GH-300 — GitHub Certified: GitHub Copilot

Full question text, answer options, and explanations for this practice set — a spoiler-free alternative is the interactive quiz above for scored, shuffled practice.

1. 1. A developer asks GitHub Copilot to generate a function that processes payment card data. Which responsible AI principle requires the developer to review the output before shipping it to production?

   • A. Human oversight — AI output must be validated by a human before use in critical systems(correct)
   • B. Cost efficiency — reviewing saves compute tokens on future requests
   • C. Copilot Enterprise policy — only Enterprise subscribers must review output
   • D. GitHub Terms of Service — all AI-generated code must pass the marketplace review

   Explanation: Responsible AI principles require human oversight of AI-generated content, especially in critical or sensitive domains like payment processing. Copilot can make mistakes, introduce security flaws, or reproduce patterns that are subtly incorrect. Validating output before shipping is a core mitigation strategy. Cost efficiency (B) and marketplace review (D) are not responsible AI principles, and the review requirement applies to all plans, not just Enterprise (C).

2. 2. Which of the following best describes a potential harm of using GitHub Copilot without appropriate safeguards?

   • A. Copilot always refuses to generate code in strongly-typed languages
   • B. Copilot may reproduce code patterns that resemble public training data, creating potential intellectual property concerns(correct)
   • C. Copilot permanently stores all accepted suggestions in the GitHub repository
   • D. Copilot disables syntax highlighting in the IDE when active

   Explanation: One documented limitation and potential harm of generative AI coding tools is that they may reproduce code patterns from training data, raising intellectual property and licensing concerns. GitHub mitigates this with duplication detection filters, but users should still review suggestions critically. Options A, C, and D describe behaviors that Copilot does not exhibit.

3. 3. A team lead wants to ensure developers in their organization use GitHub Copilot ethically and responsibly. Which combination of actions directly supports this goal?

   • A. Enable Copilot for all repos, disable code review, and trust Copilot suggestions without review
   • B. Establish a code review process, enable duplication detection, and train developers on AI limitations(correct)
   • C. Upgrade to the Individual plan to unlock ethical safeguards unavailable on the Free tier
   • D. Restrict Copilot to only generating comments and documentation, never functional code

   Explanation: Responsible AI usage involves a combination of process controls (code review), technical safeguards (duplication detection), and education (training developers on AI limitations and biases). Option A removes safeguards entirely. Option C is incorrect — ethical safeguards exist across plans. Option D is an unnecessary and impractical restriction that is not part of Copilot's responsible use framework.

4. 4. A junior developer at a financial services firm notices that Copilot is suggesting SQL queries that concatenate user input directly into query strings. The developer accepts and deploys several of these suggestions without review. What responsible AI principle was violated, and what should have been done?

   • A. Privacy principle violated — the developer should have anonymized the user input before passing it to Copilot
   • B. Human oversight principle violated — the developer should have reviewed the suggestions and identified the SQL injection vulnerability before accepting(correct)
   • C. Fairness principle violated — Copilot should have been trained on more diverse SQL patterns before deployment
   • D. Transparency principle violated — GitHub should have displayed a warning banner that Copilot was active

   Explanation: The scenario describes a failure of human oversight. The developer accepted AI suggestions without reviewing them for security issues — the concatenated SQL represents a classic SQL injection vulnerability. Responsible AI usage requires validation of output, especially for security-sensitive code. The other options (privacy, fairness, transparency) do not directly describe the failure mode in this scenario.

5. 5. Which GitHub Copilot feature allows a developer to describe a desired code change in natural language and have Copilot apply edits across multiple files simultaneously in the IDE?

   • A. Inline suggestions
   • B. Edit Mode(correct)
   • C. GitHub Copilot CLI
   • D. Pull Request summaries

   Explanation: Edit Mode in GitHub Copilot allows developers to describe a change in natural language and have Copilot apply that change across multiple files in the workspace. Inline suggestions (A) autocomplete single lines or blocks as the developer types. GitHub Copilot CLI (C) operates in the terminal, not the editor. Pull Request summaries (D) summarize diffs, not apply edits.

6. 6. A developer wants to use GitHub Copilot directly in the terminal to explain a shell command and then convert it to a script. Which Copilot component should they use?

   • A. Copilot Chat in the IDE sidebar
   • B. GitHub Copilot CLI(correct)
   • C. Agent Mode with a Sub-Agent
   • D. Copilot Spaces

   Explanation: GitHub Copilot CLI is specifically designed for terminal use. It can explain shell commands, suggest commands based on natural language descriptions, and generate scripts — all from the command line. Copilot Chat (A) and Agent Mode (C) operate within the IDE environment. Copilot Spaces (D) is a collaboration feature, not a terminal tool.

7. 7. Which of the following are valid ways to trigger GitHub Copilot in the IDE? Choose 3.

