Use this bank after you have read the domain pages. The questions are grouped by the six official GH-300 domains so you can practice the exam skills in the same shape you should revise them.
Every answer on this page was re-verified on 26 August 2026. Source questions whose answers changed were rewritten, and questions that no longer matched the current six-domain outline or current GitHub documentation were dropped rather than carried forward.
Microsoft Learn — Study guide for Exam GH-300 · GitHub Docs — GitHub Copilot documentation
How to use this
Answer each question before opening the explanation. If you miss a question because an older fact felt familiar, read the trap note and then revisit the linked domain page.
Domain 1 — Use GitHub Copilot responsibly (15–20%)#
Question 1 · Domain 1
Which responsible AI principle most directly says that a developer remains answerable for code they commit, even if Copilot generated the first draft?
A) Fairness
B) Reliability and safety
C) Accountability
D) Inclusiveness
Show answer
Answer: C. Accountability is the principle that people remain responsible for AI-assisted outcomes. Reliability and safety is tempting because review and tests matter, but it focuses on dependable behavior rather than ownership of the final decision.
Microsoft Learn — Microsoft and GitHub's six principles of responsible AIQuestion 2 · Domain 1
Copilot generates an authentication module, and a developer commits it to production without review because the code compiles. Which principle is most clearly at risk?
A) Reliability and safety
B) Competitive benchmarking
C) Model choice
D) Prompt brevity
Show answer
Answer: A. Reliability and safety requires validating generated output before acting on it. Compilation is a tempting wrong signal because insecure authorization, weak crypto, or missing edge-case handling can still compile.
GitHub Docs — Responsible use of Copilot ChatQuestion 3 · Domain 1
Copilot suggests ranking logic that may disadvantage one group because the examples in the repository are not representative. Which principle should guide the review?
A) Fairness
B) Transparency
C) Availability
D) Cost optimization
Show answer
Answer: A. Fairness addresses discriminatory or biased outcomes. Transparency is tempting because you may document assumptions, but the central risk in the stem is unequal treatment.
Microsoft Learn — Microsoft and GitHub's six principles of responsible AIQuestion 4 · Domain 1
Copilot confidently cites a configuration option that does not exist in the product documentation. What limitation does this illustrate?
A) Code referencing
B) Hallucination
C) Content exclusion
D) Repository indexing
Show answer
Answer: B. A hallucination is plausible-looking output that is unsupported or fabricated. Repository indexing is tempting because it improves context, but it does not guarantee that every generated claim is real.
GitHub Docs — Responsible use of inline suggestionsQuestion 5 · Domain 1
Copilot shows a code reference for a suggestion that resembles public GitHub code. What is the responsible next step?
A) Accept it because a reference means GitHub approved the license
B) Review the referenced source, license details, security, and fit before deciding
C) Delete the whole repository
D) Assume the code is private because it appeared in your IDE
Show answer
Answer: B. Code references are signals for human review, not automatic permission or safety decisions. A is tempting because the product surfaced license information, but the developer still decides whether to keep, rewrite, attribute, or remove the code.
GitHub Docs — Copilot code referencingQuestion 6 · Domain 1
Copilot cloud agent opens a draft pull request for an issue. Which statement best reflects responsible use?
A) The agent can self-approve because it created the branch
B) A human must review the diff, tests, and logs before merge
C) Branch protection is bypassed for Copilot branches
D) The PR is production-ready if the title matches the issue
Show answer
Answer: B. Cloud agent work still requires human review and merge control. A and C are tempting if you think the agent is autonomous end-to-end, but Copilot cannot self-approve or merge and branch protections still apply.
GitHub Docs — Concepts for Copilot cloud agentQuestion 7 · Domain 1
Copilot generates form controls without labels or keyboard-friendly behavior. Which responsible AI principle is most directly implicated?
A) Inclusiveness
B) Tokenization
C) Base model selection
D) Billing accuracy
Show answer
Answer: A. Inclusiveness includes making AI-assisted experiences usable by people with different abilities. Fairness can also matter in user-facing systems, but the stem is specifically about accessibility.
