Question 470
During troubleshooting, investigators observe: An unmanaged sensitive repository remains accessible through an overly broad policy. The system context is: An organization needs a consistent process to deny Copilot on an unauthorized repository while permitting its approved engineering repos. Which ONE cause most directly explains the observed failure?
- The feature availability boundary does not reflect repository governance.
- A required content-exclusion policy is missing, mis-scoped or ineffective on the client.
- Matching-output policy or reference information was not considered in licensing decisions.
- Personal and managed enterprise privacy controls were conflated.
Explanation
Correct Answer
A:The remedy should therefore be: Use the supported organization/enterprise policies and repository scope controls for Copilot access.
Incorrect Answers
B:A required content-exclusion policy is missing, mis-scoped or ineffective on the client. The feature availability boundary does not reflect repository governance.
C:Matching-output policy or reference information was not considered in licensing decisions. The feature availability boundary does not reflect repository governance.
D:Personal and managed enterprise privacy controls were conflated. The feature availability boundary does not reflect repository governance.
Question 471
The current design is: Use the supported organization/enterprise policies and repository scope controls for Copilot access. The prior failure was: An unmanaged sensitive repository remains accessible through an overly broad policy. Which ONE ongoing control best protects against recurrence of that specific failure?
- Audit effective Copilot policies when new repositories are created.
- Test exclusion policies on each supported surface and recheck after repository path changes.
- Review AI-generated code with the same open-source and legal diligence as other external code.
- Record the active plan, organization rules and source date in security guidance.
Explanation
Correct Answer
A:The feature availability boundary does not reflect repository governance. Audit effective Copilot policies when new repositories are created.
Incorrect Answers
B:Generated code requires independently defined acceptance tests and review against the real program contract. Preventing this failure involves auditing effective Copilot policies when new repositories are created.
C:Generated code requires independently defined acceptance tests and review against the real program contract. Preventing this failure involves auditing effective Copilot policies when new repositories are created. The observed condition is use the supported organization/enterprise policies and repository scope controls for Copilot access. The prior failure was: An unmanaged sensitive repository.
D:Record the active plan, organization rules and source date in security guidance. Preventing this failure involves auditing effective Copilot policies when new repositories are created.
Question 472
A team reports: A Copilot Chat session includes an internal incident log containing API keys, and the team wants a summary for external contractors. They observe: An external summary includes a working access token from the original log. Which ONE technical decision most directly corrects the cause?
- Configure supported organization or repository content exclusions for the sensitive path, then check the effective supported client behavior.
- Review applicable GitHub terms, input provenance, third-party rights and company policies rather than claim automatic unqualified ownership.
- Redact tokens and other confidential fields before creating or sharing an AI-generated incident summary.
- Remove credentials from instructions and refer to nonsecret configuration contracts or secret-manager identifiers.
Explanation
Correct Answer
C:Sensitive context was propagated into generated output without sanitization.
Incorrect Answers
A:A required content-exclusion policy is missing, mis-scoped or ineffective on the client. Sensitive context was propagated into generated output without sanitization.
B:Output provenance and ownership depend on legal context, not the UI that produced text. Sensitive context was propagated into generated output without sanitization.
D:Durable instructions are not a secret store and can broaden exposure of embedded values. Sensitive context was propagated into generated output without sanitization.
Question 473
A team has implemented the following change: Redact tokens and other confidential fields before creating or sharing an AI-generated incident summary. The original requirement was: A Copilot Chat session includes an internal incident log containing API keys, and the team wants a summary for external contractors. Which ONE validation test best demonstrates the intended behavior?
- Scan the proposed output and prompt for sensitive header values and secrets.
- Open a sensitive file in a supported IDE and verify inline suggestions are suppressed while a permitted file still works.
- Record source references and legal review for a proposed generated component before publication.
- Scan `.github/copilot-instructions.md` and its commit history for credential-like data.
Explanation
Correct Answer
A:Scan the proposed output and prompt for sensitive header values and secrets.
Incorrect Answers
B:Open a sensitive file in a supported IDE and verify inline suggestions are suppressed while a permitted file still works. Verification of this result involves scan the proposed output and prompt for sensitive header values and secrets.
C:Generated code requires independently defined acceptance tests and review against the real program contract. Verification of this result involves scan the proposed output and prompt for sensitive header values and secrets.
