Module assessment

1.

Fabrikam's code review system shows that code submissions associated with junior developer identifiers receive 23% more security findings than equivalent code submitted by senior developers. Which technique best identifies which agent in the pipeline is introducing this disparity?

Retrain all agents using a deduplicated dataset that removes developer seniority signals from the training data.

Replay the code submission through the pipeline starting at each agent step with the same input, compare outputs between senior and junior developer metadata contexts, and identify the step where the disparity first appears.

Strip all developer identity metadata from inputs before any agent processes them, which prevents bias from entering the pipeline.

2.

A developer receives a code review recommending they redesign their database schema. They ask which agent made this recommendation and what evidence supports it. What does a properly designed multi-agent transparency system provide?

The full conversation history of all agent interactions so the developer can trace each step themselves.

A structured attribution report with: the source agent ID, the specific evidence that supported the finding (rule reference or pattern match), the confidence level, and a link to the relevant architectural guideline.

A confidence percentage for the entire code review and the model temperature setting used during generation.

3.

Fabrikam wants to use code submitted through their review system to fine-tune future models. Under EU data privacy law, what is required before using this data for this purpose?

Anonymizing the code by removing developer names from comments is sufficient to allow use for model training without extra consent.

Separate, specific consent from the enterprise customer is required, as using code review data for model training goes beyond the stated purpose of the original data collection.

Since the code is owned by the enterprise customer, not by individuals, EU data privacy law doesn't apply and no consent is needed for model training.

4.

Fabrikam's legal team discovers that a financial services customer requires WORM-compliant audit storage for their code review records, citing SEC Rule 17a-4(f). The existing Log Analytics workspace alone doesn't satisfy this requirement. What other infrastructure should Fabrikam configure?

Increase the Log Analytics workspace retention period to 12 years, which satisfies tamper-evidence requirements for financial services regulations.

Export audit logs from Log Analytics to Azure Blob Storage and apply a locked time-based retention policy, creating write-once, read-many storage that prevents modification or deletion until the retention period expires.

Enable geo-redundant replication for the Log Analytics workspace so that audit records survive a regional outage.

Feedback