Microsoft Learn — Microsoft and GitHub's six principles of responsible AIQuestion 8 · Domain 1
A developer wants Copilot to create sample rows for a demo database. Which prompt choice is most responsible?
A) Paste last week's customer export and ask Copilot to anonymize it
B) Ask for synthetic data that matches the schema and contains no real company or user data
C) Use production secrets so the sample looks realistic
D) Ask Copilot to infer customer names from issue history
Show answer
Answer: B. Use synthetic data and provide schema, constraints, and edge cases without unnecessary personal or customer data. A is tempting because it says anonymize, but responsible prompting avoids sending sensitive source data in the first place.
GitHub Docs — Responsible use of GitHub Copilot featuresQuestion 9 · Domain 1
Which statement about Copilot safety filters is safest for the exam?
A) Filters remove the need for secure code review
B) Filters can help block harmful, offensive, or off-topic content, but humans still validate outputs
C) Filters only run for inline completions
D) Filters are bypassed whenever a third-party model is used
Show answer
Answer: B. GitHub documents content filtering, but responsible use still requires review, testing, and security checks. A is the tempting wrong answer: filters are safeguards, not a replacement for engineering judgment.
GitHub Docs — Model hostingQuestion 10 · Domain 1
Which action best supports transparency when Copilot helps produce a significant pull request?
A) Hide the AI assistance to avoid extra review
B) Document important assumptions, tests, and AI-assisted areas when appropriate
C) Remove all comments from generated code
D) Use the largest model and skip explanation
Show answer
Answer: B. Transparency is about making important AI-assisted decisions and assumptions understandable to reviewers. A is tempting when teams fear friction, but hiding material context weakens responsible review.
GitHub Docs — Responsible use of Copilot AgentsQuestion 11 · Domain 1
Copilot generates tests with high coverage, but many assertions only repeat the implementation. Who is responsible if a bug ships?
A) GitHub only
B) The model provider only
C) The developer who accepted and committed the tests
D) Nobody, because coverage was high
Show answer
Answer: C. Developers are responsible for reviewing and validating Copilot output, including generated tests. D is tempting because coverage looks objective, but coverage does not prove assertions test the right behavior.
GitHub Docs — Writing tests with GitHub CopilotDomain 2 — Use GitHub Copilot features (25–30%)#
Question 12 · Domain 2
Which Copilot activity is not billed in AI Credits on current paid plans?
A) Code completions and next edit suggestions
B) Every Copilot Chat prompt
C) Agent mode prompts
D) Cloud agent work
Show answer
Answer: A. Code completions and next edit suggestions remain unlimited on paid plans and are not billed in AI Credits. Billable model usage is metered in AI Credits, at $0.01 per credit.
GitHub Docs — Models and pricingQuestion 13 · Domain 2
Which feature is available on all Copilot plans, including Copilot Free?
A) Copilot cloud agent
B) Content exclusions
C) Agent mode in the IDE
D) Organization-wide policy management
Show answer
Answer: C. Agent mode is available on all plans, including Free. Copilot cloud agent is tempting because the names sound similar, but cloud agent is not available on Free.
GitHub Docs — Plans for GitHub CopilotQuestion 14 · Domain 2
Which individual Copilot plan exists in the current plan table and sits above Pro+?
A) Copilot Team
B) Copilot Max
C) Copilot Ultra
D) Copilot Enterprise Personal
Show answer
Answer: B. Copilot Max is the current higher individual tier. Pro+ is tempting if you studied older plan lists, but the current plan table also includes Max.
GitHub Docs — Plans for GitHub CopilotQuestion 15 · Domain 2
Which statement about Copilot Free is verified in the current study facts?
A) It has unlimited cloud agent sessions
B) It includes 2,000 code completions per month and an allowance of AI Credits
C) It includes Business content exclusions
D) It uses the same organization policy controls as Enterprise
Show answer
Answer: B. Copilot Free includes 2,000 code completions per month and a published statement that it has an AI Credits allowance, without a verified exact credit amount. A is tempting because agent mode is free, but cloud agent is not.
