Question 490
During troubleshooting, investigators observe: The password becomes available to every permitted repository reader and prompt context. The system context is: A team adds repository instructions containing a raw database password so Copilot can explain migrations. Which ONE cause most directly explains the observed failure?
- The feature availability boundary does not reflect repository governance.
- A broad path pattern matched additional nonconfidential directories beyond its intended secrets scope.
- Durable instructions are not a secret store and can broaden exposure of embedded values.
- Sensitive context was propagated into generated output without sanitization.
Explanation
Correct Answer
C:The remedy should therefore be: Remove credentials from instructions and refer to nonsecret configuration contracts or secret-manager identifiers.
Incorrect Answers
A:The remedy should therefore be: Use the supported organization/enterprise policies and repository scope controls for Copilot access. That does not establish secret-safe generated logging and code.
B:A broad path pattern matched additional nonconfidential directories beyond its intended secrets scope would not address the need for durable instructions are not a secret store and can broaden exposure of embedded values.
D:Sensitive context was propagated into generated output without sanitization would not address the need for durable instructions are not a secret store and can broaden exposure of embedded values.
Question 491
The current design is: Remove credentials from instructions and refer to nonsecret configuration contracts or secret-manager identifiers. The prior failure was: The password becomes available to every permitted repository reader and prompt context. Which ONE ongoing control best protects against recurrence of that specific failure?
- Run secret scanning and review repository instruction changes like source code.
- Apply redaction and secret scanning before sharing AI-assisted reports.
- Review pattern match examples whenever content exclusions or repository directories change.
- Audit effective Copilot policies when new repositories are created.
Explanation
Correct Answer
A:Durable instructions are not a secret store and can broaden exposure of embedded values. Run secret scanning and review repository instruction changes like source code.
Incorrect Answers
B:Redacting credentials and tokens prevents generated instrumentation from exposing secrets in logs or repositories. Preventing this failure involves running secret scanning and review repository instruction changes like source code.
C:Generated code requires independently defined acceptance tests and review against the real program contract. Preventing this failure involves running secret scanning and review repository instruction changes like source code.
D:Generated code requires independently defined acceptance tests and review against the real program contract. Preventing this failure involves running secret scanning and review repository instruction changes like source code. The observed condition is remove credentials from instructions and refer to nonsecret configuration contracts or secret-manager identifiers. The prior failure was: The password becomes.
Question 492
A team reports: A compliance officer wants a guaranteed statement that AI-generated code belongs to the company just because Copilot suggested it. They observe: A commercial release includes contested third-party material with no license analysis. Which ONE technical decision most directly corrects the cause?
- Do not submit excluded content explicitly; follow confidentiality policy and treat user-provided prompts as a separate disclosure decision.
- Review applicable GitHub terms, input provenance, third-party rights and company policies rather than claim automatic unqualified ownership.
- Redact tokens and other confidential fields before creating or sharing an AI-generated incident summary.
- Treat public-code matching filters as an additional safeguard rather than comprehensive provenance or security approval.
Explanation
Correct Answer
B:Output provenance and ownership depend on legal context, not the UI that produced text.
Incorrect Answers
A:Content-exclusion configuration is not authorization to reveal sensitive data through every channel. Output provenance and ownership depend on legal context, not the UI that produced text.
C:Sensitive context was propagated into generated output without sanitization. Output provenance and ownership depend on legal context, not the UI that produced text.
D:A matching filter does not verify dependencies or all downstream IP obligations. Output provenance and ownership depend on legal context, not the UI that produced text.
Question 493
A team has implemented the following change: Review applicable GitHub terms, input provenance, third-party rights and company policies rather than claim automatic unqualified ownership. The original requirement was: A compliance officer wants a guaranteed statement that AI-generated code belongs to the company just because Copilot suggested it. Which ONE validation test best demonstrates the intended behavior?
- Scan the proposed output and prompt for sensitive header values and secrets.
- Inspect a proposed prompt before sending and verify it contains no excluded secrets or business formulas.
- Record source references and legal review for a proposed generated component before publication.
- Run ordinary SCA/license and security scans on a generated patch and review any suspicious matches.
Explanation
Correct Answer
C:Record source references and legal review for a proposed generated component before publication.
Incorrect Answers
A:Redacting credentials and tokens prevents generated instrumentation from exposing secrets in logs or repositories. Verification of this result involves record source references and legal review for a proposed generated component before publication.
B:Redacting credentials and tokens prevents generated instrumentation from exposing secrets in logs or repositories. Verification of this result involves record source references and legal review for a proposed generated component before publication. The observed condition is a team has implemented the following change: Review applicable GitHub terms, input provenance, third-party rights and company policies rather than claim automatic.