   • A. Inline code completions that appear as ghost text as you type(correct)
   • B. Opening the Copilot Chat panel and typing a natural language question(correct)
   • C. Using the GitHub Copilot CLI `gh copilot explain` command
   • D. Activating Plan Mode to interactively draft a multi-step implementation plan(correct)
   • E. Pushing a commit to trigger a Copilot GitHub Action on the remote repo

   Explanation: Copilot can be triggered inside the IDE via inline suggestions (ghost text), the Chat panel, and Plan Mode (for planning multi-step implementations). The CLI command `gh copilot explain` (C) works in the terminal, not the IDE. Pushing a commit (E) is a GitHub Actions trigger unrelated to IDE-based Copilot features.

8. 8. A GitHub organization administrator wants to prevent Copilot from reading the contents of a folder containing proprietary cryptographic keys. What is the correct mechanism to configure this?

   • A. Add the folder to .gitignore so git does not track it
   • B. Set the folder permissions to read-only at the OS level
   • C. Configure content exclusions in the organization's Copilot settings to exclude the file path or repository(correct)
   • D. Rename the folder to start with an underscore, which Copilot ignores by convention

   Explanation: Content exclusions are a first-class feature in GitHub Copilot that allow organization admins to specify file paths or entire repositories that Copilot should not use as context. This prevents sensitive files from being included in prompts. `.gitignore` (A) affects git tracking, not Copilot. OS-level permissions (B) would affect all users, not just Copilot. Underscore naming conventions (D) have no special meaning in Copilot.

9. 9. An organization is using GitHub Copilot Enterprise. A team wants Copilot's Chat responses to always follow their internal coding standards documentation stored in the repository. Which Copilot feature should they configure to achieve this?

   • A. Create a `.github/copilot-instructions.md` file (instructions file) in the repository(correct)
   • B. Enable Agent Mode and manually paste the coding standards into each chat session
   • C. Upload the coding standards to GitHub Packages and reference it in the Copilot CLI config
   • D. Configure a custom GitHub Action that appends coding standards to every push

   Explanation: GitHub Copilot supports customizable instructions files (e.g., `.github/copilot-instructions.md`) that are automatically included in Copilot Chat context. This allows teams to define coding conventions, naming standards, and preferred patterns that Copilot will follow consistently without manual pasting. Options B, C, and D do not leverage the built-in instructions file mechanism and are cumbersome or unrelated to Copilot Chat context customization.

10. 10. What is the primary purpose of Sub-Agents in GitHub Copilot's Agent Mode?

    • A. To run unit tests in isolated Docker containers automatically
    • B. To delegate specific tasks to specialized agents, optimizing context usage across a complex multi-step workflow(correct)
    • C. To create separate GitHub accounts for each team member's Copilot subscription
    • D. To route Copilot suggestions through a corporate proxy for compliance review

    Explanation: Sub-Agents in Agent Mode allow complex workflows to be broken down and delegated to specialized agents, each handling a portion of the task with focused context. This optimizes token usage and allows Agent Mode to handle larger, multi-step development tasks. Sub-Agents are not about Docker containers (A), GitHub accounts (C), or corporate proxies (D).

11. 11. A GitHub organization admin wants to review all Copilot-related activity — such as when users accept suggestions and which repositories they access — for compliance purposes. Which feature provides this data?

    • A. GitHub Insights dashboard
    • B. Organization audit log events(correct)
    • C. Copilot Chat history in each user's IDE
    • D. Dependabot alerts

    Explanation: The organization audit log captures Copilot-related events such as policy changes, user enablement, and feature usage. Admins can export and analyze these events for compliance and governance. GitHub Insights (A) provides repository metrics, not Copilot event logs. Chat history (C) is local and user-controlled. Dependabot alerts (D) are for dependency vulnerabilities.

12. 12. When a developer types code in their IDE, what does GitHub Copilot include in the prompt sent to the language model?

    • A. Only the current line being typed
    • B. The entire git history of the repository
    • C. Surrounding code context including open files and cursor position, assembled through prompt building(correct)
    • D. A hash of the file name used to look up suggestions in a pre-cached database

    Explanation: GitHub Copilot performs prompt building by assembling context from the current file, nearby code, open files, and other signals — not just the current line. This assembled prompt is sent to the language model for completion. The full git history (B) is not included. Copilot does not use a cached hash lookup (D); it performs real-time inference.

13. 13. What role does the Copilot proxy play in the code suggestion lifecycle?

