. An AI assistant misstates the time complexity of a proposed search method. What is the safest technically sound choice? Run accessibility checks and test keyboard and assistive-technology behavior Benchmark representative inputs and analyze algorithmic bounds independently Retain named human ownership and the normal peer-review and CI gates Locate and inspect the original evidence instead of trusting the citation Explanation Correct Answer B:A plausible explanation can hide worse-than-expected scaling behavior. Incorrect Answers A:The alternative run accessibility checks and test keyboard and assistive-technology behavior addresses a proposed interface is unusable by keyboard-only users (code completion does not guarantee accessible focus order or interaction semantics), whereas the present requirement is an AI assistant misstates the time complexity of a proposed search method. C:Retain named human ownership and the normal peer-review and CI gates has a different scope: responsibility for merged source remains with project maintainers regardless of who suggested the code when a developer claims AI output is automatically approved because Copilot proposed it; the current scenario instead concerns an AI assistant misstates the time complexity of a proposed search method. D:Locate and inspect the original evidence instead of trusting the citation is useful when a response cites a nonexistent internal design memo as proof of compatibility because fabricated references cannot substitute for a source that actually supports a claim; this case instead asks how to address an AI assistant misstates the time complexity of a proposed search method.
Question 24 A public-service portal team checks the reliability of generated recommendations. A proposed interface is unusable by keyboard-only users. Which decision best fits these constraints? Retain named human ownership and the normal peer-review and CI gates Validate the pattern against current issuer guidance and supported SDK versions Run accessibility checks and test keyboard and assistive-technology behavior Locate and inspect the original evidence instead of trusting the citation Explanation Correct Answer C:Code completion does not guarantee accessible focus order or interaction semantics. Incorrect Answers A:Retain named human ownership and the normal peer-review and CI gates is useful when a developer claims AI output is automatically approved because Copilot proposed it because responsibility for merged source remains with project maintainers regardless of who suggested the code; this case instead asks how to address a proposed interface is unusable by keyboard-only users. B:The alternative validate the pattern against current issuer guidance and supported SDK versions addresses a code-generation response uses an old authentication flow that was retired (model training and retrieval can lag behind product changes, making old security flows unsafe), whereas the present requirement is a proposed interface is unusable by keyboard-only users. D:Locate and inspect the original evidence instead of trusting the citation has a different scope: fabricated references cannot substitute for a source that actually supports a claim when a response cites a nonexistent internal design memo as proof of compatibility; the current scenario instead concerns a proposed interface is unusable by keyboard-only users.
Question 25 A platform security committee is writing a responsible-Copilot adoption policy. A generated patch modifies license headers across a codebase without authorization. Which action most directly addresses the problem? Share only sanitized architecture facts and use approved enterprise data paths Restore the original legal notices and request explicit legal review of proposed changes Compare query plans and benchmark realistic workload distributions Treat its findings as hypotheses and use code review, scanning, and targeted tests Explanation Correct Answer B:Generated edits cannot silently override repository licensing and attribution obligations. Incorrect Answers A:Share only sanitized architecture facts and use approved enterprise data paths has a different scope: credential metadata and secret inventory can be sensitive even if raw private keys are omitted when a teammate wants to paste an unpublished signing-key inventory into a general chat; the current scenario instead concerns a generated patch modifies license headers across a codebase without authorization. C:The alternative compare query plans and benchmark realistic workload distributions addresses a Copilot patch modifies a SQL query but no query-plan evidence is supplied (syntactic correctness says little about query performance under production cardinalities), whereas the present requirement is a generated patch modifies license headers across a codebase without authorization. D:For the situation where a developer asks Copilot to certify that a release is free from vulnerabilities, treat its findings as hypotheses and use code review, scanning, and targeted tests is appropriate since aI assistance cannot provide a guaranteed absence of security defects; it does not resolve a generated patch modifies license headers across a codebase without authorization.
Question 26 A platform security committee is writing a responsible-Copilot adoption policy. An AI-generated test fixture contains production customer email addresses. What should the team do next? Treat its findings as hypotheses and use code review, scanning, and targeted tests Benchmark representative inputs and analyze algorithmic bounds independently Replace the fixture with purpose-built synthetic addresses and review data handling Restore the original legal notices and request explicit legal review of proposed changes Explanation Correct Answer C:Test data should not expose actual customer identity just to approximate realistic records. Incorrect Answers A:For the situation where a developer asks Copilot to certify that a release is free from vulnerabilities, treat its findings as hypotheses and use code review, scanning, and targeted tests is appropriate since aI assistance cannot provide a guaranteed absence of security defects; it does not resolve an AI-generated test fixture contains production customer email addresses. B:Benchmark representative inputs and analyze algorithmic bounds independently has a different scope: a plausible explanation can hide worse-than-expected scaling behavior when an AI assistant misstates the time complexity of a proposed search method; the current scenario instead concerns an AI-generated test fixture contains production customer email addresses. D:The alternative restore the original legal notices and request explicit legal review of proposed changes addresses a generated patch modifies license headers across a codebase without authorization (generated edits cannot silently override repository licensing and attribution obligations), whereas the present requirement is an AI-generated test fixture contains production customer email addresses.
