Hard — GH-300 Practice Quiz

Question 1

A security lead configures content exclusions in the organization settings to block Copilot from using a directory named 'secrets/' that contains credential files. A developer later asks the security lead whether excluding these files also guarantees that the file names, directory structure, and paths within 'secrets/' are hidden from GitHub's servers and never referenced anywhere. What is the accurate response?

Accepted Answer

Content exclusions prevent Copilot from using the file contents as context or generating suggestions in those files, but they are not a comprehensive data-hiding mechanism and do not guarantee that file paths or repository metadata are never processed.

Answer

Content exclusions fully encrypt and hide the file names, paths, and directory structure from GitHub's servers in addition to blocking the contents.

Answer

Content exclusions only take effect after the excluded files are deleted from the repository, so metadata is removed automatically.

Answer

Content exclusions apply exclusively to the file contents in chat and have no effect on completions, so paths remain fully protected.

Question 2

An organization has configured content exclusions for a repository named 'payments-core' so that Copilot ignores its files inside developers' IDEs. A security lead notices that when browsing that same repository on GitHub.com and using Copilot Chat in the web interface to ask about the excluded files, the assistant still references their contents. The lead asks you to explain this behavior. What is the most accurate explanation?

Accepted Answer

Content exclusions apply to a defined set of Copilot surfaces (such as supported IDEs), and coverage across other surfaces like the GitHub.com web experience may differ, so exclusions are not guaranteed to be enforced everywhere identically.

Answer

Content exclusions only take effect after a 24-hour propagation window, so the web experience will honor them automatically once that period elapses.

Answer

The exclusion rules were misconfigured; a correctly written glob pattern always blocks the files across every Copilot surface including the web UI.

Answer

Content exclusions are enforced only on private repositories, so a public 'payments-core' repository would never be excluded anywhere.

Question 3

A platform team excludes the repository directory /libs/pricing-engine/** using Copilot content exclusions. A developer working in a separate microservice repository writes code that imports and calls a public helper function whose name and signature happen to match one defined in the excluded pricing-engine directory. The developer is surprised when Copilot completions in the microservice still suggest usages referencing that function name. What is the best explanation for this behavior?

Accepted Answer

Content exclusions prevent the excluded files' contents from being used as context, but they do not erase knowledge of a symbol's name if it appears or is typed in a non-excluded file the developer is editing.

Answer

Content exclusions are only enforced for chat, so completions ignore them entirely and can freely read the excluded files.

Answer

The exclusion failed because directory-scoped glob patterns cannot match nested paths, so the pricing-engine files were never actually excluded.

Answer

Copilot retroactively trained on the excluded function, so the exclusion cannot remove what the model already learned from that repository.

Question 4

A backend developer notices that ever since the platform team added a content exclusion rule for the repository's `/config/legacy-secrets/` directory, Copilot completions in a nearby service file feel less accurate. The service file itself is not excluded, but it imports and calls helper functions defined in files under the excluded directory. The developer asks why the suggestions in the allowed file seem to have gotten worse. What is the most accurate explanation?

Accepted Answer

Excluded files cannot be used as context for suggestions in other files, so Copilot loses the surrounding code it would otherwise draw from, which can reduce completion quality in files that depend on the excluded code.

Answer

Content exclusions disable Copilot completions entirely in any file that imports from an excluded path until the import is removed.

Answer

The exclusion rule corrupts Copilot's local index, and the developer must delete and re-clone the repository to restore suggestion quality.

Answer

Content exclusions only affect GitHub.com search results and have no bearing on IDE completion context, so the perceived change must be unrelated.

Question 5

Your organization has configured Copilot content exclusions on a repository named 'payments-core' to block Copilot from using its files as context. A developer creates a personal fork of 'payments-core' into their own GitHub account and clones that fork locally. When they open files from the forked clone in their IDE, they notice Copilot provides inline completions using content from those files. They open a support ticket claiming content exclusions are broken. What is the most accurate explanation of this behavior?

Accepted Answer

Content exclusion rules are tied to the specific repository they are configured on and do not automatically propagate to forks residing under a different owner, so the forked repository is not covered.

Answer

Content exclusions always follow the file contents regardless of repository, so this indicates a misconfiguration in the exclusion YAML that must be fixed.

Answer

Forks inherit all content exclusion settings automatically, so the developer must simply restart the IDE to force the rules to apply.

Answer

Content exclusions are enforced by scanning file hashes, so any file matching the original is blocked even in the fork.

