Microsoft GH-300 Practice Test 1
Question 1
A completion introduces a client method missing from the project's pinned SDK. What is the most direct pre-merge check?
- Compare the query with the authorized schema and execute it against a representative nonproduction database.
- Compare the call against the installed SDK's versioned API reference and execute a focused test.
- Verify the partner's documented endpoint and authentication contract using the pinned API version.
- Check the dependency manifest and package provenance before adding or importing the package.
Explanation
Correct Answer
B:Version-specific verification catches a plausible method name that the actual dependency does not implement.
Incorrect Answers
A:Schema-aware execution detects fabricated columns and unexpected query effects. What is the most direct pre-merge check. Version-specific verification catches a plausible method name that the actual dependency does not implement.
C:An invented route cannot be fixed reliably by adjusting only the surrounding syntax. version-specific verification catches a plausible method name that the actual dependency does not implement.
D:Dependency existence and supply-chain trust must be established independently of suggested code. version-specific verification catches a plausible method name that the actual dependency does not implement.
Question 2
An AI response cites a repository helper that cannot be found in a code search. How should the developer proceed?
- Locate the helper in the checked-out repository and inspect its actual signature before using it.
- Compare the query with the authorized schema and execute it against a representative nonproduction database.
- Verify the partner's documented endpoint and authentication contract using the pinned API version.
- Compare the call against the installed SDK's versioned API reference and execute a focused test.
Explanation
Correct Answer
A:A generated assertion about repository code is not evidence the function exists.
Incorrect Answers
B:Schema-aware execution detects fabricated columns and unexpected query effects. How should the developer proceed. A generated assertion about repository code is not evidence the function exists.
C:An invented route cannot be fixed reliably by adjusting only the surrounding syntax. a generated assertion about repository code is not evidence the function exists.
D:Version-specific verification catches a plausible method name that the actual dependency does not implement. A generated assertion about repository code is not evidence the function exists.
Question 3
Copilot supplies a package import for a dependency absent from the lockfile. What should the developer verify first?
- Check the dependency manifest and package provenance before adding or importing the package.
- Compare the call against the installed SDK's versioned API reference and execute a focused test.
- Verify the partner's documented endpoint and authentication contract using the pinned API version.
- Locate the helper in the checked-out repository and inspect its actual signature before using it.
Explanation
Correct Answer
A:Dependency existence and supply-chain trust must be established independently of suggested code.
Incorrect Answers
B:Version-specific verification catches a plausible method name that the actual dependency does not implement. Dependency existence and supply-chain trust must be established independently of suggested code.
C:An invented route cannot be fixed reliably by adjusting only the surrounding syntax. dependency existence and supply-chain trust must be established independently of suggested code.
D:A generated assertion about repository code is not evidence the function exists. dependency existence and supply-chain trust must be established independently of suggested code.
Question 4
A generated SQL query references a table whose name sounds plausible but differs from the production schema. Which validation is essential?
- Compare the query with the authorized schema and execute it against a representative nonproduction database.
- Check the dependency manifest and package provenance before adding or importing the package.
- Locate the helper in the checked-out repository and inspect its actual signature before using it.
- Compare the call against the installed SDK's versioned API reference and execute a focused test.
Explanation
Correct Answer
A:Schema-aware execution detects fabricated columns and unexpected query effects.
Incorrect Answers
B:Dependency existence and supply-chain trust must be established independently of suggested code. Which validation is essential. Schema-aware execution detects fabricated columns and unexpected query effects.
C:A generated assertion about repository code is not evidence the function exists. schema-aware execution detects fabricated columns and unexpected query effects.
D:Version-specific verification catches a plausible method name that the actual dependency does not implement. Schema-aware execution detects fabricated columns and unexpected query effects.
Question 5
A Copilot-generated integration uses both an unfamiliar SDK method and an undocumented partner endpoint. Which TWO independent checks should a reviewer perform before deployment? (Select TWO.)
- Compare the partner endpoint with its current API contract and authentication requirements.
- Treat the model's confident explanation as proof that both interfaces exist.
- Add a broad try-catch around both calls without checking their existence.
- Verify the call against the installed SDK version and execute a focused integration test.
- Delete the dependency lockfile to let any available library version install.
Explanation
Correct Answers
A:A documented endpoint and auth contract are necessary for a working integration.
D:Versioned API validation establishes that the named method actually exists and behaves as expected.
Incorrect Answers
B:Model fluency is not evidence of an API contract.
C:Error handling cannot turn nonexistent interfaces into valid ones.