    • A. It stores all accepted suggestions in a GitHub-managed database for model retraining
    • B. It filters prompts and responses for policy compliance, content safety, and duplication before they reach the developer or the model(correct)
    • C. It routes all traffic through the developer's local machine to prevent cloud transmission
    • D. It converts code suggestions into GitHub Actions workflows automatically

    Explanation: The Copilot proxy sits between the IDE and the language model. It performs pre-processing (filtering prompts for sensitive content) and post-processing (filtering responses for policy compliance, safety, and duplication detection) before suggestions are shown to the developer. It does not store accepted suggestions for retraining (A), does not route through the local machine (C), and has no relationship to Actions (D).

14. 14. Which of the following is a documented limitation of Large Language Models (LLMs) that directly impacts the reliability of GitHub Copilot suggestions?

    • A. LLMs can only process files smaller than 100KB
    • B. LLMs may generate plausible-sounding but factually incorrect or outdated code patterns (hallucinations)(correct)
    • C. LLMs always produce the same output for identical inputs, making them deterministic
    • D. LLMs are unable to process code written in dynamically-typed languages

    Explanation: LLMs can hallucinate — generating syntactically plausible code that uses non-existent APIs, incorrect function signatures, or outdated patterns. This is a well-documented limitation that makes human review essential. LLMs do not have strict file size limits (A). LLMs are non-deterministic with temperature > 0 (C). They can process any programming language, including dynamically-typed ones (D).

15. 15. For GitHub Copilot Business and Enterprise subscribers, how does GitHub handle the code snippets transmitted as part of prompts?

    • A. GitHub retains all prompt snippets for 30 days for model quality improvement
    • B. Code snippets in prompts are not retained beyond the request; they are not used to train GitHub's foundational models(correct)
    • C. Prompt snippets are anonymized and shared with OpenAI for continuous model improvement
    • D. All prompts are stored in the user's GitHub repository as hidden commits

    Explanation: For Copilot Business and Enterprise plans, GitHub does not retain prompt content after the request is completed and does not use that code to train its foundational models. This is a key data protection commitment. Options A, C, and D describe behaviors that contradict GitHub's published data handling policies for these plans.

16. 16. A developer wants Copilot to generate a function that parses a CSV file. They write a detailed comment describing the expected input format, edge cases, and return type before asking Copilot for help. This technique is an example of which prompt engineering best practice?

    • A. Few-shot prompting
    • B. Providing clear context and a detailed prompt structure(correct)
    • C. Zero-shot chain-of-thought prompting
    • D. Model fine-tuning

    Explanation: Providing a detailed, contextual description of the expected behavior — including inputs, edge cases, and outputs — before invoking Copilot is a fundamental prompt crafting best practice. It directly improves suggestion quality by giving the model the information it needs. Few-shot prompting (A) involves providing examples of input/output pairs. Chain-of-thought (C) prompts the model to reason step by step. Model fine-tuning (D) is a training-time activity, not a prompt-time technique.

17. 17. What is the difference between zero-shot and few-shot prompting in the context of GitHub Copilot Chat?

    • A. Zero-shot uses no context files; few-shot requires at least 10 context files open in the IDE
    • B. Zero-shot asks the model to complete a task with no examples; few-shot provides one or more example input-output pairs to guide the model(correct)
    • C. Zero-shot is available only on the Business plan; few-shot is an Enterprise-only feature
    • D. Zero-shot generates one suggestion; few-shot generates multiple alternative suggestions

    Explanation: In prompt engineering, zero-shot prompting gives the model a task description without any examples, relying on the model's pre-trained knowledge. Few-shot prompting includes one or more examples of the desired input-output pattern, guiding the model's response format and style. These are not plan-dependent features (C), not about the number of context files (A), and not about the quantity of suggestions returned (D).

18. 18. A developer uses GitHub Copilot Chat and notices that responses in a long conversation start to drift — Copilot seems to forget the constraints set at the beginning of the session. What is the underlying reason for this behavior?

    • A. Copilot resets its memory every 10 messages to save server resources
    • B. The context window of the LLM is finite; as the conversation grows, older context (including early constraints) may be truncated from the prompt(correct)
    • C. Copilot applies exponential decay to earlier chat messages to prioritize recency
    • D. The developer's internet connection degraded, causing partial prompt transmission

    Explanation: LLMs operate within a finite context window. In a long Copilot Chat session, the accumulated conversation history may exceed what fits in the context window, causing the model to effectively 'forget' constraints or information established early in the session. This is a fundamental LLM architectural limitation, not a deliberate reset (A), a decay algorithm (C), or a network issue (D).

19. 19. Which of the following factors influence how GitHub Copilot determines context for inline code suggestions? Choose 2.

    • A. The current file's content and cursor position(correct)
    • B. Recently open files in the IDE (neighbor files)(correct)
    • C. The developer's GitHub contribution graph
    • D. The organization's billing plan
    • E. The number of stars on the repository

    Explanation: Copilot uses the current file's content and cursor position as the primary context signal, along with nearby open files (neighbor files) to infer patterns, imports, and conventions in use. The developer's contribution graph (C), billing plan (D), and repository star count (E) have no influence on context determination for inline suggestions.

