Microsoft GH-300 Practice Test 42
Question 410
A sequence algorithm fails on extremely large lists. What should the test plan examine?
- Use property-based or fuzz testing with invariant assertions.
- Include Unicode normalization and multicodepoint grapheme inputs.
- Probe memory, runtime growth, and algorithmic limits on scaled inputs.
- Test timezone transitions and ambiguous or nonexistent local times.
Explanation
Correct Answer
C:Correct small-input results do not establish scalability.
Incorrect Answers
A:Broad generated inputs explore unexpected cases beyond handpicked examples. correct small-input results do not establish scalability.
B:Text length and character classes vary beyond ASCII. What should the test plan examine. Correct small-input results do not establish scalability.
D:Clock rules create boundary conditions that simple timestamps miss. Correct small-input results do not establish scalability.
Question 411
Copilot generates a web query with user input interpolated into SQL. What should a security review require?
- Validate signature, issuer, audience, and token lifetime before authorizing.
- Use parameters and tests with injection payloads.
- Configure only approved origins and validate credential handling.
- Validate type, size, and safe storage path independent of user filename.
Explanation
Correct Answer
B:Bound parameters prevent untrusted values from changing query structure.
Incorrect Answers
A:A token's claims are untrusted without cryptographic validation. bound parameters prevent untrusted values from changing query structure.
C:Broad origin trust can expose authenticated cross-origin requests. Bound parameters prevent untrusted values from changing query structure.
D:Untrusted filenames can enable traversal and arbitrary file placement. bound parameters prevent untrusted values from changing query structure.
Question 412
An AI patch logs user passwords while debugging login failures. What corrective action is needed?
- Configure only approved origins and validate credential handling.
- Validate type, size, and safe storage path independent of user filename.
- Remove secret logging and add a safe redaction regression test.
- Use parameters and tests with injection payloads.
Explanation
Correct Answer
C:Password exposure in logs remains a security incident risk.
Incorrect Answers
A:Broad origin trust can expose authenticated cross-origin requests. Password exposure in logs remains a security incident risk.
B:Untrusted filenames can enable traversal and arbitrary file placement. password exposure in logs remains a security incident risk.
D:Bound parameters prevent untrusted values from changing query structure. What corrective action is needed. Password exposure in logs remains a security incident risk.
Question 413
A generated API checks a JWT's expiry but skips its signature. What must be corrected?
- Remove secret logging and add a safe redaction regression test.
- Validate signature, issuer, audience, and token lifetime before authorizing.
- Validate type, size, and safe storage path independent of user filename.
- Use parameters and tests with injection payloads.
Explanation
Correct Answer
B:A token's claims are untrusted without cryptographic validation.
Incorrect Answers
A:Password exposure in logs remains a security incident risk. a token's claims are untrusted without cryptographic validation.
C:Untrusted filenames can enable traversal and arbitrary file placement. a token's claims are untrusted without cryptographic validation.
D:Bound parameters prevent untrusted values from changing query structure. What must be corrected. A token's claims are untrusted without cryptographic validation.
Question 414
Copilot suggests allowing every CORS origin to resolve a frontend error. What should be reviewed?
- Validate signature, issuer, audience, and token lifetime before authorizing.
- Configure only approved origins and validate credential handling.
- Use parameters and tests with injection payloads.
- Remove secret logging and add a safe redaction regression test.
Explanation
Correct Answer
B:Broad origin trust can expose authenticated cross-origin requests.
Incorrect Answers
A:A token's claims are untrusted without cryptographic validation. Broad origin trust can expose authenticated cross-origin requests.
C:Bound parameters prevent untrusted values from changing query structure. What should be reviewed. Broad origin trust can expose authenticated cross-origin requests.
D:Password exposure in logs remains a security incident risk. broad origin trust can expose authenticated cross-origin requests.
Question 415
A generated file-upload endpoint trusts the client-provided filename. What is required?
- Remove secret logging and add a safe redaction regression test.
- Validate type, size, and safe storage path independent of user filename.
- Validate signature, issuer, audience, and token lifetime before authorizing.
- Configure only approved origins and validate credential handling.
Explanation
Correct Answer
B:Untrusted filenames can enable traversal and arbitrary file placement.