D:AI-assisted postmortem claims need links to actual commits, logs and reproducible failures. Verification of this result involves scan the proposed output and prompt for sensitive header values and secrets.
Question 474
During troubleshooting, investigators observe: An external summary includes a working access token from the original log. The system context is: A Copilot Chat session includes an internal incident log containing API keys, and the team wants a summary for external contractors. Which ONE cause most directly explains the observed failure?
- Sensitive context was propagated into generated output without sanitization.
- A required content-exclusion policy is missing, mis-scoped or ineffective on the client.
- Durable instructions are not a secret store and can broaden exposure of embedded values.
- Output provenance and ownership depend on legal context, not the UI that produced text.
Explanation
Correct Answer
A:The remedy should therefore be: Redact tokens and other confidential fields before creating or sharing an AI-generated incident summary.
Incorrect Answers
B:The remedy should therefore be: Configure supported organization or repository content exclusions for the sensitive path, then check the effective supported client behavior. That does not establish tested AI-assisted changes that preserve stated requirements.
C:Durable instructions are not a secret store and can broaden exposure of embedded values would not address the need for sensitive context was propagated into generated output without sanitization.
D:Output provenance and ownership depend on legal context, not the UI that produced text would not address the need for sensitive context was propagated into generated output without sanitization.
Question 475
The current design is: Redact tokens and other confidential fields before creating or sharing an AI-generated incident summary. The prior failure was: An external summary includes a working access token from the original log. Which ONE ongoing control best protects against recurrence of that specific failure?
- Test exclusion policies on each supported surface and recheck after repository path changes.
- Run secret scanning and review repository instruction changes like source code.
- Apply redaction and secret scanning before sharing AI-assisted reports.
- Route licensing disputes to qualified legal review and maintain source records.
Explanation
Correct Answer
C:Sensitive context was propagated into generated output without sanitization. Apply redaction and secret scanning before sharing AI-assisted reports.
Incorrect Answers
A:Generated code requires independently defined acceptance tests and review against the real program contract. Preventing this failure involves applying redaction and secret scanning before sharing AI-assisted reports.
B:Redacting credentials and tokens prevents generated instrumentation from exposing secrets in logs or repositories. Preventing this failure involves applying redaction and secret scanning before sharing AI-assisted reports.
D:Public-code similarity and repository licensing must be reviewed before copying suggested code into a product. It would leave secret-safe generated logging and code without the specified safeguard.
Question 476
A team reports: A customer wants assurance that Copilot will never output a fragment similar to public code under any circumstances. They observe: A developer promises automatic IP safety without ever reviewing matched references. Which ONE technical decision most directly corrects the cause?
- Treat public-code matching filters as an additional safeguard rather than comprehensive provenance or security approval.
- Inspect the matching public-code reference and license details and apply the organization's IP review workflow.
- Explain the expected inline-suggestion suppression for excluded paths and verify the policy's intended scope.
- Explain the limits of public-code matching policy and use normal license and source review rather than promise zero matching output.
Explanation
Correct Answer
D:Similarity detection and policy support are not absolute output ownership guarantees.
Incorrect Answers
A:Treat public-code matching filters as an additional safeguard rather than comprehensive provenance or security approval would not explain the limits of public-code matching policy and use normal license and source review rather than promise zero matching output.
B:Inspecting the matching public-code reference and license details and applying the organization's IP review workflow would not explain the limits of public-code matching policy and use normal license and source review rather than promise zero matching output.
C:Explaining the expected inline-suggestion suppression for excluded paths and verifying the policy's intended scope would not explain the limits of public-code matching policy and use normal license and source review rather than promise zero matching output.
Question 477
A team has implemented the following change: Explain the limits of public-code matching policy and use normal license and source review rather than promise zero matching output. The original requirement was: A customer wants assurance that Copilot will never output a fragment similar to public code under any circumstances. Which ONE validation test best demonstrates the intended behavior?
- Inspect a flagged suggestion and confirm whether policy displayed or blocked it in that supported product.
- Open an unexcluded file and check that suggestions still work while sensitive paths remain blocked.
- Confirm the referenced repository and license are compatible or remove/reimplement the snippet.
- Run ordinary SCA/license and security scans on a generated patch and review any suspicious matches.