20. 20. A developer is working with a 10-year-old Java codebase that uses deprecated APIs. Which GitHub Copilot use case would most directly help modernize this code?

    • A. Using Copilot to generate new unit tests for the legacy code as-is
    • B. Using Copilot to suggest refactored versions of functions using modern APIs and patterns(correct)
    • C. Using Copilot to auto-deploy the legacy code to a cloud environment
    • D. Using Copilot CLI to push the codebase to a new repository

    Explanation: GitHub Copilot supports legacy code modernization by suggesting refactored versions of functions that use updated APIs and modern patterns. This is a documented productivity use case. Generating tests for unmodified legacy code (A) doesn't modernize the code. Auto-deploy (C) and repository push (D) are not Copilot features.

21. 21. A developer joins a new team and must quickly understand a complex 2,000-line authentication module with no comments. How can GitHub Copilot reduce context-switching and accelerate their understanding?

    • A. Copilot can automatically delete unused code sections, making the file shorter
    • B. The developer can highlight sections and ask Copilot Chat to explain the logic, and can ask Copilot to generate inline documentation(correct)
    • C. Copilot will automatically create a wiki page summarizing the module on push
    • D. Copilot converts all code to pseudocode and emails it to the developer

    Explanation: Using Copilot Chat to explain highlighted code sections and generating inline documentation comments are well-established ways to accelerate onboarding and reduce context switching when learning a new codebase. Options A, C, and D describe capabilities that Copilot does not have.

22. 22. Which of the following is a supported GitHub Copilot use case for improving software quality during testing?

    • A. Automatically running tests in the cloud and reporting results in Copilot Chat
    • B. Generating unit and integration tests, and suggesting assertions and edge cases(correct)
    • C. Creating load test infrastructure on Azure automatically from test descriptions
    • D. Deploying test environments via Copilot's built-in CI/CD pipeline

    Explanation: GitHub Copilot supports test generation, including unit and integration tests, and can suggest assertions and edge case scenarios. This directly improves code quality and coverage. Running cloud tests (A), provisioning infrastructure (C), and CI/CD deployment (D) are not features of GitHub Copilot itself — they belong to other GitHub or Azure tools.

23. 23. A GitHub organization admin wants to prevent Copilot from suggesting code that closely matches publicly available open-source code. Which setting should they enable?

    • A. Enable branch protection rules
    • B. Enable duplication detection (public code filtering)(correct)
    • C. Set repository visibility to Private
    • D. Enable required code review with two approvers

    Explanation: Duplication detection (also called public code filtering) is a GitHub Copilot safeguard that blocks suggestions matching known public code snippets. It reduces the risk of unintentionally reproducing licensed code. Branch protection rules (A) and required code reviews (D) are version control policies unrelated to Copilot suggestions. Private repository visibility (C) controls who can see the repo but does not affect Copilot's suggestion filtering.

24. 24. An organization needs to configure GitHub Copilot to protect sensitive files and ensure compliance. Which two actions directly address this goal? Choose 2.

    • A. Configure content exclusions in organization Copilot settings to exclude paths containing secrets or proprietary algorithms(correct)
    • B. Add all sensitive files to .gitignore to prevent them from being committed
    • C. Enable security warnings so Copilot flags potentially vulnerable code patterns in suggestions(correct)
    • D. Upgrade all developers to GitHub Enterprise Cloud to unlock privacy features
    • E. Archive repositories containing sensitive data to prevent Copilot access

    Explanation: Content exclusions (A) prevent specified file paths from being included in Copilot's context, directly protecting sensitive code. Security warnings (C) actively flag potentially vulnerable code patterns in suggestions, supporting compliance. .gitignore (B) prevents commits but not Copilot reading tracked files. Upgrading plans (D) is not necessary for these specific features. Archiving (E) would prevent access by everyone, not just Copilot.

25. 25. Which statements accurately describe ownership and output limitations of GitHub Copilot suggestions? Choose 2.

    • A. Code suggestions accepted by developers become the intellectual property of GitHub
    • B. GitHub does not claim ownership of code generated by Copilot — the developer is responsible for the output they use(correct)
    • C. Copilot suggestions are guaranteed to be free of open-source license obligations when duplication detection is enabled
    • D. Developers remain responsible for ensuring accepted code does not violate third-party licenses or introduce security vulnerabilities(correct)
    • E. GitHub provides full legal indemnification for all code produced by Copilot

    Explanation: GitHub does not claim ownership of Copilot-generated code — the developer owns what they write and accept. However, developers retain full responsibility for the code they ship, including compliance with licenses and security review. Duplication detection reduces risk but does not guarantee (C) absolute license freedom. GitHub does not provide blanket indemnification (E) for all Copilot output.