Incorrect Answers
A:Password exposure in logs remains a security incident risk. untrusted filenames can enable traversal and arbitrary file placement.
C:A token's claims are untrusted without cryptographic validation. Untrusted filenames can enable traversal and arbitrary file placement.
D:Broad origin trust can expose authenticated cross-origin requests. untrusted filenames can enable traversal and arbitrary file placement.
Question 416
An AI-generated cache layer claims to halve latency. How should it be evaluated?
- Estimate worst-case complexity and benchmark realistic high-cardinality inputs.
- Benchmark representative traffic with hit-rate and invalidation measurements.
- Run resource-leak tests and inspect open handles under repeated operations.
- Measure concurrency, queue delay, error rate, and system capacity.
Explanation
Correct Answer
B:Actual latency depends on cache behavior and workload.
Incorrect Answers
A:Nested scans can grow quadratically with input size. Actual latency depends on cache behavior and workload.
C:Throughput measurements alone miss resource exhaustion. actual latency depends on cache behavior and workload.
D:Arbitrary worker increases can produce contention or overload. How should it be evaluated. Actual latency depends on cache behavior and workload.
Question 417
A generated parallel map improves speed in a microbenchmark but overloads the database. What must be measured?
- Run end-to-end load tests with connection-pool and backend saturation metrics.
- Run resource-leak tests and inspect open handles under repeated operations.
- Measure concurrency, queue delay, error rate, and system capacity.
- Benchmark representative traffic with hit-rate and invalidation measurements.
Explanation
Correct Answer
A:Local CPU speedup may shift bottlenecks downstream.
Incorrect Answers
B:Throughput measurements alone miss resource exhaustion. local CPU speedup may shift bottlenecks downstream.
C:Arbitrary worker increases can produce contention or overload. What must be measured. Local CPU speedup may shift bottlenecks downstream.
D:Actual latency depends on cache behavior and workload. local CPU speedup may shift bottlenecks downstream.
Question 418
A proposed algorithm uses repeated list scans inside a loop. What should the developer analyze?
- Estimate worst-case complexity and benchmark realistic high-cardinality inputs.
- Run end-to-end load tests with connection-pool and backend saturation metrics.
- Benchmark representative traffic with hit-rate and invalidation measurements.
- Measure concurrency, queue delay, error rate, and system capacity.
Explanation
Correct Answer
A:Nested scans can grow quadratically with input size.
Incorrect Answers
B:Local CPU speedup may shift bottlenecks downstream. Nested scans can grow quadratically with input size.
C:Actual latency depends on cache behavior and workload. nested scans can grow quadratically with input size.
D:Arbitrary worker increases can produce contention or overload. What should the developer analyze. Nested scans can grow quadratically with input size.
Question 419
A memory-saving rewrite appears fast but leaks file descriptors. What validation is useful?
- Estimate worst-case complexity and benchmark realistic high-cardinality inputs.
- Run resource-leak tests and inspect open handles under repeated operations.
- Benchmark representative traffic with hit-rate and invalidation measurements.
- Run end-to-end load tests with connection-pool and backend saturation metrics.
Explanation
Correct Answer
B:Throughput measurements alone miss resource exhaustion.
Incorrect Answers
A:Nested scans can grow quadratically with input size. throughput measurements alone miss resource exhaustion.
C:Actual latency depends on cache behavior and workload. throughput measurements alone miss resource exhaustion.
D:Local CPU speedup may shift bottlenecks downstream. Throughput measurements alone miss resource exhaustion.
Question 420
A Copilot performance patch introduces caching and parallel database calls. Which THREE measurements are needed before approving its claimed speedup? (Select THREE.)
- Observe backend connection saturation, error rate, and queueing under concurrency.
- Ignore data correctness if throughput increases.
- Check cache hit rate, invalidation, and memory utilization.
- Test only a single tiny input that bypasses the cache.
- Measure before-and-after end-to-end latency on representative traffic.
- Trust the generated complexity claim without profiling.
Explanation
Correct Answers
A:Extra parallelism can overload shared dependencies.
C:Cache behavior determines whether its benefit survives real workloads.
E:The optimization must improve observed user-level performance.
Incorrect Answers
B:Performance must not compromise business integrity.
D:Nonrepresentative samples cannot validate the design.
F:Model prose is not a measured system property.