Question 6

A backend engineer notices that GitHub Copilot completions feel slower when working inside a very large monolithic file compared to smaller files. A teammate suggests this is because Copilot is 'sending the whole repository to be analyzed on every keystroke.' Which explanation most accurately describes what actually happens in the code-suggestion lifecycle?

Accepted Answer

The IDE extension assembles a bounded prompt from local context (cursor surroundings, neighboring open files, and relevant snippets), which is truncated to fit the model's context window before being sent through the proxy.

Answer

Copilot uploads the entire repository index to the model server, and larger repos always increase latency proportionally to total lines of code.

Answer

Copilot streams every open file in full to the proxy, where a post-processing filter decides which lines are relevant before forwarding to the model.

Answer

The model persistently caches the full file contents server-side between requests, so latency reflects the size of that stored cache.

Question 7

Your organization has configured content exclusions to prevent Copilot from accessing files under a sensitive `/secrets` directory. A developer on the team uses an older third-party editor with a Copilot plugin that does not yet support content exclusions. During a security review, you must explain what happens when this developer works in that editor. Which statement accurately describes the behavior?

Accepted Answer

The excluded files will still be accessible to Copilot in that editor because content exclusions are only enforced in editors and Copilot features that support the capability.

Answer

Copilot is automatically disabled entirely in any editor that does not support content exclusions, so no files can be accessed.

Answer

The exclusion rules are enforced server-side at the proxy for all clients, so the unsupported editor is fully protected regardless of its capabilities.

Answer

The developer's editor will download the exclusion policy and enforce it locally after a one-time sync, guaranteeing protection.

Question 8

A developer is testing a `serialize(order)` / `deserialize(bytes)` pair for an order object. Example-based unit tests keep passing, but production occasionally corrupts orders with unusual field combinations the developer never thought to write cases for. They want Copilot to help generate tests that catch these unforeseen combinations without hand-authoring each input. Which prompt approach best leverages Copilot for this need?

Accepted Answer

Ask Copilot to generate a property-based test asserting the round-trip invariant that `deserialize(serialize(order))` equals the original order for randomly generated order inputs.

Answer

Ask Copilot to duplicate the existing example tests and change the literal field values slightly in each copy.

Answer

Ask Copilot to add more assertions to a single test using the same hardcoded order object already in the suite.

Answer

Ask Copilot to generate a load test that serializes the same order object thousands of times to measure throughput.

Question 9

A developer selects a legacy `calculateShippingCost` function that has no documentation and asks Copilot Chat with `/tests` to generate a unit test suite. The function contains several conditional branches whose business meaning is unclear (e.g., a discount applied only when `weight > 50 && region == 'INTL'`). Copilot produces tests that pass, but the developer is unsure whether the assertions reflect the *intended* behavior or merely the *current* behavior. What is the most appropriate next step to maximize the value of the generated tests?

Accepted Answer

Verify the intended behavior against requirements or a domain expert, then correct any assertions that merely encode existing (possibly buggy) behavior before committing the tests.

Answer

Accept the generated tests as-is, since passing tests confirm the code is correct and the assertions are trustworthy.

Answer

Delete the ambiguous branches from the function so Copilot can generate simpler tests without unclear logic.

Answer

Ask Copilot to increase the number of test cases until code coverage reaches 100%, which guarantees the assertions are correct.

Question 10

A developer asks Copilot Chat to generate unit tests for a `calculateDiscount(price, tier)` function. Copilot produces tests that all pass, but a subsequent mutation testing run reveals that several mutants (e.g., changing `>=` to `>`, or `*0.9` to `*0.8`) survive because no test fails when the logic is altered. What is the most effective way to use Copilot to address this gap?

Accepted Answer

Prompt Copilot to add assertions that verify exact computed discount values at boundary tiers, so that any change to the comparison operators or multipliers causes a test to fail.

Answer

Ask Copilot to increase the number of test cases with randomly generated prices, since more inputs will eventually catch the surviving mutants.

Answer

Instruct Copilot to wrap each test in a try/catch block so exceptions from mutated code are reported as failures.

Answer

Have Copilot lower the code coverage threshold so the surviving mutants are excluded from the report.

Question 11

A developer on your team uses GitHub Copilot to scaffold a customer eligibility function for a lending application. Copilot generates logic that filters applicants based on ZIP code and a variable named 'neighborhood_risk_score'. The code compiles and passes the existing unit tests. As the reviewer responsible for responsible AI practices, what is the most appropriate action before merging?

