Generative AI Leader Practice Question: Techniques to Improve Generative AI Model Output
An enterprise uses a fine-tuned PaLM 2 model for code generation. They want to ensure the generated code passes security audits. Which combination of techniques would be most effective?
⚠ Common exam trap
The Generative AI Leader exam often tests the misconception that prompt engineering alone (e.g., system instructions or few-shot examples) is sufficient for security, when in fact deterministic validation and filtering techniques are required to enforce constraints reliably.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Integrate a static analysis tool in the pipeline and add a safety filter to reject code containing dangerous functions.
Integrating a static analysis tool (e.g., SonarQube, Checkmarx) into the pipeline provides automated, rule-based scanning for security vulnerabilities like SQL injection or buffer overflows, while a safety filter explicitly blocks generated code containing dangerous functions (e.g., eval(), exec()). This combination creates a defense-in-depth approach that catches both known vulnerability patterns and explicitly prohibited operations, which is essential for passing security audits.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Integrate a static analysis tool in the pipeline and add a safety filter to reject code containing dangerous functions.
Why this is correct
Static analysis scans generated code for dangerous constructs before merge, while a safety filter rejects outputs containing risky functions at generation time. Together they satisfy the security audit requirement by catching vulnerabilities at two stages rather than relying on prompt engineering alone.
- ✗
Use a few-shot prompt with examples of secure code and set temperature to 1.0.
Why it's wrong here
Temperature 1.0 maximises sampling randomness, so secure few-shot examples are undermined by unpredictable token selection. Few-shot prompting is tempting for steering style, but security assurance needs deterministic output plus validation; low temperature and automated scanning are required instead.
- ✗
Fine-tune the model on a dataset of insecure code and use top-p=0.9.
Why it's wrong here
Fine-tuning on insecure code teaches the model to reproduce vulnerable patterns, directly contradicting the audit requirement. Top-p sampling only controls token breadth. Fine-tuning is tempting for domain adaptation, but here the dataset must contain secure, reviewed code to shape safe outputs.
- ✗
Increase the model's context window and use a system instruction to 'be secure'.
Why it's wrong here
A larger context window only admits more input tokens; it does not enforce secure coding patterns, and a system instruction is unverified guidance the model may ignore. Context expansion suits long-file analysis, but passing security audits needs constrained decoding and static analysis.
Go deeper
Related to this question
About these practice questions
One of 1,008 original Generative AI Leader practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This Generative AI Leader practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the Generative AI Leader exam.