GitHub Docs — Plans for GitHub CopilotQuestion 16 · Domain 2
You want Copilot to research a multi-file change and produce a plan before modifying code. Which chat mode best fits?
A) Ask
B) Plan
C) Agent
D) Review
Show answer
Answer: B. Plan mode uses read-only tools to investigate and produce a plan for your approval before any implementation. The three chat modes are Ask, Plan and Agent.
GitHub Docs — Asking GitHub Copilot questions in your IDEQuestion 17 · Domain 2
What is the clearest difference between IDE agent mode and Copilot cloud agent?
A) IDE agent mode is interactive in your editor; cloud agent works on GitHub and opens a pull request for review
B) They are the same feature with two names
C) Cloud agent runs only inside VS Code
D) IDE agent mode can merge pull requests by itself
Show answer
Answer: A. IDE agent mode works in the local editor session, while cloud agent runs delegated work on GitHub and produces a branch and draft PR. B is tempting because both are agentic, but their surfaces and control flow differ.
GitHub Docs — Concepts for Copilot cloud agentQuestion 18 · Domain 2
Which installation command is documented for installing GitHub Copilot CLI with npm?
A) npm install -g @github/copilot
B) npm install -g gh-copilot-extension
C) pip install github-copilot-cli
D) git clone github.com/copilot/cli
Show answer
Answer: A. GitHub documents installing the Copilot CLI with `npm install -g @github/copilot` when using Node.js 22 or later. B is tempting if you remember older terminal extensions, but it is not the current Copilot CLI package.
GitHub Docs — Getting started with Copilot CLIQuestion 19 · Domain 2
Which Copilot CLI command inventories plugins, MCP servers, skills, instruction sources, and language servers discovered for the current directory?
A) copilot plugins list
B) copilot audit
C) copilot explain
D) copilot doctor --all
Show answer
Answer: A. `copilot plugins list` lists discovered plugins and context-extension sources. C is tempting for people who studied older terminal helpers, but it is not the current command for inventorying this configuration.
GitHub Docs — Copilot CLI command referenceQuestion 20 · Domain 2
Which CLI practice best limits risk when Copilot asks to run terminal commands?
A) Allow every shell command for all future sessions
B) Use scoped allow and deny rules, and reset allowed tools when needed
C) Disable Git entirely in the repository
D) Let Copilot run destructive commands because it can recover
Show answer
Answer: B. The CLI supports tool approvals, allow and deny patterns, and resetting allowed tools. A is tempting for convenience, but least-privilege tool control is safer.
GitHub Docs — Copilot CLI best practicesQuestion 21 · Domain 2
Which description best matches current Copilot extensibility?
A) MCP servers, custom agents, agent skills, and third-party coding agents
B) Only browser extensions
C) One hard-coded GitHub API tool
D) A retired Skillset/Agent/Action taxonomy
Show answer
Answer: A. Copilot extensibility is built on MCP servers, custom agents, agent skills, and third-party coding agents.
GitHub Docs — About MCPQuestion 22 · Domain 2
In a repository-shared VS Code MCP configuration, which top-level JSON key should define MCP servers?
A) servers
B) mcp.servers
C) tools
D) actions
Show answer
Answer: A. The shared `.vscode/mcp.json` file uses a top-level `servers` object. B is tempting because it looks like a settings key, but it is not the documented shared repository file shape.
GitHub Docs — Extending Copilot Chat with MCP serversQuestion 23 · Domain 2
Where can an organization-scoped custom agent be stored for Copilot?
A) In an `/agents/NAME.md` file in the organization's `.github` or `.github-private` repository
B) In every user's local Downloads folder
C) In `.vscode/tasks.json`
D) Only in the repository that will run the task
Show answer
Answer: A. Organization agents use `/agents/NAME.md` in the designated organization repository. D is tempting because repository agents exist too, but it is not the organization-scoped location.
