Domain 1 content was verified on 26 August 2026 and is current as of August 2026. The domain name, subskills, and weighting come from the Microsoft Learn skills outline; responsible-use behavior comes from GitHub's application cards and code-referencing documentation; the six responsible AI principles come from Microsoft and GitHub responsible AI material.
Microsoft Learn — Study guide for Exam GH-300 · skills measured as of 7 August 2026. Content last verified 26 August 2026.
What this domain tests#
Domain 1 tests judgment: understand generative AI risks, describe ethical use, identify harms and mitigations, validate output, and operate Copilot responsibly. Microsoft Learn — GH-300 skills outline
Domain 1 is the second-largest domain
The current outline lists Use GitHub Copilot responsibly at 15–20%, the second-largest domain after Copilot features. Microsoft Learn — GH-300 study guide
Exam instinct: Copilot accelerates a developer; it does not replace the developer's accountability.
The six responsible AI principles#
Microsoft and GitHub name six responsible AI principles: fairness; reliability and safety; privacy and security; inclusiveness; transparency; and accountability. Microsoft Learn — Microsoft and GitHub’s six principles of responsible AI
| Principle | How it shows up in Copilot work |
|---|---|
| Fairness | Check logic and test data for biased assumptions about users, names, locations, roles, languages, or eligibility. |
| Reliability and safety | Treat output as untrusted until it builds, passes tests, handles edge cases, and fails safely. |
| Privacy and security | Do not prompt with secrets or unnecessary customer data; inspect for leaks, injection, weak crypto, and broad permissions. |
| Inclusiveness | Review generated UI for keyboard paths, labels, contrast, screen-reader semantics, captions, and understandable errors. |
| Transparency | Disclose AI help when appropriate, document assumptions, and preserve PR discussion, tests, and agent logs. |
| Accountability | A human decides whether output is appropriate, lawful, secure, accessible, and ready to ship. |
Risks, harms, and mitigations#
GitHub’s responsible-use pages repeatedly warn that Copilot output may be inaccurate, incomplete, biased, misaligned, irrelevant, insecure, or based on misunderstood context. GitHub Docs — Responsible use of GitHub Copilot features
| Risk | What to watch for | Responsible mitigation |
|---|---|---|
| Bias and unfairness | Stereotyped data, one-culture assumptions, unfair ranking or eligibility logic, or inaccessible UI. | Review requirements, add representative tests, check accessibility, and compare similarly situated users. |
| Hallucination | Invented APIs, settings, limits, filenames, or explanations. GitHub defines hallucination as plausible but unsupported or fabricated output. | Verify against official docs, local code, compiler output, tests, and runtime behavior. GitHub Docs — Responsible use of inline suggestions |
| Security vulnerabilities | Secrets, missing authorization, injection, unsafe deserialization, weak crypto, risky dependencies, or dangerous commands. | Use secure coding review, tests, scanners, dependency checks, and command review. GitHub Docs — Responsible use of Copilot Agents |
| IP and license exposure | Suggestions may match public GitHub code and, depending on settings, be blocked or shown with source and license details. | Review references and decide whether to keep, attribute, rewrite, or remove the code. GitHub Docs — Copilot code referencing |
| Over-reliance and skill atrophy | Developers accept code they do not understand because mistakes can be hard to detect. | Keep humans in the loop, require explanation, prefer small changes, and prove behavior with tests. GitHub Docs — Responsible use of Copilot Chat |
Public code matching is setting-dependent
GitHub documents setting-dependent public code matching: matches may be blocked or annotated with source and license details. Code referencing compares potential suggestions and about 150 surrounding characters against an index of public GitHub repositories; private repositories and non-GitHub code are not included. GitHub Docs — Copilot code referencing
The developer is accountable#
Copilot suggestions are not exceptions to normal engineering responsibility. GitHub’s Terms of Service make users responsible for user-generated content and rights to post it; GitHub’s responsible-use docs require review, testing, and validation before use. GitHub Terms of Service — User-Generated Content GitHub Docs — Responsible use of inline suggestions
For exam purposes: if you accept, edit, commit, or merge it, you own the decision. For Copilot cloud agent, GitHub documents traceability through agent session logs and human co-authorship, but the pull request still needs human review before merge. GitHub Docs — Responsible use of Copilot Agents
Validate output in practice#
Validation is more than “it looks right.” GitHub says generated code may appear valid while being wrong, insecure, or misaligned with intent. GitHub Docs — Responsible use of Copilot Chat
Use this flow before accepting Copilot output as production-ready:
- Understand it. If you cannot explain the algorithm, API, permissions, or command, do not accept it yet.