D:Public-code similarity and repository licensing must be reviewed before copying suggested code into a product. Verification of this result involves record source references and legal review for a proposed generated component before publication.
Question 494
During troubleshooting, investigators observe: A commercial release includes contested third-party material with no license analysis. The system context is: A compliance officer wants a guaranteed statement that AI-generated code belongs to the company just because Copilot suggested it. Which ONE cause most directly explains the observed failure?
- Content-exclusion configuration is not authorization to reveal sensitive data through every channel.
- Sensitive context was propagated into generated output without sanitization.
- Output provenance and ownership depend on legal context, not the UI that produced text.
- A matching filter does not verify dependencies or all downstream IP obligations.
Explanation
Correct Answer
C:The remedy should therefore be: Review applicable GitHub terms, input provenance, third-party rights and company policies rather than claim automatic unqualified ownership.
Incorrect Answers
A:Content-exclusion configuration is not authorization to reveal sensitive data through every channel would not address the need for output provenance and ownership depend on legal context, not the UI that produced text.
B:Sensitive context was propagated into generated output without sanitization would not address the need for output provenance and ownership depend on legal context, not the UI that produced text.
D:The remedy should therefore be: Treat public-code matching filters as an additional safeguard rather than comprehensive provenance or security approval. The missing change involves output provenance and ownership depend on legal context, not the UI that produced text.
Question 495
The current design is: Review applicable GitHub terms, input provenance, third-party rights and company policies rather than claim automatic unqualified ownership. The prior failure was: A commercial release includes contested third-party material with no license analysis. Which ONE ongoing control best protects against recurrence of that specific failure?
- Keep regular code review, dependency scanning, and legal evaluation for generated output.
- Apply redaction and secret scanning before sharing AI-assisted reports.
- Route licensing disputes to qualified legal review and maintain source records.
- Train developers to minimize confidential prompt content independently of file exclusions.
Explanation
Correct Answer
C:Output provenance and ownership depend on legal context, not the UI that produced text. Route licensing disputes to qualified legal review and maintain source records.
Incorrect Answers
A:Approved dependency sources and lockfiles protect builds against invented or impersonated packages. Preventing this failure involves routing licensing disputes to qualified legal review and maintain source records.
B:Redacting credentials and tokens prevents generated instrumentation from exposing secrets in logs or repositories. Preventing this failure involves routing licensing disputes to qualified legal review and maintain source records.
D:Approved dependency sources and lockfiles protect builds against invented or impersonated packages. Preventing this failure involves routing licensing disputes to qualified legal review and maintain source records. The observed condition is review applicable GitHub terms, input provenance, third-party rights and company policies rather than claim automatic unqualified ownership. The prior failure was:.
Question 496
A GitHub Copilot task needs TWO complementary actions: the immediate fix and a preventive practice. Context: An admin needs to distinguish a Copilot code review finding from a required branch protection approval. Observed failure: A sensitive PR merges automatically just because Copilot review returned no findings. Select exactly TWO decisions that together address these needs.
- Maintain mandatory code owners and test gates for sensitive paths.
- Record the active plan, organization rules and source date in security guidance.
- Configure supported organization or repository content exclusions for the sensitive path, then check the effective supported client behavior.
- Keep human reviewer and check requirements enforced independently from optional AI comments or suggestions.
- Treat public-code matching filters as an additional safeguard rather than comprehensive provenance or security approval.
Explanation
Correct Answers
A:AI code review is not an independent authorization boundary or guaranteed defect detector. Maintain mandatory code owners and test gates for sensitive paths.
D:AI code review is not an independent authorization boundary or guaranteed defect detector.
Incorrect Answers
B:Record the active plan, organization rules and source date in security guidance. The combined controls instead need tested AI-assisted changes that preserve stated requirements.
C:Content exclusions restrict what Copilot can access; they do not make its code review an enforceable branch protection check.
E:Public-code matching filters do not substitute for required human approvals and branch test gates.
Question 497
A team has implemented the following change: Keep human reviewer and check requirements enforced independently from optional AI comments or suggestions. The original requirement was: An admin needs to distinguish a Copilot code review finding from a required branch protection approval. Which ONE validation test best demonstrates the intended behavior?
- Open a sensitive file in a supported IDE and verify inline suggestions are suppressed while a permitted file still works.
- Check the tenant's actual settings and documented processing commitments before writing a privacy statement.
- Run ordinary SCA/license and security scans on a generated patch and review any suspicious matches.
- Open a test pull request and verify protected-branch rules still require the configured human approval.
Explanation
Correct Answer
D:Open a test pull request and verify protected-branch rules still require the configured human approval.