GitHub Docs — About custom agentsQuestion 24 · Domain 2
Which path is valid for repository-level agent skills?
A) .github/skills/
B) .github/actions/copilot/
C) .copilot/extensions/
D) .vscode/prompts/
Show answer
Answer: A. Agent skills can live under `.github/skills/` for a repository, with user skills under `~/.copilot/skills/`. C is tempting if you think of old extension folders, but it is not the documented agent-skills path.
GitHub Docs — About custom agentsQuestion 25 · Domain 2
What is true about subagents in Copilot Chat?
A) They have separate context windows and cannot create more subagents
B) They replace branch protection rules
C) They always use a different model from the main session
D) They can merge pull requests without approval
Show answer
Answer: A. Subagents are isolated agents with their own context window, and they cannot spawn additional subagents. C is tempting, but GitHub documents that subagents use the same tools and model as the main session.
GitHub Docs — Asking GitHub Copilot questions in your IDEQuestion 26 · Domain 2
Which setting can automatically request Copilot code review for pull requests in a repository?
A) Repository branch rulesets
B) A local editor theme
C) A Markdown checklist in the PR body
D) The public-code matching filter
Show answer
Answer: A. Repository rulesets can request Copilot review automatically and can also review new pushes or draft pull requests depending on configuration. C is tempting as a team habit, but it does not automatically request Copilot review.
GitHub Docs — Configuring automatic code reviewQuestion 27 · Domain 2
What can Copilot Spaces include as curated context?
A) Repositories, code, pull requests, issues, notes, images, and file uploads
B) Only a single README file
C) Only terminal history
D) Only files generated by Copilot cloud agent
Show answer
Answer: A. Spaces can gather several types of context for Chat. B is tempting if you think of Spaces as a document folder, but GitHub documents repositories, code, PRs, issues, notes, images, and uploads.
GitHub Docs — About Copilot SpacesQuestion 28 · Domain 2
Which statement about GitHub Spark is current for 26 August 2026?
A) It stopped accepting new users and new apps beginning 4 August 2026, while existing users can continue accessing apps they already created
B) It is required for every Copilot agent session
C) It is the same thing as Copilot Spaces
D) It is an enterprise content-exclusion feature
Show answer
Answer: A. Spark is a natural-language app-building and deployment experience, but GitHub says it stopped accepting new users and apps on 4 August 2026. C is tempting because both are Copilot features, but Spaces organize Chat context rather than build and deploy apps.
GitHub Docs — About GitHub SparkQuestion 29 · Domain 2
Which REST API area manages Copilot Business or Enterprise seat assignments for an organization?
A) Copilot user management endpoints
B) Git blobs endpoints
C) Dependabot alerts endpoints
D) Markdown rendering endpoints
Show answer
Answer: A. The Copilot user management API includes endpoints for subscription information and seat assignments. B is tempting because Copilot works with code, but blob endpoints do not manage Copilot seats.
GitHub Docs — REST API endpoints for Copilot user managementDomain 3 — Understand GitHub Copilot data and architecture (10–15%)#
Question 30 · Domain 3
When Copilot prepares an inline suggestion, which statement best describes context handling?
A) The model reads every file from disk directly
B) The client and Copilot service package selected context into a prompt
C) Public repositories receive your private files first
D) Context windows are unlimited
Show answer
Answer: B. Copilot gathers and packages selected context such as nearby code and relevant open files. A is tempting because suggestions can feel repository-aware, but the model does not directly read the whole disk.
GitHub Docs — Inline suggestions responsible useQuestion 31 · Domain 3
Why can useful repository context still be omitted from a Copilot request?
A) The prompt must fit within the model context window, so context may be ranked, trimmed, or summarized
B) Copilot is prohibited from using open files
C) Tokens are the same as lines of code
D) Chat history is never considered
Show answer
Answer: A. Context windows limit how much input can be sent, so Copilot must select and trim context. B is tempting if you overcorrect on privacy, but open and relevant files can be part of context when allowed.