Explanation
Correct Answer
A:Inspect a flagged suggestion and confirm whether policy displayed or blocked it in that supported product.
Incorrect Answers
B:Open an unexcluded file and check that suggestions still work while sensitive paths remain blocked. It does not inspect a flagged suggestion and confirm whether policy displayed or blocked it in that supported product.
C:Public-code similarity and repository licensing must be reviewed before copying suggested code into a product. It does not inspect a flagged suggestion and confirm whether policy displayed or blocked it in that supported product.
D:Public-code similarity and repository licensing must be reviewed before copying suggested code into a product. Verification of this result involves inspecting a flagged suggestion and confirm whether policy displayed or blocked it in that supported product.
Question 478
During troubleshooting, investigators observe: A developer promises automatic IP safety without ever reviewing matched references. The system context is: A customer wants assurance that Copilot will never output a fragment similar to public code under any circumstances. Which ONE cause most directly explains the observed failure?
- Matching-output policy or reference information was not considered in licensing decisions.
- A matching filter does not verify dependencies or all downstream IP obligations.
- Similarity detection and policy support are not absolute output ownership guarantees.
- Policy-enforced exclusion was mistaken for an extension malfunction.
Explanation
Correct Answer
C:The remedy should therefore be: Explain the limits of public-code matching policy and use normal license and source review rather than promise zero matching output.
Incorrect Answers
A:Matching-output policy or reference information was not considered in licensing decisions would not address the need for similarity detection and policy support are not absolute output ownership guarantees.
B:The remedy should therefore be: Treat public-code matching filters as an additional safeguard rather than comprehensive provenance or security approval. The missing change involves similarity detection and policy support are not absolute output ownership guarantees.
D:Policy-enforced exclusion was mistaken for an extension malfunction would not address the need for similarity detection and policy support are not absolute output ownership guarantees.
Question 479
The current design is: Explain the limits of public-code matching policy and use normal license and source review rather than promise zero matching output. The prior failure was: A developer promises automatic IP safety without ever reviewing matched references. Which ONE ongoing control best protects against recurrence of that specific failure?
- Document excluded directory behavior and a safe support diagnostic process.
- Use a documented IP assessment process and avoid blanket compliance promises.
- Keep regular code review, dependency scanning, and legal evaluation for generated output.
- Review AI-generated code with the same open-source and legal diligence as other external code.
Explanation
Correct Answer
B:Similarity detection and policy support are not absolute output ownership guarantees. Use a documented IP assessment process and avoid blanket compliance promises.
Incorrect Answers
A:Document excluded directory behavior and a safe support diagnostic process. It would leave use a documented IP assessment process and avoid blanket compliance promises without the specified safeguard.
C:Approved dependency sources and lockfiles protect builds against invented or impersonated packages. It would leave use a documented IP assessment process and avoid blanket compliance promises without the specified safeguard.
D:Generated code requires independently defined acceptance tests and review against the real program contract. It would leave use a documented IP assessment process and avoid blanket compliance promises without the specified safeguard.
Question 480
A team reports: An administrator excludes a symbolic-link path pointing to confidential files and assumes the link is covered in every client. They observe: A file reachable through a symlink unexpectedly enters assistant context. Which ONE technical decision most directly corrects the cause?
- Assume a glob-based exclusion automatically protects a symlink target on a remote filesystem without validating the client behavior.
- Read the current GitHub content-exclusion support matrix for each client and independently validate effective behavior before making a universal claim.
- Treat symlink and remote-filesystem exclusion behavior as a documented limitation and use stronger access restrictions on the underlying files.
- Configure supported organization or repository content exclusions for the sensitive path, then check the effective supported client behavior.
Explanation
Correct Answer
C:Exclusion path handling does not necessarily extend to symlink targets or remote storage.
Incorrect Answers
A:Exclusion patterns alone do not guarantee coverage of symlink targets or remote paths. The scenario requires understanding documented limits and stronger underlying access control.
B:Feature and exclusion support are surface- and version-dependent, with additional MCP limitations. That does not establish treat symlink and remote-filesystem exclusion behavior as a documented limitation and use stronger access restrictions on.
D:A required content-exclusion policy is missing, mis-scoped or ineffective on the client. Exclusion path handling does not necessarily extend to symlink targets or remote storage.
GitHub Copilot (GH-300) Practice Tests