Microsoft GH-300 Practice Test 21
Question 200
A developer asks a custom agent to assume dependencies that are not installed. What should the agent validate?
- Require reviewable tool permissions and an explicit production-deploy gate.
- Define file-path-specific instructions for each language area.
- Inspect actual project manifests and dependency versions before coding.
- Configure a focused custom agent and delegate a bounded security review when supported.
Explanation
Correct Answer
C:Persona instructions cannot invent runtime capabilities.
Incorrect Answers
A:Reusable automation remains subject to change-control authorization. What should the agent validate. Persona instructions cannot invent runtime capabilities.
B:Scope prevents irrelevant standards from spilling into unrelated files. Persona instructions cannot invent runtime capabilities.
D:Specialized instructions can improve review consistency without overriding approvals. persona instructions cannot invent runtime capabilities.
Question 201
An enterprise owner wants Copilot Chat enabled but autonomous agent execution restricted. What should they manage?
- Review inherited policy precedence and administrative rights before expecting a local override.
- Pilot the feature with approved users and review data, permissions, and operational effects.
- Configure the organization or enterprise policy controls for each supported Copilot capability.
- Set the supported suggestions-matching-public-code policy at the governing organization level.
Explanation
Correct Answer
C:Feature availability can be governed independently at administrative scope.
Incorrect Answers
A:Higher-scope controls may constrain repository-level settings. What should they manage. Feature availability can be governed independently at administrative scope.
B:A launch toggle is not itself a security approval. feature availability can be governed independently at administrative scope.
D:Central policy reduces inconsistent local settings for managed accounts. feature availability can be governed independently at administrative scope.
Question 202
A member sees a feature greyed out despite having a paid seat. What should they investigate?
- Pilot the feature with approved users and review data, permissions, and operational effects.
- Configure the organization or enterprise policy controls for each supported Copilot capability.
- Check organization feature policies and client eligibility, not just subscription billing.
- Review inherited policy precedence and administrative rights before expecting a local override.
Explanation
Correct Answer
C:Licensing alone does not guarantee every capability is permitted.
Incorrect Answers
A:A launch toggle is not itself a security approval. licensing alone does not guarantee every capability is permitted.
B:Feature availability can be governed independently at administrative scope. Licensing alone does not guarantee every capability is permitted.
D:Higher-scope controls may constrain repository-level settings. What should they investigate. Licensing alone does not guarantee every capability is permitted.
Question 203
A company wants consistent public-code matching policy across members. What control is appropriate?
- Check organization feature policies and client eligibility, not just subscription billing.
- Pilot the feature with approved users and review data, permissions, and operational effects.
- Configure the organization or enterprise policy controls for each supported Copilot capability.
- Set the supported suggestions-matching-public-code policy at the governing organization level.
Explanation
Correct Answer
D:Central policy reduces inconsistent local settings for managed accounts.
Incorrect Answers
A:Licensing alone does not guarantee every capability is permitted. central policy reduces inconsistent local settings for managed accounts.
B:A launch toggle is not itself a security approval. central policy reduces inconsistent local settings for managed accounts.
C:Feature availability can be governed independently at administrative scope. Central policy reduces inconsistent local settings for managed accounts.
Question 204
A repository admin attempts to override a stricter enterprise Copilot rule. What should be checked?
- Set the supported suggestions-matching-public-code policy at the governing organization level.
- Check organization feature policies and client eligibility, not just subscription billing.
- Configure the organization or enterprise policy controls for each supported Copilot capability.
- Review inherited policy precedence and administrative rights before expecting a local override.
Explanation
Correct Answer
D:Higher-scope controls may constrain repository-level settings.
Incorrect Answers
A:Central policy reduces inconsistent local settings for managed accounts. What should be checked. Higher-scope controls may constrain repository-level settings.
B:Licensing alone does not guarantee every capability is permitted. higher-scope controls may constrain repository-level settings.
C:Feature availability can be governed independently at administrative scope. Higher-scope controls may constrain repository-level settings.
Question 205
An org enables a new Copilot feature without a risk assessment. What governance action is needed?
- Check organization feature policies and client eligibility, not just subscription billing.
- Pilot the feature with approved users and review data, permissions, and operational effects.
- Set the supported suggestions-matching-public-code policy at the governing organization level.
- Review inherited policy precedence and administrative rights before expecting a local override.
Explanation
Correct Answer
B:A launch toggle is not itself a security approval.