Question 27 A platform security committee is writing a responsible-Copilot adoption policy. A teammate wants to paste an unpublished signing-key inventory into a general chat. Which GitHub Copilot practice is most appropriate? Share only sanitized architecture facts and use approved enterprise data paths Treat its findings as hypotheses and use code review, scanning, and targeted tests Replace patient identifiers with synthetic data before requesting help Restore the original legal notices and request explicit legal review of proposed changes Explanation Correct Answer A:Credential metadata and secret inventory can be sensitive even if raw private keys are omitted. Incorrect Answers B:For the situation where a developer asks Copilot to certify that a release is free from vulnerabilities, treat its findings as hypotheses and use code review, scanning, and targeted tests is appropriate since aI assistance cannot provide a guaranteed absence of security defects; it does not resolve a teammate wants to paste an unpublished signing-key inventory into a general chat. C:Replace patient identifiers with synthetic data before requesting help has a different scope: a realistic reproduction can preserve field shape and failure conditions without disclosing identifiable records when the proposed code inserts real patient names into a chat request to demonstrate a bug; the current scenario instead concerns a teammate wants to paste an unpublished signing-key inventory into a general chat. D:Restore the original legal notices and request explicit legal review of proposed changes is useful when a generated patch modifies license headers across a codebase without authorization because generated edits cannot silently override repository licensing and attribution obligations; this case instead asks how to address a teammate wants to paste an unpublished signing-key inventory into a general chat.
Question 28 A platform security committee is writing a responsible-Copilot adoption policy. A developer asks Copilot to certify that a release is free from vulnerabilities. What is the safest technically sound choice? Require an explicit reviewed plan and scoped execution authorization Treat its findings as hypotheses and use code review, scanning, and targeted tests Share only sanitized architecture facts and use approved enterprise data paths Restore the original legal notices and request explicit legal review of proposed changes Explanation Correct Answer B:AI assistance cannot provide a guaranteed absence of security defects. Incorrect Answers A:Require an explicit reviewed plan and scoped execution authorization is useful when a developer asks an agent to apply resource changes with no approval boundary because agent-generated infrastructure changes can be consequential and should not bypass change control; this case instead asks how to address a developer asks Copilot to certify that a release is free from vulnerabilities. C:For the situation where a teammate wants to paste an unpublished signing-key inventory into a general chat, share only sanitized architecture facts and use approved enterprise data paths is appropriate since credential metadata and secret inventory can be sensitive even if raw private keys are omitted; it does not resolve a developer asks Copilot to certify that a release is free from vulnerabilities. D:Restore the original legal notices and request explicit legal review of proposed changes has a different scope: generated edits cannot silently override repository licensing and attribution obligations when a generated patch modifies license headers across a codebase without authorization; the current scenario instead concerns a developer asks Copilot to certify that a release is free from vulnerabilities.
Question 29 A nonprofit team is mitigating harmful content in an AI-assisted community product. A suggested moderation classifier performs worse on non-English comments. Which response best satisfies the requirement? Validate its existence, provenance, license, and supply-chain risk before adoption Reject the workflow and substitute an approved diagnostic that avoids credential collection Remove the disclosure and investigate unauthorized context or retrieval access Evaluate performance on multilingual representative samples and adjust the process Explanation Correct Answer D:Aggregate accuracy can conceal substantially different outcomes between language groups. Incorrect Answers A:Validate its existence, provenance, license, and supply-chain risk before adoption has a different scope: plausible generated package names are not proof of a safe or authentic dependency when a suggested dependency is an unfamiliar package with no established maintainer history; the current scenario instead concerns a suggested moderation classifier performs worse on non-English comments. B:Reject the workflow and substitute an approved diagnostic that avoids credential collection is useful when a security engineer sees a suggested script to collect other developers' credentials because authorized troubleshooting should not require harvesting secrets from coworkers; this case instead asks how to address a suggested moderation classifier performs worse on non-English comments. C:The alternative remove the disclosure and investigate unauthorized context or retrieval access addresses a generated chatbot response includes a private volunteer phone number (a generated response can leak personal data supplied in an unsafe prompt or context), whereas the present requirement is a suggested moderation classifier performs worse on non-English comments.
Question 30 A nonprofit team is mitigating harmful content in an AI-assisted community product. A generated chatbot response includes a private volunteer phone number. Which action most directly addresses the problem? Require review thresholds and an appeal or audit path for consequential decisions Evaluate performance on multilingual representative samples and adjust the process Validate the pattern against current issuer guidance and supported SDK versions Remove the disclosure and investigate unauthorized context or retrieval access Explanation Correct Answer D:A generated response can leak personal data supplied in an unsafe prompt or context. Incorrect Answers A:For the situation where copilot proposes automatically deleting user comments based only on low-confidence predictions, require review thresholds and an appeal or audit path for consequential decisions is appropriate since automated moderation may produce false positives and needs proportional human oversight; it does not resolve a generated chatbot response includes a private volunteer phone number. B:Evaluate performance on multilingual representative samples and adjust the process has a different scope: aggregate accuracy can conceal substantially different outcomes between language groups when a suggested moderation classifier performs worse on non-English comments; the current scenario instead concerns a generated chatbot response includes a private volunteer phone number. C:Validate the pattern against current issuer guidance and supported SDK versions is useful when a code-generation response uses an old authentication flow that was retired because model training and retrieval can lag behind product changes, making old security flows unsafe; this case instead asks how to address a generated chatbot response includes a private volunteer phone number.