Question 20
The team has implemented a fix for this Copilot-related requirement: A generated rate limiter accepts a user-provided key that can vary per request. What should the reviewer observe to accept the change?
Explanation
Correct Answer
This is the specific observable acceptance result for the scenario. Security behavior must be tested against adversarial inputs to AI-generated code. It demonstrates the required behavior, rather than merely showing that a setting was changed.
Incorrect Answers
The application authenticates with the supported identity flow without storing user passwords in source or configuration. However, this does not establish the required outcome: repeated requests from one actor share the intended limit even when client headers change.
Relevant tests and security checks pass on the exact proposed change set. However, this does not establish the required outcome: repeated requests from one actor share the intended limit even when client headers change.
Unauthorized principals receive denial while valid principals retain allowed access. However, this does not establish the required outcome: repeated requests from one actor share the intended limit even when client headers change.