Incorrect Answers
A:Open a sensitive file in a supported IDE and verify inline suggestions are suppressed while a permitted file still works. Verification of this result involves open a test pull request and verify protected-branch rules still require the configured human approval.
B:AI-assisted postmortem claims need links to actual commits, logs and reproducible failures. Verification of this result involves open a test pull request and verify protected-branch rules still require the configured human approval.
C:Public-code similarity and repository licensing must be reviewed before copying suggested code into a product. Verification of this result involves open a test pull request and verify protected-branch rules still require the configured human approval.
Question 498
During troubleshooting, investigators observe: A sensitive PR merges automatically just because Copilot review returned no findings. The system context is: An admin needs to distinguish a Copilot code review finding from a required branch protection approval. Which ONE cause most directly explains the observed failure?
- A required content-exclusion policy is missing, mis-scoped or ineffective on the client.
- AI code review is not an independent authorization boundary or guaranteed defect detector.
- A matching filter does not verify dependencies or all downstream IP obligations.
- Personal and managed enterprise privacy controls were conflated.
Explanation
Correct Answer
B:The remedy should therefore be: Keep human reviewer and check requirements enforced independently from optional AI comments or suggestions.
Incorrect Answers
A:A required content-exclusion policy is missing, mis-scoped or ineffective on the client. AI code review is not an independent authorization boundary or guaranteed defect detector.
C:A matching filter does not verify dependencies or all downstream IP obligations. AI code review is not an independent authorization boundary or guaranteed defect detector.
D:Personal and managed enterprise privacy controls were conflated. AI code review is not an independent authorization boundary or guaranteed defect detector.
Question 499
The current design is: Keep human reviewer and check requirements enforced independently from optional AI comments or suggestions. The prior failure was: A sensitive PR merges automatically just because Copilot review returned no findings. Which ONE ongoing control best protects against recurrence of that specific failure?
- Record the active plan, organization rules and source date in security guidance.
- Test exclusion policies on each supported surface and recheck after repository path changes.
- Keep regular code review, dependency scanning, and legal evaluation for generated output.
- Maintain mandatory code owners and test gates for sensitive paths.
Explanation
Correct Answer
D:AI code review is not an independent authorization boundary or guaranteed defect detector. Maintain mandatory code owners and test gates for sensitive paths. Preventing this failure involves maintaining mandatory code owners and test gates for sensitive paths.
Incorrect Answers
A:Record the active plan, organization rules and source date in security guidance. Preventing this failure involves maintaining mandatory code owners and test gates for sensitive paths.
B:Generated code requires independently defined acceptance tests and review against the real program contract. Preventing this failure involves maintaining mandatory code owners and test gates for sensitive paths.
C:Approved dependency sources and lockfiles protect builds against invented or impersonated packages. Preventing this failure involves maintaining mandatory code owners and test gates for sensitive paths.
Question 500
A GitHub Copilot workflow needs THREE distinct decisions: a direct implementation, a way to validate it, and a recurring protection. Situation: A security architect discovers that editor extensions and cloud agents may have different capabilities and content-exclusion behavior across versions. Failure: A confidential workflow relies on one setting assumed to protect every Copilot surface equally. Select exactly THREE options covering those responsibilities; a choice about another situation does not qualify.
- Use defense in depth and revisit the live support matrix whenever workflows or clients change.
- Test the relevant IDE chat mode, inline suggestions, code review, and authorized agent separately in a nonsecret repo.
- Read the current GitHub content-exclusion support matrix for each client and independently validate effective behavior before making a universal claim.
- Assume that a repository-level setting automatically configures every third-party MCP server and every IDE agent without testing their behavior.
- Explain the expected inline-suggestion suppression for excluded paths and verify the policy's intended scope.
- Replace the overly broad repository content-exclusion pattern with the specific authorized secrets directory path after checking documented glob syntax.
Explanation
Correct Answers
A:Feature and exclusion support are surface- and version-dependent, with additional MCP limitations. Use defense in depth and revisit the live support matrix whenever workflows or clients change.
B:Test the relevant IDE chat mode, inline suggestions, code review, and authorized agent separately in a nonsecret repo.
C:Feature and exclusion support are surface- and version-dependent, with additional MCP limitations.
Incorrect Answers
D:A repository policy does not guarantee uniform coverage of third-party MCP tools or agent surfaces. The task requires the documented matrix and tested client behavior.
E:Testing inline-suggestion suppression covers only one Copilot surface; it does not establish content-exclusion behavior in agents or code review.
F:Narrowing the exclusion path may help a repository setting, but it does not verify that each client and agent respects that setting.
GitHub Copilot (GH-300) Practice Tests