Microsoft GH-300 Practice Test 2
Question 10
A suggested authorization handler checks whether a user is logged in but not whether they own the record. What is missing?
- Redact credentials and log only approved nonsecret request diagnostics.
- Diagnose the certificate chain and trust store while keeping peer verification enabled.
- Add record-level authorization and tests for cross-user access attempts.
- Enforce allowlisted paths and canonicalize the resolved destination to prevent traversal.
Explanation
Correct Answer
C:Authentication alone does not grant access to every tenant's or user's resource.
Incorrect Answers
A:Access tokens in logs become reusable credentials for anyone who can read the logs. Authentication alone does not grant access to every tenant's or user's resource.
B:Disabling verification hides a trust failure and permits man-in-the-middle attacks. authentication alone does not grant access to every tenant's or user's resource.
D:Filesystem boundaries must be validated independently of plausible generated code. What is missing. Authentication alone does not grant access to every tenant's or user's resource.
Question 11
A hiring tool prototype uses AI suggestions to rank candidates using historical outcomes. What should be done before adoption?
- Evaluate disparate impacts with representative groups and have accountable humans review the decision process.
- Examine proxy discrimination and document mitigation before using the feature in decisions.
- Avoid unnecessary sensitive inference and use user-directed accessible options instead.
- Measure behavior across the actual deployment populations and document subgroup limitations.
Explanation
Correct Answer
A:Historical patterns can encode unfair outcomes even when a generated algorithm appears neutral.
Incorrect Answers
B:Removing explicit protected fields does not eliminate correlated bias. historical patterns can encode unfair outcomes even when a generated algorithm appears neutral.
C:Accessibility support does not require unconsented classification of sensitive traits. Historical patterns can encode unfair outcomes even when a generated algorithm appears neutral.
D:Performance on one demographic distribution cannot establish fairness in another. historical patterns can encode unfair outcomes even when a generated algorithm appears neutral.
Question 12
A generated customer-help flow assumes everyone uses a single language or cultural convention. What improvement is appropriate?
- Evaluate disparate impacts with representative groups and have accountable humans review the decision process.
- Measure behavior across the actual deployment populations and document subgroup limitations.
- Avoid unnecessary sensitive inference and use user-directed accessible options instead.
- Test localization and accessibility with representative users rather than relying on the default generated wording.
Explanation
Correct Answer
D:Diverse user testing exposes hidden assumptions not apparent to the authors.
Incorrect Answers
A:Historical patterns can encode unfair outcomes even when a generated algorithm appears neutral. What improvement is appropriate. Diverse user testing exposes hidden assumptions not apparent to the authors.
B:Performance on one demographic distribution cannot establish fairness in another. diverse user testing exposes hidden assumptions not apparent to the authors.
C:Accessibility support does not require unconsented classification of sensitive traits. Diverse user testing exposes hidden assumptions not apparent to the authors.
Question 13
An AI assistant generates a recommendation based on a proxy feature strongly correlated with a protected attribute. What should the team investigate?
- Evaluate disparate impacts with representative groups and have accountable humans review the decision process.
- Measure behavior across the actual deployment populations and document subgroup limitations.
- Examine proxy discrimination and document mitigation before using the feature in decisions.
- Test localization and accessibility with representative users rather than relying on the default generated wording.
Explanation
Correct Answer
C:Removing explicit protected fields does not eliminate correlated bias.
Incorrect Answers
A:Historical patterns can encode unfair outcomes even when a generated algorithm appears neutral. What should the team investigate. Removing explicit protected fields does not eliminate correlated bias.
B:Performance on one demographic distribution cannot establish fairness in another. removing explicit protected fields does not eliminate correlated bias.
D:Diverse user testing exposes hidden assumptions not apparent to the authors. removing explicit protected fields does not eliminate correlated bias.
Question 14
A model proposes to infer users' disability status from activity logs to customize content. What is the responsible response?
- Evaluate disparate impacts with representative groups and have accountable humans review the decision process.
- Test localization and accessibility with representative users rather than relying on the default generated wording.
- Examine proxy discrimination and document mitigation before using the feature in decisions.
- Avoid unnecessary sensitive inference and use user-directed accessible options instead.
Explanation
Correct Answer
D:Accessibility support does not require unconsented classification of sensitive traits.
Incorrect Answers
A:Historical patterns can encode unfair outcomes even when a generated algorithm appears neutral. What is the responsible response. Accessibility support does not require unconsented classification of sensitive traits.
B:Diverse user testing exposes hidden assumptions not apparent to the authors. accessibility support does not require unconsented classification of sensitive traits.
C:Removing explicit protected fields does not eliminate correlated bias. Accessibility support does not require unconsented classification of sensitive traits.
Question 15
Copilot suggests training data from one region as proof a system will work equally well globally. What validation is needed?
- Examine proxy discrimination and document mitigation before using the feature in decisions.
- Test localization and accessibility with representative users rather than relying on the default generated wording.