- Compare it to requirements. Confirm it solves the real acceptance criteria.
- Build and run it. Compile, lint, test, and exercise a realistic path.
- Add missing tests. Include normal cases, boundaries, invalid input, error paths, and authorization failures.
- Review security and privacy. Look for injection, secrets, unsafe file or network access, weak crypto, risky dependencies, and sensitive logging.
- Review fairness and accessibility. Inspect assumptions about users and generated UI behavior.
- Check IP signals. If code references appear, review the source and license details.
- Use human review. Copilot code review can help, but it supplements rather than replaces people.
Responsible
Accept with Tab, then read, simplify, test, scan, and explain the change in the pull request.
Not responsible
Accept a large change because it "looks professional," skip tests, and rely on Copilot's explanation instead of evidence.
Operate Copilot responsibly by feature#
Inline suggestions are visually distinct and only applied when a user explicitly accepts them, but GitHub still says users must review suggestions before accepting and validate them afterward. GitHub Docs — Responsible use of inline suggestions
Copilot Chat and Spaces use contextual information, including curated Spaces context, but responses may still be wrong and not all Space content is used. Keep context selective, current, and coding-focused. GitHub Docs — Responsible use of Copilot Chat
Copilot code review, cloud agent, and CLI are agentic surfaces, so use scoped tasks, permission review, diff inspection, command review, tests, and human-controlled merges. Safeguards such as constrained permissions, a default firewall, automated security analysis, and traceable commits do not remove the need for review. GitHub Docs — Responsible use of Copilot Agents
Check yourself#
Question 1
What is the published Microsoft Learn weighting for Use GitHub Copilot responsibly in GH-300?
A) 5–10%
B) 15–20%
C) 25–30%
D) Microsoft does not publish domain weights
Show answer
Answer: B. The current Microsoft Learn study guide lists Use GitHub Copilot responsibly at 15–20%.
Question 2
Copilot generates authentication code that compiles. What should you do before committing it?
A) Commit it because compiling proves it is safe
B) Ask Copilot whether it is secure
C) Review the logic, test paths, and inspect for vulnerabilities
D) Only check formatting
Show answer
Answer: C. Generated code may compile while still being insecure, wrong, or incomplete.
Question 3
Which statement about public code matching is most accurate?
A) Copilot always blocks public matches
B) Copilot never checks public matches
C) Depending on settings, matches may be blocked or shown with source and license details
D) A code reference means the code is automatically safe
Show answer
Answer: C. Public code behavior is setting-dependent, and developers must still review IP, license, security, and tests.
Question 4
Which responsible AI principle most directly supports reviewing generated UI for keyboard access and screen-reader labels?
A) Inclusiveness
B) Billing transparency
C) Model selection
D) Competitive benchmarking
Show answer
Answer: A. Inclusiveness means AI systems should empower everyone and be accessible.
Question 5
Copilot code review leaves a comment that appears to identify a bug. What is the responsible next step?
A) Apply it without checking
B) Verify whether the issue is real and test any fix
C) Ignore all Copilot review comments
D) Merge if Copilot has no comments
Show answer
Answer: B. Copilot code review can miss issues or produce false positives, so human verification remains required.