GitHub Docs — Prompt engineeringQuestion 32 · Domain 3
An organization uses a third-party model through BYOK. What remains true about GitHub Copilot processing?
A) Responses still pass through GitHub Copilot safety systems such as content filtering
B) All filtering is disabled by default
C) The third-party provider becomes the only policy engine
D) Public-code safeguards are impossible
Show answer
Answer: A. GitHub documents that prompts and outputs continue through Copilot systems and filters even when models are hosted by different providers. B is tempting for BYOK, but BYOK changes model access, not the existence of Copilot safeguards.
GitHub Docs — Model hostingQuestion 33 · Domain 3
What code base does Copilot code referencing compare potential matches against?
A) An index of public repositories on GitHub.com, not private repositories or non-GitHub code
B) Every private repository in the enterprise
C) The developer's local file system
D) Only packages installed by npm
Show answer
Answer: A. Code referencing compares suggestions and surrounding context against public GitHub repositories. B is tempting for enterprise users, but private repositories are not part of the public-code search index.
GitHub Docs — Copilot code referencingQuestion 34 · Domain 3
Which data-handling statement is correct for Copilot Business and Copilot Enterprise?
A) Customer code is never used to train models, and code snippets are not retained after a suggestion is returned
B) Customer code is used for training unless every developer opts out
C) Snippets are retained indefinitely for model improvement
D) Only public repositories receive data protections
Show answer
Answer: A. Business and Enterprise customer code is not used for training, and snippets are not retained after suggestion. B is tempting because individual plans have user-level training settings, but the Business and Enterprise rule is different.
GitHub Copilot Trust CenterQuestion 35 · Domain 3
Which statement about model hosting is most accurate?
A) Copilot can route to models from multiple providers, while GitHub Copilot service and filters remain in the path
B) All models run locally inside the IDE
C) Copilot only ever uses one model provider
D) BYOK means prompts stop passing through Copilot service controls
Show answer
Answer: A. GitHub documents different hosting paths for OpenAI, Anthropic, Google, xAI, Microsoft, Kimi, and other model families, with Copilot systems still mediating. B is tempting if you assume privacy means local inference, but Copilot suggestions are service-backed.
GitHub Docs — Model hostingQuestion 36 · Domain 3
What can auto model selection consider when routing a Copilot request?
A) System health, task complexity, model policies, subscription type, data residency, and compliance restrictions
B) Only alphabetical model order
C) Only the file extension
D) Only the user's keyboard shortcut
Show answer
Answer: A. Auto model selection is a routing system that considers availability, task complexity, policies, subscription, and compliance factors. C is tempting because language matters, but routing is broader than file extension.
GitHub Docs — Auto model selectionQuestion 37 · Domain 3
For Copilot Business and Enterprise, what does a newly designated base model change imply?
A) It can be automatically enabled after an administrator window, while an LTS model remains supported for a defined period
B) It immediately deletes all other models
C) It disables organization policy controls
D) It applies only to Copilot Free
Show answer
Answer: A. Business and Enterprise admins get a window before a base model is automatically enabled, and LTS models provide a stable supported target. B is tempting if you treat “base” as exclusive, but organizations can still manage model access through policy.
GitHub Docs — Base and LTS modelsDomain 4 — Apply prompt engineering and context crafting (10–15%)#
Question 38 · Domain 4
For a complex coding task, which prompting approach matches GitHub's guidance?
A) Start with the broad goal, then add specific requirements, constraints, and examples
B) Put every possible requirement in one unstructured paragraph
C) Avoid mentioning files so Copilot can guess freely
D) Ask only “fix this”
Show answer
Answer: A. GitHub recommends starting general, getting specific, giving examples, breaking complex tasks down, and iterating. D is tempting because it is fast, but it gives Copilot almost no task or context signal.
GitHub Docs — Prompt engineeringQuestion 39 · Domain 4
You need Copilot to format API errors exactly like one provided example. Which technique is best described?