- Measure behavior across the actual deployment populations and document subgroup limitations.
- Avoid unnecessary sensitive inference and use user-directed accessible options instead.
Explanation
Correct Answer
C:Performance on one demographic distribution cannot establish fairness in another.
Incorrect Answers
A:Removing explicit protected fields does not eliminate correlated bias. Performance on one demographic distribution cannot establish fairness in another.
B:Diverse user testing exposes hidden assumptions not apparent to the authors. performance on one demographic distribution cannot establish fairness in another.
D:Accessibility support does not require unconsented classification of sensitive traits. performance on one demographic distribution cannot establish fairness in another.
Question 16
A proposed implementation resembles a known public library. What should the engineer verify before reuse?
- Review available code references, licenses, and project policy before incorporating the implementation.
- Apply its legal and organizational IP policy rather than making a universal ownership claim.
- Do not treat absence of a reference as proof that the code is original or unencumbered.
- Conduct the repository's license and provenance review before merging generated code.
Explanation
Correct Answer
A:Public availability does not remove copyright and license conditions.
Incorrect Answers
B:Output rights depend on applicable law, agreements, and the underlying material. What should the engineer verify before reuse. Public availability does not remove copyright and license conditions.
C:Matching indexes and detection thresholds do not exhaust all sources or licenses. Public availability does not remove copyright and license conditions.
D:Copilot output still requires ordinary compliance review for the target distribution. public availability does not remove copyright and license conditions.
Question 17
Copilot outputs a long verbatim-looking function with a public-code match reference. How should the reviewer handle it?
- Conduct the repository's license and provenance review before merging generated code.
- Inspect the reference and license obligations, then attribute, rewrite, or reject according to policy.
- Apply its legal and organizational IP policy rather than making a universal ownership claim.
- Review available code references, licenses, and project policy before incorporating the implementation.
Explanation
Correct Answer
B:A code-reference notice supplies provenance clues, not automatic permission to reuse.
Incorrect Answers
A:Copilot output still requires ordinary compliance review for the target distribution. a code-reference notice supplies provenance clues, not automatic permission to reuse.
C:Output rights depend on applicable law, agreements, and the underlying material. How should the reviewer handle it. A code-reference notice supplies provenance clues, not automatic permission to reuse.
D:Public availability does not remove copyright and license conditions. a code-reference notice supplies provenance clues, not automatic permission to reuse.
Question 18
A generated snippet lacks a public-code citation. Which assumption should be avoided?
- Inspect the reference and license obligations, then attribute, rewrite, or reject according to policy.
- Apply its legal and organizational IP policy rather than making a universal ownership claim.
- Do not treat absence of a reference as proof that the code is original or unencumbered.
- Review available code references, licenses, and project policy before incorporating the implementation.
Explanation
Correct Answer
C:Matching indexes and detection thresholds do not exhaust all sources or licenses.
Incorrect Answers
A:A code-reference notice supplies provenance clues, not automatic permission to reuse. Matching indexes and detection thresholds do not exhaust all sources or licenses.
B:Output rights depend on applicable law, agreements, and the underlying material. Which assumption should be avoided. Matching indexes and detection thresholds do not exhaust all sources or licenses.
D:Public availability does not remove copyright and license conditions. matching indexes and detection thresholds do not exhaust all sources or licenses.
Question 19
A team wants to copy generated code into a repository governed by incompatible licensing requirements. What review is appropriate?
- Conduct the repository's license and provenance review before merging generated code.
- Review available code references, licenses, and project policy before incorporating the implementation.
- Do not treat absence of a reference as proof that the code is original or unencumbered.
- Inspect the reference and license obligations, then attribute, rewrite, or reject according to policy.
Explanation
Correct Answer
A:Copilot output still requires ordinary compliance review for the target distribution.
Incorrect Answers
B:Public availability does not remove copyright and license conditions. copilot output still requires ordinary compliance review for the target distribution.
C:Matching indexes and detection thresholds do not exhaust all sources or licenses. copilot output still requires ordinary compliance review for the target distribution.
D:A code-reference notice supplies provenance clues, not automatic permission to reuse. Copilot output still requires ordinary compliance review for the target distribution.
Question 20
A generated utility closely resembles code in a public repository, and the product is commercially distributed. Which TWO steps appropriately address provenance risk? (Select TWO.)
- Assume no rights review is necessary if the function compiles.
- Apply the project's legal and license compliance review before incorporating the utility.
- Delete displayed code references while retaining the copied implementation unchanged.
- Review available public-code references and their licensing context.
- Assume that generated code is automatically public domain.
Explanation
Correct Answers
B:A responsible distribution decision requires consideration of compatible rights and notices.
D:Match references may identify original authors and conditions that matter for reuse.
Incorrect Answers
A:Correct execution does not determine the legal status of the code.
C:Hiding references neither alters provenance nor fulfills license requirements.
E:AI generation does not create a universal public-domain waiver.