Question 260
During troubleshooting, investigators observe: A slow or disallowed model is selected for every trivial inline question. The system context is: A developer needs to choose a Copilot model for a complex reasoning task and assumes all available models have equal latency and limits. Which ONE cause most directly explains the observed failure?
- Repository context selection and retrieval can omit relevant files.
- Extraneous context can crowd out useful evidence and increase ambiguity.
- The assistant did not have the actual codebase information in its input context.
- Different model options and access policies have distinct tradeoffs and availability.
Explanation
Correct Answer
D:The remedy should therefore be: Compare the currently available model capabilities, speed, allowances and organization policy in the actual Copilot interface.
Incorrect Answers
A:Repository context selection and retrieval can omit relevant files would not address the need for different model options and access policies have distinct tradeoffs and availability.
B:Extraneous context can crowd out useful evidence and increase ambiguity would not address the need for different model options and access policies have distinct tradeoffs and availability.
C:The remedy should therefore be: Provide authorized repository/file context or use supported repository indexing tools instead of expecting hidden access. That does not establish different model options and access policies have distinct tradeoffs and availability.
Question 261
The current design is: Compare the currently available model capabilities, speed, allowances and organization policy in the actual Copilot interface. The prior failure was: A slow or disallowed model is selected for every trivial inline question. Which ONE ongoing control best protects against recurrence of that specific failure?
- Reassess model selection as plans, policies and product versions change.
- Keep prompts specific and include only files that bear on the actual decision.
- Confirm retrieved file paths and version of the repository before trusting navigation advice.
- Cross-check answers against authoritative code search when completeness matters.
Explanation
Correct Answer
A:Different model options and access policies have distinct tradeoffs and availability. Reassess model selection as plans, policies and product versions change.
Incorrect Answers
B:Keep prompts specific and include only files that bear on the actual decision.
C:Confirm retrieved file paths and version of the repository before trusting navigation advice. It would leave reassess model selection as plans, policies and product versions change without the specified safeguard.
D:Cross-check answers against authoritative code search when completeness matters. It would leave reassess model selection as plans, policies and product versions change without the specified safeguard.
Question 262
A team reports: A security leader believes choosing Copilot Business automatically makes every connected third-party tool safe for confidential data. They observe: Private repository text is copied to an external service through an overly broad tool. Which ONE technical decision most directly corrects the cause?
- Distinguish safety/filtering stages from semantic correctness; build, test and review the accepted completion.
- Read the applicable plan's current official data processing and organizational settings before stating any training or retention rule.
- Provide relevant open-file and nearby code context while treating the actual prompt-building window as selective and limited.
- Evaluate each MCP server and external integration's own permissions and data path rather than relying on Copilot plan alone.
Explanation
Correct Answer
D:The tool integration introduces a separate trust and data-processing boundary.
Incorrect Answers
A:Distinguishing safety/filtering stages from semantic correctness would not meet the need for each MCP server.
B:Reading the applicable plan's current official data processing and organizational settings would not meet the need for each MCP server.
C:Providing relevant open-file and nearby code context while treating the actual prompt-building window as selective and limited would not meet the need for each MCP server.
Question 263
A team has implemented the following change: Evaluate each MCP server and external integration's own permissions and data path rather than relying on Copilot plan alone. The original requirement was: A security leader believes choosing Copilot Business automatically makes every connected third-party tool safe for confidential data. Which ONE validation test best demonstrates the intended behavior?
- Inject a wrong business-rule fixture and check the produced function fails the test.
- Verify an eligible tenant's effective controls and compare with an individual account's settings.
- Review a test tool request's destination and verify no unapproved document content is sent.
- Close unrelated tabs, expose the target helper definition and compare the next completion for consistency.
Explanation
Correct Answer
C:Review a test tool request's destination and verify no unapproved document content is sent.
Incorrect Answers
A:Generated code requires independently defined acceptance tests and review against the real program contract. That check cannot demonstrate validated approved cryptographic requirements.
