Question 340
In a Cisco AI Technical Practitioner study scenario, the team discovers: A developer accepts an AI-assisted logging patch that records request headers verbatim, unintentionally writing bearer tokens into an ordinary shared application log. Which preventive practice should be standardized to avoid recurrence?
Explanation
Correct Answer
This safeguard addresses ai generated pull request adds credentials to debug output: Include secret scanning and privacy-aware code review in CI for machine-suggested logging changes. The prevented failure mechanism is: Logging generated from broad debugging suggestions can disclose secrets even when functional tests pass and the main application permissions remain correct. A control for an unrelated service cannot establish the required protection.
Incorrect Answers
Generated code may introduce injection vulnerabilities when untrusted values are interpolated into query syntax rather than bound as data. “Scan AI-suggested database access code for parameterization and authorization before accepting automated pull requests” would remedy that alternative situation, but it would not correct the present issue: logging generated from broad debugging suggestions can disclose secrets even when functional tests pass and the main application permissions remain correct.
“Require evidence-linked diagnostic notes and reject disruptive AI troubleshooting changes unsupported by measurements” is the supported response when a model can offer a plausible hypothesis without sufficient evidence, so suggested root causes must be checked against observed telemetry before making risky changes. Here the decisive response is “Include secret scanning and privacy-aware code review in CI for machine-suggested logging changes”, so that different intervention does not meet the stated requirement.
Models can generate plausible but nonexistent API names or combine interfaces from different library versions, so suggestions need authoritative API checks. “Treat generated code as an untrusted draft and require pinned dependency builds and official API reference checks” applies to that other condition. The reported evidence is a developer accepts an AI-assisted logging patch that records request headers verbatim, unintentionally writing bearer tokens into an ordinary shared application log; this alternative would address the wrong dependency.