Accepted Answer

Review the generated logic for potential discriminatory bias (e.g., proxy variables that could correlate with protected characteristics) and validate it against fairness and legal requirements before merging

Answer

Merge the code, since it passed all unit tests and Copilot suggestions are trained on high-quality public repositories

Answer

Add more Copilot-generated unit tests to increase coverage, then merge once coverage exceeds the team threshold

Answer

Disable Copilot for this repository, since AI tools cannot be used in any regulated domain such as lending

Question 12

A developer maintains a Node.js service that iterates over an array of 500 user IDs and, inside the loop, calls an external REST endpoint once per ID with `await fetch(...)`. The endpoint also exposes a bulk lookup route that accepts up to 100 IDs per request. The developer selects the loop and asks Copilot Chat: "Refactor this to reduce the number of network round trips." What is the most appropriate way to evaluate Copilot's suggested refactor before merging it?

Accepted Answer

Verify that the suggestion chunks the IDs into batches respecting the 100-ID limit and correctly aggregates the responses, then confirm behavior with tests, since Copilot has no guaranteed knowledge of the endpoint's batch constraint.

Answer

Accept the suggestion as-is, because Copilot analyzes the external API's OpenAPI specification and automatically enforces the documented per-request limits.

Answer

Reject any batching refactor and keep the sequential loop, because Copilot cannot safely transform network I/O code and will always introduce race conditions.

Answer

Merge the change immediately if it compiles, since a reduction in the number of `await` statements is sufficient proof that round trips were reduced.

Question 13

A backend developer accepts a GitHub Copilot suggestion for a regular expression that validates user-submitted email addresses in a public-facing web form. The regex works correctly against the developer's sample inputs and is merged. Two weeks later, the service experiences intermittent CPU spikes and request timeouts whenever certain malformed inputs are submitted. What responsible-use practice should the developer have applied before merging the Copilot-suggested regex?

Accepted Answer

Reviewed and tested the suggested regex for performance risks such as catastrophic backtracking, including with adversarial and malformed inputs, rather than relying only on happy-path samples

Answer

Rejected the suggestion outright because Copilot should never be used to generate regular expressions of any kind

Answer

Enabled the Copilot duplication detection filter, which would have blocked the vulnerable pattern automatically

Answer

Added a comment above the regex crediting Copilot as the author to satisfy attribution requirements

Question 14

While building a proprietary product, a developer accepts a large, distinctive block of code that GitHub Copilot suggested. A teammate later notices the block appears nearly identical to a snippet from a well-known open-source project distributed under a copyleft (GPL) license. What is the most responsible way to handle this situation before shipping?

Accepted Answer

Enable Copilot's duplication detection filter and review whether the accepted code matches public code, then verify licensing and replace or properly attribute it as needed.

Answer

Keep the code since Copilot generated it, which automatically means the output is free of any licensing obligations.

Answer

Add a code comment stating the snippet was AI-generated, which removes any obligation to check its origin or license.

Answer

Rename the variables and reformat the block so it no longer looks like the original, then ship it without further review.

Question 15

An enterprise has enabled the public-code matching filter (duplicate detection) for all its Copilot seats. A developer notices that when they ask Copilot Chat to explain a well-known open-source algorithm, the response still reproduces a recognizable code snippet resembling public code, even though inline code completions rarely produce such matches. A compliance officer asks you to explain why the filter did not consistently block this. What is the most accurate explanation?

Accepted Answer

The public-code matching filter is scoped to code-completion suggestions and does not guarantee the same suppression behavior for all Copilot Chat outputs, so chat responses may still surface matching snippets.

Answer

The filter was silently disabled for that user because their IDE was outdated, so no filtering occurred in either surface.

Answer

The filter only blocks snippets that exactly match GPL-licensed repositories, so MIT-style public code is always allowed through.

Answer

Chat outputs are filtered more strictly than completions, so the snippet must have been manually approved by an organization admin.

Question 16

A developer on an Enterprise Cloud plan reports that even after their organization owner enabled the 'Suggestions matching public code' filter to Allow, no matching suggestions appear. The developer confirms their personal Copilot settings also allow matching public code. What is the most likely reason the filter is still blocking these suggestions?

Accepted Answer

A policy set at the enterprise level to Block matching public code overrides the more permissive organization and personal settings.

Answer

The developer must restart their IDE and re-authenticate before the organization's Allow setting propagates to their session.

Answer

Personal account settings always take precedence over organization settings, so the personal 'Allow' should have worked and this is a bug.

Answer

The public code matching filter only applies to Copilot Chat, so completions are unaffected by any of these settings.