A) One-shot prompting
B) Content exclusion
C) Model hosting
D) Audit logging
Show answer
Answer: A. One-shot prompting gives one example to clarify the desired output shape. Few-shot prompting is tempting if examples help, but the stem specifies exactly one example.
GitHub Docs — Prompt engineering: Give examplesQuestion 40 · Domain 4
Which item can serve as an example for Copilot when behavior is subtle?
A) Unit tests that show inputs and expected outputs
B) An unrelated screenshot
C) A billing policy with no code context
D) A stale chat thread about another feature
Show answer
Answer: A. GitHub says examples of inputs and outputs, including tests, can guide Copilot toward the intended behavior. D is tempting because chat history is context, but irrelevant history can mislead the model.
GitHub Docs — Prompt engineering: Give examplesQuestion 41 · Domain 4
How can a developer improve Copilot's context before asking about a specific bug in the IDE?
A) Open the relevant files, select the failing code, and close unrelated files
B) Leave every repository file open
C) Remove all comments and type information
D) Ask a vague question in a long stale thread
Show answer
Answer: A. GitHub recommends indicating relevant code and keeping context focused. B is tempting if you think more context is always better, but irrelevant context can crowd out useful signals.
GitHub Docs — Prompt engineering: Indicate relevant codeQuestion 42 · Domain 4
Which VS Code chat variable is most appropriate when you want Copilot to focus on the highlighted code?
A) #selection
B) #billing
C) @team
D) #all-files
Show answer
Answer: A. `#selection` supplies the selected code as explicit context. D is tempting as a whole-project idea, but it is not a current VS Code chat variable.
GitHub Docs — Copilot Chat cheat sheet for VS CodeQuestion 43 · Domain 4
Which custom instruction has the highest precedence when multiple instruction sources apply?
A) Personal instructions
B) Organization instructions
C) Repository-wide `.github/copilot-instructions.md`
D) `AGENTS.md`
Show answer
Answer: A. The verified precedence starts with personal instructions, then path-specific repository instructions, then repository-wide instructions, then agent files, then organization instructions. B is tempting because organization rules sound broad, but breadth is not the same as precedence.
GitHub Docs — Customizing responses: Precedence of custom instructionsQuestion 44 · Domain 4
What does the `applyTo` front matter in `.github/instructions/NAME.instructions.md` do?
A) Scopes path-specific instructions to matching files
B) Adds a Copilot billing budget
C) Creates a repository content exclusion
D) Forces Copilot to approve pull requests
Show answer
Answer: A. Path-specific instruction files use `applyTo` globs to target guidance to matching paths. C is tempting because both involve paths, but content exclusions are separate privacy controls.
GitHub Docs — Adding repository custom instructionsQuestion 45 · Domain 4
A team repeatedly asks for the same security-review checklist only when they choose to run that task. Which customization fits best?
A) A prompt file in `.github/prompts/*.prompt.md`
B) An enterprise billing endpoint
C) A content-exclusion pattern
D) A required approving review from Copilot
Show answer
Answer: A. Prompt files are reusable task prompts invoked manually, unlike custom instructions that apply automatically within their scope. C is tempting because it is also repository configuration, but exclusions remove content from Copilot rather than defining reusable prompts.
GitHub Docs — Customization cheat sheetDomain 5 — Improve developer productivity with GitHub Copilot (10–15%)#
Question 46 · Domain 5
Which Copilot surface is usually best for completing a small function body while you are already typing in the editor?
A) Inline suggestions
B) Organization audit logs
C) Content exclusion settings
D) REST subscription management
Show answer
Answer: A. Inline suggestions are designed for low-friction code completion in the editor. Chat is tempting for every Copilot task, but small local completions are often faster as inline suggestions.
GitHub Docs — Best practices for using GitHub CopilotQuestion 47 · Domain 5
Which refactoring prompt is safest?
