Module 5 Quiz: Governance, Security and Compliance

Six questions. Click an option to check it.

---

Question 1

Which risk category is genuinely new with AI-assisted development, rather than an existing risk made more likely?

1. Secrets in commits
2. Unapproved licences
3. Prompt injection
4. Typo-squatted packages

---

Question 2

Why is input filtering not a sufficient defence against prompt injection?

1. Filters are too slow
2. There are infinitely many phrasings; the model cannot distinguish instructions from data, so the control must limit what the agent can do
3. Filters only work in English
4. Providers forbid filtering

---

Question 3

An API key was visible in an agent session transcript, but the agent did not commit it. What should happen?

1. Nothing; it was not committed
2. Delete the transcript
3. Rotate the key - a secret that entered a model context is treated as compromised
4. Add the key to the rules file so the agent knows not to use it

---

Question 4

Which permission should an automated agent identity never have?

1. Read the repository
2. Push to a scoped branch
3. Open a pull request
4. Approve or merge its own pull request

---

Question 5

What makes a policy "enforced" rather than "a PDF"?

1. It is signed by the CTO
2. Each line maps to configuration - branch protection, CI gates, ignore files, scoped identities - that applies whether anyone remembers it or not
3. It is longer than ten pages
4. It is reviewed annually

---

Question 6

An auditor asks how you govern AI in your development process. Which answer is complete?

1. "We trust our engineers"
2. "We only use Copilot"
3. "Here is our policy, here is how it is enforced in configuration, and here is the audit trail showing it was followed"
4. "We do not use AI"