B:Verify an eligible tenant's effective controls and compare with an individual account's settings. That check cannot demonstrate validated approved cryptographic requirements.
D:Close unrelated tabs, expose the target helper definition and compare the next completion for consistency. That check cannot demonstrate validated approved cryptographic requirements.
Question 264
During troubleshooting, investigators observe: Private repository text is copied to an external service through an overly broad tool. The system context is: A security leader believes choosing Copilot Business automatically makes every connected third-party tool safe for confidential data. Which ONE cause most directly explains the observed failure?
- Proxy and output filters do not establish business-logic validity.
- The tool integration introduces a separate trust and data-processing boundary.
- Copilot assembles bounded context and does not possess perfect omniscient repository state.
- Plan-specific processing controls and contracts were conflated.
Explanation
Correct Answer
B:The remedy should therefore be: Evaluate each MCP server and external integration's own permissions and data path rather than relying on Copilot plan alone.
Incorrect Answers
A:Proxy and output filters do not establish business-logic validity. The tool integration introduces a separate trust and data-processing boundary.
C:Copilot assembles bounded context and does not possess perfect omniscient repository state. The tool integration introduces a separate trust and data-processing boundary.
D:Plan-specific processing controls and contracts were conflated. The tool integration introduces a separate trust and data-processing boundary.
Question 265
The current design is: Evaluate each MCP server and external integration's own permissions and data path rather than relying on Copilot plan alone. The prior failure was: Private repository text is copied to an external service through an overly broad tool. Which ONE ongoing control best protects against recurrence of that specific failure?
- Record effective plan and date when documenting privacy claims.
- Keep necessary examples and contracts accessible rather than assume every file is included.
- Maintain an approved-tool registry and minimize shared context per request.
- Retain static analysis, tests and peer review after AI output processing.
Explanation
Correct Answer
C:The tool integration introduces a separate trust and data-processing boundary. Maintain an approved-tool registry and minimize shared context per request.
Incorrect Answers
A:Record effective plan and date when documenting privacy claims. It would leave verified package identity and dependency provenance without the specified safeguard.
B:Keep necessary examples and contracts accessible rather than assume every file is included. Preventing this failure involves maintaining an approved-tool registry and minimize shared context per request.
D:Generated code requires independently defined acceptance tests and review against the real program contract. Preventing this failure involves maintaining an approved-tool registry and minimize shared context per request.
Question 266
A team reports: An organization compares individual Copilot privacy settings with centrally governed Business/Enterprise usage and assumes the controls are identical. They observe: A policy memo treats all Copilot subscriptions as having the same model-training opt-out behavior. Which ONE technical decision most directly corrects the cause?
- Review GitHub's matching-public-code references and applicable policy rather than infer provenance from style alone.
- Treat LLM generation as potentially non-deterministic and verify outputs against stable acceptance tests.
- Read the applicable plan's current official data processing and organizational settings before stating any training or retention rule.
- Evaluate each MCP server and external integration's own permissions and data path rather than relying on Copilot plan alone.
Explanation
Correct Answer
C:Plan-specific processing controls and contracts were conflated.
Incorrect Answers
A:Reviewing GitHub's matching-public-code references and applicable policy rather than infer provenance from style alone would not read the applicable plan's current official data processing and organizational settings.
B:Treat LLM generation as potentially non-deterministic and verify outputs against stable acceptance tests would not read the applicable plan's current official data processing and organizational settings.
D:Evaluating each MCP server and external integration's own permissions and data path rather than relying on Copilot plan alone would not read the applicable plan's current official data processing and organizational settings.
Question 267
A team has implemented the following change: Read the applicable plan's current official data processing and organizational settings before stating any training or retention rule. The original requirement was: An organization compares individual Copilot privacy settings with centrally governed Business/Enterprise usage and assumes the controls are identical. Which ONE validation test best demonstrates the intended behavior?
- Run several prompt attempts and compare resulting outputs against one common test suite.
- Review a test tool request's destination and verify no unapproved document content is sent.
- Verify an eligible tenant's effective controls and compare with an individual account's settings.