A) Refactor this however you want
B) Refactor `shippingCost` using guard clauses, preserve return values and error behavior, and list tests to run
C) Rewrite the module and skip tests
D) Optimize for fewer lines only
Show answer
Answer: B. A safe refactoring prompt states the target, constraints, and validation. D is tempting because concise code looks cleaner, but shorter code is not a guarantee of unchanged behavior.
GitHub Docs — Improving code readability and maintainabilityQuestion 48 · Domain 5
Copilot drafts documentation for a legacy billing service. What must the developer do before publishing it?
A) Verify the description against the code, requirements, and team decisions
B) Publish it unchanged because documentation cannot break code
C) Remove all caveats to make it shorter
D) Treat the generated text as an authoritative source
Show answer
Answer: A. Copilot can accelerate documentation, but it can invent behavior or miss undocumented reality. B is tempting because docs do not compile, but inaccurate documentation can still harm users and maintainers.
GitHub Docs — Documenting legacy codeQuestion 49 · Domain 5
What is the best way to use Copilot for seed data in a demo?
A) Provide schema and constraints, then ask for synthetic rows with edge cases and no real personal data
B) Paste production customer records for realism
C) Ask Copilot to scrape names from public issues
D) Reuse secrets from staging
Show answer
Answer: A. Copilot is useful for synthetic examples when the prompt includes schema, constraints, and edge cases. B is tempting because real data looks representative, but responsible productivity avoids unnecessary sensitive data.
GitHub Docs — Best practices for using GitHub CopilotQuestion 50 · Domain 5
A function sends a notification after a successful deposit. Which test type best verifies the collaboration with the notification dependency?
A) An integration-style test with a mock notification system and call assertions
B) A test that only imports the class
C) A screenshot test of the editor
D) A test that asserts the function output equals another call to itself
Show answer
Answer: A. Integration-style tests verify collaboration between components, such as whether a dependency was called. D is tempting as a quick assertion, but it is tautological and can pass even when business behavior is wrong.
GitHub Docs — Writing tests with GitHub CopilotQuestion 51 · Domain 5
Which prompt best uses Copilot to improve test coverage for risky behavior?
A) List edge cases by input validation, state, external dependency, security, and performance, then suggest tests
B) Make tests
C) Increase coverage number only
D) Delete failing cases
Show answer
Answer: A. Asking for categorized edge cases helps turn vague coverage goals into meaningful assertions. C is tempting because coverage is measurable, but a higher percentage can still miss critical behavior.
GitHub Docs — Writing tests with GitHub CopilotQuestion 52 · Domain 5
Copilot identifies a possible XSS issue and suggests a safer change. What should happen next?
A) Verify the fix, add or update tests, and use normal security tooling such as code scanning
B) Disable code scanning because Copilot already reviewed the code
C) Commit immediately because Copilot found the issue
D) Ask Copilot to mark the PR as approved
Show answer
Answer: A. Copilot can suggest security improvements, but GitHub says not to rely on Copilot as comprehensive security analysis. C is tempting because the suggestion may be right, but security fixes still need verification.
GitHub Docs — Finding existing vulnerabilities in codeQuestion 53 · Domain 5
Which performance-improvement prompt is most useful?
A) Make this faster, preserve behavior, explain complexity before and after, and suggest benchmarks
B) Make it clever
C) Remove tests to speed up CI
D) Use any algorithm even if output changes
Show answer
Answer: A. A good optimization prompt asks for measurable complexity and benchmarks while preserving behavior. B is tempting because it sounds productive, but it gives no correctness or measurement criteria.
GitHub Docs — Refactoring for performance optimizationDomain 6 — Configure privacy, content exclusions, and safeguards (10–15%)#
Question 54 · Domain 6
In a content exclusion pattern, what does a leading slash such as `/scripts/**` mean?
A) The pattern is anchored at the repository root
B) The pattern applies only to GitHub Actions logs
C) The pattern is a regular expression delimiter
D) The file will be encrypted
Show answer
Answer: A. A leading slash anchors the pattern at the repository root. C is tempting because slashes appear in regex examples, but Copilot content exclusions use path pattern matching, not arbitrary regular expressions.
