Gains:
- Ability to recognize and verify that AI may produce bogus APIs, insecure code, and copyrighted content
- Ability to manage AI use within the limits of source code confidentiality, personal data and corporate policy
- Understanding that the ultimate responsibility for license compliance, security and ethics remains with the engineer.
Module Exam
1. As a computer engineer, when working with an AI code generation tool, the ultimate responsibility for which of the following should always remain with the human?
- A) Final approval of correctness, security, and review and testing of code put into production ✔
- B) Creating the first code skeleton for a function
- C) Producing a list of suggestions for variable names
- D) Preparing a draft text for code comments
Description: AI; It can speed up tasks such as code skeleton, test draft and documentation. However, it is the engineer's responsibility to review, test and approve the generated code to ensure that it is correct, safe and in compliance with the requirements, and to put it into production; this cannot be delegated to AI without independent verification.
2. AI has produced a function for you and it seems to be working in the happy path. What is the best step before putting it into production?
- A) Since the function seems to work, put it directly into production
- B) Verify behavior by writing and running small unit tests that include edge cases ✔
- C) Just looking at the number of lines of the function
- D) Making the name of the function more descriptive
Explanation: Appearing to work does not mean being right. Writing and running small unit tests that cover edge cases such as empty input, zero, negative, very large value, and mismatch verify the actual behavior of the function without moving it to the live environment.
3. AI suggested a method called 'array.sortStable()' that does not exist in your language and explained it in a clear manner. What is the first correct action to take?
- A) Using the method directly because the AI seems confident
- B) Define the method yourself and use its name exactly
- C) Verifying the existence of the method from the official documentation of the language/library ✔
- D) Close the compiler warning and continue
Explanation: Language models can plausibly make up library, package, or method names that do not actually exist (hallucinate). Each proposed API should be verified verbatim against the official and current documentation of the language or library; If it is not included in the document, it should not be used.
4. You want to paste your company's confidential source code and an embedded API key into a public AI tool and ask for help. Which is the most correct approach?
- A) Pasting the code as is with the API key for speed
- B) It is enough to just delete the company name and share everything else
- C) Sharing the code and then asking the AI to delete it
- D) Removing secrets and hidden logic and reducing the problem to a representative example or using an institutional tool ✔
Description: Secret source code and credentials (API key, password, connection string); It is risky in terms of company secret and security. It is necessary to strip out the secrets and hidden business logic and reduce the problem to an anonymous/representative example or use an enterprise/non-data sharing tool.
5. AI said that the complexity of a search function he wrote was O(n); but there are two nested loops in the code. What is the correct engineering behavior?
- A) Analyze the code manually and extract the complexity yourself and measure it if necessary ✔
- B) Accept O(n) and continue because AI said
- C) Assuming the number of cycles has nothing to do with performance
- D) Just change the name of the function
Explanation: Time complexity (Big-O) shows how the number of operations increases as the input grows. Two nested loops usually mean O(n^2). AI's complexity claim should be verified by manually analyzing the code and measuring with increasing inputs if necessary; Relying on the claim produces a false assumption of performance.
6. AI generated code that directly inserts user input into a SQL query by concatenating text. What is the main problem and the right solution here?
- A) No problem; text merging is the fastest method
- B) There is a risk of SQL injection; A parameterized query (prepared statement) that separates the input should be used ✔
- C) Just converting the query to uppercase is enough
- D) Writing the query shorter will solve the problem
Description: Adding user input directly to the query text creates a SQL injection vulnerability; The attacker can modify the query with the input. The correct solution is to use a parameterized query (prepared statement) that separates the input from the query text. This is one of the most commonly missed security mistakes in AI code.
7. You have limited time when reviewing a piece of code produced by AI. Which issues are best to prioritize?
- A) Only format details such as indentation and spacing
- B) Only the length of variable names
- C) Logical correctness, vulnerabilities and edge case behavior ✔
- D) Only the total number of lines of the file
Description: Highest risk in code review; These are issues that cause serious harm, such as logical errors, security vulnerabilities and confidential information leaks. Format and style problems are fixed with automatic tools; The main human attention should be devoted to accuracy, security and edge case behavior.
