Exam Bundle

“The final adopted code has reviewed licensing or a clean independent replacement.” does not demonstrate the result required here: The sensitive file remains excluded while permitted files still receive suggestions.

“The allowed request succeeds with safety protections intact.” does not demonstrate the result required here: The sensitive file remains excluded while permitted files still receive suggestions.

“Suggestions work in an allowed fixture while remaining absent in the excluded path.” does not demonstrate the result required here: The sensitive file remains excluded while permitted files still receive suggestions.

Foundation model training does not ensure live knowledge of repository state. That recommendation is relevant to a different task: An engineer says Copilot's model must possess current repository status even without access to it. In this case the main need is: An administrator believes the model itself reads the entire private repository automatically on every request.

Retrieved content can carry prompt-injection attempts. That recommendation is relevant to a different task: A user pastes malicious instructions from an untrusted issue comment into a Copilot task. In this case the main need is: An administrator believes the model itself reads the entire private repository automatically on every request.

Model selection and organizational access controls are distinct layers. That recommendation is relevant to a different task: A developer asks whether changing the model selected for Copilot changes every policy. In this case the main need is: An administrator believes the model itself reads the entire private repository automatically on every request.

“All endpoints retain equivalent error behavior after extraction.” does not demonstrate the result required here: The example starts and demonstrates the requested feature.

“Fixtures cover expected distributions and contain no production records.” does not demonstrate the result required here: The example starts and demonstrates the requested feature.

“Every required source field maps correctly under fixture tests.” does not demonstrate the result required here: The example starts and demonstrates the requested feature.

Exclusion coverage varies by client and integration. That recommendation is relevant to a different task: A security lead believes a content-exclusion policy guarantees all tools never encounter the excluded data. In this case the main need is: An organization wants to understand where prompt safety filtering fits in suggestion generation.

Blocked outputs can reflect policy rather than malformed user code. That recommendation is relevant to a different task: A Copilot suggestion is blocked but a manual user prompt still seems valid. In this case the main need is: An organization wants to understand where prompt safety filtering fits in suggestion generation.

Matching detection and reference presentation depend on policy and product support. That recommendation is relevant to a different task: A QA engineer asks whether public-code matching checks a generated suggestion before the user sees it. In this case the main need is: An organization wants to understand where prompt safety filtering fits in suggestion generation.

Spaces can mix curated files and issues but sharing needs governance. That recommendation is relevant to a different task: A manager wants to use Copilot Spaces for confidential planning documents. In this case the main need is: A user wants to share a Space publicly although it includes a private threat assessment.

Prompt minimization is needed even when the repository itself is private. That recommendation is relevant to a different task: A developer asks Copilot to improve code using production incident records containing addresses. In this case the main need is: A user wants to share a Space publicly although it includes a private threat assessment.

Organization-level exclusion patterns can centralize protection for assigned users. That recommendation is relevant to a different task: An organization owner needs exclusions that apply across several company repositories. In this case the main need is: A user wants to share a Space publicly although it includes a private threat assessment.

“Results reproduce a meaningful improvement without changing outputs.” does not demonstrate the result required here: DNS resolution is restored and requests meet their normal timeout.

“Wrong-issuer and wrong-audience tokens are rejected in tests.” does not demonstrate the result required here: DNS resolution is restored and requests meet their normal timeout.

“Cancelling a request closes handles and stops unwanted work.” does not demonstrate the result required here: DNS resolution is restored and requests meet their normal timeout.

Privacy obligations apply to generated analytics instrumentation. That recommendation is relevant to a different task: A code assistant generates telemetry that captures a user's full home address without business need. In this case the main need is: A draft API handler exposes a password embedded in a copied configuration example.

Generated output may resemble copyrighted or licensed source material. That recommendation is relevant to a different task: An assistant returns a code snippet copied verbatim from an unfamiliar public project. In this case the main need is: A draft API handler exposes a password embedded in a copied configuration example.

Unverified marketing assertions create compliance and trust risks. That recommendation is relevant to a different task: An AI-generated README uses a confident but false statement about service uptime. In this case the main need is: A draft API handler exposes a password embedded in a copied configuration example.

Tests should not merely mirror the code they are meant to validate. That recommendation is relevant to a different task: Generated test assertions duplicate the current flawed implementation's output. In this case the main need is: An assistant writes a REST endpoint that returns all database fields to a normal user.

Coverage percentage does not demonstrate behavior under failure. That recommendation is relevant to a different task: Generated instructions claim test coverage is complete despite no negative-path tests. In this case the main need is: An assistant writes a REST endpoint that returns all database fields to a normal user.

Edge cases often reveal assumptions hidden by example-only testing. That recommendation is relevant to a different task: A generated Python loop changes behavior when the collection is empty. In this case the main need is: An assistant writes a REST endpoint that returns all database fields to a normal user.

“Approved implementation meets documented consent and retention controls.” does not demonstrate the result required here: Disaggregated tests identify unfair outcomes and the approved fix meets documented fairness goals.

“The query excludes unrelated personal attributes and passes documented review cases.” does not demonstrate the result required here: Disaggregated tests identify unfair outcomes and the approved fix meets documented fairness goals.

“Review evidence confirms approved primitives and tests cover misuse and invalid inputs.” does not demonstrate the result required here: Disaggregated tests identify unfair outcomes and the approved fix meets documented fairness goals.

“A test PR touching the excluded fixture is not reviewed using that content.” does not demonstrate the result required here: A supported inline suggestion no longer uses text from the excluded folder.

“Eligible clients receive the intended rules across covered repositories.” does not demonstrate the result required here: A supported inline suggestion no longer uses text from the excluded folder.

“A supported completion outside the folder does not use the excluded fixture text.” does not demonstrate the result required here: A supported inline suggestion no longer uses text from the excluded folder.

“A test policy edit appears with actor, event type, and timestamp.” does not demonstrate the result required here: Recorded events identify the actor and affected setting.

“Preview capabilities appear only for the intended test group.” does not demonstrate the result required here: Recorded events identify the actor and affected setting.

“Disallowed MCP servers cannot be invoked by affected accounts.” does not demonstrate the result required here: Recorded events identify the actor and affected setting.