GitHub Docs — Excluding content from GitHub CopilotQuestion 55 · Domain 6
Which Copilot surfaces do not support content exclusions? Select TWO.
A) Copilot CLI
B) Agent mode in Copilot Chat in IDEs
C) Inline suggestions in VS Code
D) Copilot code review
Show answer
Answer: A and B. GitHub documents that content exclusions are not supported by Copilot CLI or IDE Agent mode. C and D are tempting because they are Copilot surfaces, but they are listed as supported for exclusions in the documented support table.
GitHub Docs — Content exclusion for GitHub CopilotQuestion 56 · Domain 6
An organization owner configures Copilot content exclusions. Who do those organization rules apply to?
A) Users assigned a Copilot seat by that organization
B) Every GitHub user who can see a public repository
C) Only repository administrators
D) Only users with personal Pro plans
Show answer
Answer: A. Organization exclusions apply to users assigned a Copilot seat through that organization. B is tempting because organization repositories can be visible more broadly, but Copilot policy follows the seated users under that organization.
GitHub Docs — Excluding content from GitHub CopilotQuestion 57 · Domain 6
A user has Copilot seats from two organizations with conflicting public-code matching policies. Which conflict rule is documented for that setting?
A) The most restrictive setting applies
B) The least restrictive setting always applies
C) The newest setting by timestamp applies
D) The user chooses in the IDE
Show answer
Answer: A. GitHub documents suggestions-matching-public-code as a most-restrictive policy conflict. B is tempting because some Copilot policies can use least-restrictive behavior, but this privacy-related setting is different.
GitHub Docs — Feature availability when policies conflictQuestion 58 · Domain 6
How are local editor Copilot settings different from content exclusions?
A) Editor settings can enable or disable suggestions locally; content exclusions define privacy boundaries for selected content
B) Editor settings create enterprise exclusions
C) Content exclusions only change the editor theme
D) They are identical controls with different names
Show answer
Answer: A. Editor settings control local suggestion behavior, while content exclusions stop selected files from being used by supported Copilot features. B is tempting because both affect suggestions, but only exclusions are the privacy control.
GitHub Docs — Configuring GitHub Copilot in your environmentQuestion 59 · Domain 6
For current Copilot subscriptions, which terms page is the safest place to cite for ownership of Inputs and Outputs?
A) GitHub Generative AI Services Terms
B) A random marketplace listing
C) A repository README generated by Copilot
D) A legacy-only summary with no date context
Show answer
Answer: A. Current IP and ownership answers should cite the GitHub Generative AI Services Terms for applicable current subscriptions. D is tempting if you studied older terms, but pre-March-2026 material must not be flattened into the current answer.
GitHub Generative AI Services TermsQuestion 60 · Domain 6
Which audit-log query pattern is appropriate when reviewing Copilot-related events for an organization?
A) Use the audit log with a phrase such as `action:copilot`
B) Search local browser history for prompt text
C) Query Git blobs for every completion
D) Check DNS logs for model names
Show answer
Answer: A. GitHub documents Copilot audit-log review and the `action:copilot` phrase pattern. B is tempting if you want prompt visibility, but audit logs are for recorded GitHub events, not local prompt transcripts.
GitHub Docs — Reviewing audit logs for GitHub CopilotQuestion 61 · Domain 6
Which statement about BYOK in Copilot administration is most accurate?
A) It lets an organization or enterprise connect Copilot to LLM API keys; it is model governance, not content exclusion
B) It means Bring Your Own encryption Key for repository files
C) It automatically hides files from Copilot CLI
D) It is only a personal setting for Copilot Free
Show answer
Answer: A. BYOK means Bring Your Own LLM API Key and is configured at organization or enterprise level for custom models. B is tempting because BYOK often means encryption keys elsewhere, but in Copilot it refers to LLM API keys.
GitHub Docs — Enabling custom models for an organization