- Inspect any matching links and licensing information attached to the specific accepted suggestion.
Explanation
Correct Answer
C:Verify an eligible tenant's effective controls and compare with an individual account's settings.
Incorrect Answers
A:Generated code requires independently defined acceptance tests and review against the real program contract. It does not verify an eligible tenant's effective controls and compare with an individual account's settings.
B:Cryptographic algorithm decisions must follow authoritative security standards rather than unverified model claims. Verification of this result involves verifying an eligible tenant's effective controls and compare with an individual account's settings.
D:Public-code similarity and repository licensing must be reviewed before copying suggested code into a product. It does not verify an eligible tenant's effective controls and compare with an individual account's settings.
Question 268
During troubleshooting, investigators observe: A policy memo treats all Copilot subscriptions as having the same model-training opt-out behavior. The system context is: An organization compares individual Copilot privacy settings with centrally governed Business/Enterprise usage and assumes the controls are identical. Which ONE cause most directly explains the observed failure?
- The tool integration introduces a separate trust and data-processing boundary.
- Plan-specific processing controls and contracts were conflated.
- Public-code reference information was ignored during IP review.
- A generative model is probabilistic, not a deterministic code compiler.
Explanation
Correct Answer
B:The remedy should therefore be: Read the applicable plan's current official data processing and organizational settings before stating any training or retention rule.
Incorrect Answers
A:The tool integration introduces a separate trust and data-processing boundary would not address the need for plan-specific processing controls and contracts were conflated.
C:Public-code reference information was ignored during IP review would not address the need for plan-specific processing controls and contracts were conflated.
D:The remedy should therefore be: Treat LLM generation as potentially non-deterministic and verify outputs against stable acceptance tests. That does not establish plan-specific processing controls and contracts were conflated.
Question 269
The current design is: Read the applicable plan's current official data processing and organizational settings before stating any training or retention rule. The prior failure was: A policy memo treats all Copilot subscriptions as having the same model-training opt-out behavior. Which ONE ongoing control best protects against recurrence of that specific failure?
- Maintain an approved-tool registry and minimize shared context per request.
- Anchor acceptability in tests and specifications, not exact repeated wording.
- Require source/license review and choose to rewrite material when permitted-use conditions are unclear.
- Record effective plan and date when documenting privacy claims.
Explanation
Correct Answer
D:Plan-specific processing controls and contracts were conflated. Record effective plan and date when documenting privacy claims.
Incorrect Answers
A:Approved dependency sources and lockfiles protect builds against invented or impersonated packages. It would leave record effective plan and date when documenting privacy claims without the specified safeguard.
B:Generated code requires independently defined acceptance tests and review against the real program contract. It would leave record effective plan and date when documenting privacy claims without the specified safeguard.
C:Public-code similarity and repository licensing must be reviewed before copying suggested code into a product. It would leave record effective plan and date when documenting privacy claims without the specified safeguard.
Question 270
A team reports: An IDE is allowed to show suggestions but a model responds with an unsafe file-deletion command. They observe: A user runs a destructive command assuming filters made it operationally harmless. Which ONE technical decision most directly corrects the cause?
- Distinguish safety/filtering stages from semantic correctness; build, test and review the accepted completion.
- Recognize that content filtering and tool approval are different stages; independently authorize every side-effectful action.
- Use the repository's own implementation and versioned documentation as higher-trust evidence than an unverified retrieved reference.
- Provide relevant open-file and nearby code context while treating the actual prompt-building window as selective and limited.
Explanation
Correct Answer
B:Filtering output is not a sandbox or permission boundary for shell operations.
Incorrect Answers
A:Distinguishing safety/filtering stages from semantic correctness would not address the need for recognize that content filtering and tool approval are different stages.
C:External retrieval results can be relevant-looking but still incorrect for the current environment. That does not establish verified package identity and dependency provenance.
D:Providing relevant open-file and nearby code context while treating the actual prompt-building window as selective and limited would not address the need for recognize that content filtering and tool approval are different stages.
GitHub Copilot (GH-300) Practice Tests