Incorrect Answers
A:Licensing alone does not guarantee every capability is permitted. a launch toggle is not itself a security approval.
C:Central policy reduces inconsistent local settings for managed accounts. What governance action is needed. A launch toggle is not itself a security approval.
D:Higher-scope controls may constrain repository-level settings. a launch toggle is not itself a security approval.
Question 206
An organization needs to automate reconciliation of assigned Copilot seats. What should it use?
- Use the documented GitHub REST API for Copilot seat or subscription administration with scoped authentication.
- Prefer official GitHub subscription management APIs with versioned contracts.
- Assign a properly scoped organization-authorized token to the documented API operation.
- Confirm ownership and notify affected stakeholders before removing access.
Explanation
Correct Answer
A:Seat APIs can support authorized inventory and billing workflows.
Incorrect Answers
B:A supported API is less fragile than scraping UI markup. Seat APIs can support authorized inventory and billing workflows.
C:REST administration enforces permission scopes independent of request syntax. What should it use. Seat APIs can support authorized inventory and billing workflows.
D:License changes can disrupt normal engineering workflows. seat APIs can support authorized inventory and billing workflows.
Question 207
A seat report shows a user with no recent activity. What should a licensing manager avoid?
- Avoid assuming inactivity proves the user no longer needs a seat without checking policy and workload.
- Use the documented GitHub REST API for Copilot seat or subscription administration with scoped authentication.
- Prefer official GitHub subscription management APIs with versioned contracts.
- Confirm ownership and notify affected stakeholders before removing access.
Explanation
Correct Answer
A:Usage data is a signal, not automatic justification for revocation.
Incorrect Answers
B:Seat APIs can support authorized inventory and billing workflows. usage data is a signal, not automatic justification for revocation.
C:A supported API is less fragile than scraping UI markup. Usage data is a signal, not automatic justification for revocation.
D:License changes can disrupt normal engineering workflows. usage data is a signal, not automatic justification for revocation.
Question 208
An automation script requires organization billing permissions but uses a personal read-only token. What should be corrected?
- Prefer official GitHub subscription management APIs with versioned contracts.
- Avoid assuming inactivity proves the user no longer needs a seat without checking policy and workload.
- Assign a properly scoped organization-authorized token to the documented API operation.
- Use the documented GitHub REST API for Copilot seat or subscription administration with scoped authentication.
Explanation
Correct Answer
C:REST administration enforces permission scopes independent of request syntax.
Incorrect Answers
A:A supported API is less fragile than scraping UI markup. REST administration enforces permission scopes independent of request syntax.
B:Usage data is a signal, not automatic justification for revocation. What should be corrected. REST administration enforces permission scopes independent of request syntax.
D:Seat APIs can support authorized inventory and billing workflows. rEST administration enforces permission scopes independent of request syntax.
Question 209
A license-removal workflow could affect a critical release engineer. What process should precede it?
- Use the documented GitHub REST API for Copilot seat or subscription administration with scoped authentication.
- Assign a properly scoped organization-authorized token to the documented API operation.
- Confirm ownership and notify affected stakeholders before removing access.
- Avoid assuming inactivity proves the user no longer needs a seat without checking policy and workload.
Explanation
Correct Answer
C:License changes can disrupt normal engineering workflows.
Incorrect Answers
A:Seat APIs can support authorized inventory and billing workflows. license changes can disrupt normal engineering workflows.
B:REST administration enforces permission scopes independent of request syntax. license changes can disrupt normal engineering workflows.
D:Usage data is a signal, not automatic justification for revocation. What process should precede it. License changes can disrupt normal engineering workflows.
Question 210
A team uses an undocumented page scrape to assign Copilot seats. What alternative is more stable?
- Avoid assuming inactivity proves the user no longer needs a seat without checking policy and workload.
- Assign a properly scoped organization-authorized token to the documented API operation.
- Prefer official GitHub subscription management APIs with versioned contracts.
- Confirm ownership and notify affected stakeholders before removing access.
Explanation
Correct Answer
C:A supported API is less fragile than scraping UI markup.
Incorrect Answers
A:Usage data is a signal, not automatic justification for revocation. What alternative is more stable. A supported API is less fragile than scraping UI markup.
B:REST administration enforces permission scopes independent of request syntax. a supported API is less fragile than scraping UI markup.
D:License changes can disrupt normal engineering workflows. A supported API is less fragile than scraping UI markup.