E:Uncontrolled version changes undermine reproducibility and do not validate the selected API.
Question 6
Copilot suggests string concatenation to build a login SQL query from a request parameter. What should be required?
- Add record-level authorization and tests for cross-user access attempts.
- Replace interpolation with parameterized database queries and test injection inputs.
- Diagnose the certificate chain and trust store while keeping peer verification enabled.
- Redact credentials and log only approved nonsecret request diagnostics.
Explanation
Correct Answer
B:Parameter binding separates user values from executable SQL syntax.
Incorrect Answers
A:Authentication alone does not grant access to every tenant's or user's resource. Parameter binding separates user values from executable SQL syntax.
C:Disabling verification hides a trust failure and permits man-in-the-middle attacks. What should be required. Parameter binding separates user values from executable SQL syntax.
D:Access tokens in logs become reusable credentials for anyone who can read the logs. parameter binding separates user values from executable SQL syntax.
Question 7
A proposed Node.js file download handler builds its path directly from a user-supplied filename. What should happen?
- Redact credentials and log only approved nonsecret request diagnostics.
- Add record-level authorization and tests for cross-user access attempts.
- Enforce allowlisted paths and canonicalize the resolved destination to prevent traversal.
- Replace interpolation with parameterized database queries and test injection inputs.
Explanation
Correct Answer
C:Filesystem boundaries must be validated independently of plausible generated code.
Incorrect Answers
A:Access tokens in logs become reusable credentials for anyone who can read the logs. filesystem boundaries must be validated independently of plausible generated code.
B:Authentication alone does not grant access to every tenant's or user's resource. Filesystem boundaries must be validated independently of plausible generated code.
D:Parameter binding separates user values from executable SQL syntax. filesystem boundaries must be validated independently of plausible generated code.
Question 8
A chat answer proposes turning off TLS certificate verification to resolve an HTTPS failure. What is the safe next step?
- Diagnose the certificate chain and trust store while keeping peer verification enabled.
- Add record-level authorization and tests for cross-user access attempts.
- Replace interpolation with parameterized database queries and test injection inputs.
- Enforce allowlisted paths and canonicalize the resolved destination to prevent traversal.
Explanation
Correct Answer
A:Disabling verification hides a trust failure and permits man-in-the-middle attacks.
Incorrect Answers
B:Authentication alone does not grant access to every tenant's or user's resource. Disabling verification hides a trust failure and permits man-in-the-middle attacks.
C:Parameter binding separates user values from executable SQL syntax. disabling verification hides a trust failure and permits man-in-the-middle attacks.
D:Filesystem boundaries must be validated independently of plausible generated code. What is the safe next step. Disabling verification hides a trust failure and permits man-in-the-middle attacks.
Question 9
An AI-generated logging statement writes the full OAuth bearer token for troubleshooting. What should the reviewer request?
- Replace interpolation with parameterized database queries and test injection inputs.
- Redact credentials and log only approved nonsecret request diagnostics.
- Diagnose the certificate chain and trust store while keeping peer verification enabled.
- Enforce allowlisted paths and canonicalize the resolved destination to prevent traversal.
Explanation
Correct Answer
B:Access tokens in logs become reusable credentials for anyone who can read the logs.
Incorrect Answers
A:Parameter binding separates user values from executable SQL syntax. access tokens in logs become reusable credentials for anyone who can read the logs.
C:Disabling verification hides a trust failure and permits man-in-the-middle attacks. access tokens in logs become reusable credentials for anyone who can read the logs.
D:Filesystem boundaries must be validated independently of plausible generated code. What should the reviewer request. Access tokens in logs become reusable credentials for anyone who can read the logs.
Question 10
A suggested authorization handler checks whether a user is logged in but not whether they own the record. What is missing?
- Redact credentials and log only approved nonsecret request diagnostics.
- Diagnose the certificate chain and trust store while keeping peer verification enabled.
- Add record-level authorization and tests for cross-user access attempts.
- Enforce allowlisted paths and canonicalize the resolved destination to prevent traversal.
Explanation
Correct Answer
C:Authentication alone does not grant access to every tenant's or user's resource.
Incorrect Answers
A:Access tokens in logs become reusable credentials for anyone who can read the logs. Authentication alone does not grant access to every tenant's or user's resource.
B:Disabling verification hides a trust failure and permits man-in-the-middle attacks. authentication alone does not grant access to every tenant's or user's resource.
D:Filesystem boundaries must be validated independently of plausible generated code. What is missing. Authentication alone does not grant access to every tenant's or user's resource.