8. You want to have AI solve a bug. Which input would best help the AI find the root cause?
- A) Just saying 'code doesn't work, fix it'
- B) Just give the name of the file
- C) Just saying the expected result, without the error text
- D) Provide full error message, stack trace, relevant code and minimum reproduction example ✔
Explanation: For effective debugging, it is necessary to give the AI the full error message, stack trace, relevant code snippet, and the smallest reproducible sample that produces the error. The vague statement 'doesn't work' forces AI to guess and make blanket recommendations.
9. All unit tests produced by AI pass on the first run. Which risk should not be ignored in this situation?
- A) Tests may confirm the current state of the code but not actual/expected behavior ✔
- B) The code is absolutely error free because all tests passed
- C) Quality is guaranteed if the number of tests is large
- D) Passing the test proves that the coverage is complete
Explanation: Tests may be validating the current (perhaps buggy) behavior of the code, not its intended behavior; or it may not contain any meaningful assertion and is always passed. To see that the tests are checking the real expectation, it is necessary to consciously break the code and confirm that the test turns red.
10. AI has produced you a ready-made block of code for a problem. You suspect that the code may have been copied verbatim from an open source project. Which is the right approach?
- A) Using the license without thinking because the code works
- B) Checking the source/license of the code, rewriting if necessary and complying with corporate policy ✔
- C) Just change the variable names and consider the problem solved
- D) Assuming that licensing only concerns large companies
Description: AI can reproduce the copyrighted/licensed code in the training data verbatim. License violation in a commercial product creates serious legal risks. It is necessary to check the source and license of the code, rewrite it in your own words if necessary, and comply with the institution's licensing policy.
11. AI suggested that you immediately switch to microservices architecture for your project. What is the most appropriate engineering approach when evaluating this proposal?
- A) Immediately divide the entire system into microservices because AI suggests
- B) Assuming microservice is always the best choice
- C) Evaluate the proposal according to the real need, load, team structure and plus-minus balance ✔
- D) Making the decision based solely on the popularity of the architecture
Explanation: Architectural decisions depend on context; Microservices add value in needs such as scale and team separation, but come with costs such as operational complexity, distributed debugging and cost. Evaluate the proposal according to the actual need, load, team structure and pros and cons balance; General advice should not be followed blindly.
12. AI produced a streamlined README and API documentation for your code; but some endpoints and parameters do not match in the code. What is the correct behavior?
- A) Publishing the document as it is because the text is fluent
- B) Just fix the title and leave the rest as is
- C) Adding the document to the warehouse without reading it
- D) Compare each endpoint and parameter to the actual code and fix any that do not match ✔
Description: Documentation should be an accurate reflection of the actual code; The wrong document pushes the developers who read it to use it incorrectly. Every endpoint, parameter, and return value should be verified against the actual code, and any mismatches should be corrected.
13. Which input approach is right for the highest quality output when requesting code from AI?
- A) Clearly providing language/version, input-output contract, constraints and error situations ✔
- B) Just saying 'write me some working code'
- C) Write the shortest request without giving any context
- D) Just specifying how many lines of code there will be
Description: Powerful prompt; It includes the language and version used, the input-output contract, performance and style constraints, error conditions, and the 'stay only within the requested scope' instruction. A contextless 'write me a function' request is generic and often produces inappropriate code.
14. AI generated a configuration for your CI/CD (continuous integration/deployment) pipeline and embedded the database password in it in plain text. Which is the correct fix?
- A) Leaving the password as plain text because it works
- B) Moving secrets out via environment variable or secret management tool, not putting plaintext in the repository ✔
- C) Move the password only to the comment line
- D) Changing the file name solves the problem
Explanation: Writing secrets such as passwords and keys in plain text to the configuration file poses the risk of leaking version control and unauthorized access. Secrets; It should be kept out by environment variables or a special secrets manager, and should never enter the repository in plain text.