Microsoft GH-300 Practice Test 44
Question 430
A Copilot Business administrator needs to exclude a sensitive repository subfolder without blocking the entire source tree. Which TWO steps fit? (Select TWO.)
- Assume the exclusion automatically applies to every MCP tool and agent.
- Test the rule in a client and feature that documents enforcement support.
- Configure a precise supported content-exclusion path pattern through administrative settings.
- Make the entire repository public to simplify policy troubleshooting.
- Put a comment in the confidential file asking Copilot not to read it.
Explanation
Correct Answers
B:A saved path rule is not proof of correct matching and client coverage.
C:Narrow patterns target confidential files without suppressing unrelated code.
Incorrect Answers
A:Documented support excludes some modes and third-party integrations.
D:Publication is unrelated and would expose sensitive code.
E:A source comment is not enforceable administrative policy.
Question 431
A team assumes its content exclusions are enforced in VS Code Agent Mode. What should they verify?
- Check the documented unsupported Agent and Edit mode coverage and restrict tool access separately.
- Account for type and hover metadata that may reveal semantic details indirectly.
- Confirm current exclusion support for remote filesystem repositories before relying on it.
- Review current exclusions limitations for symlinks and enforce filesystem-level denial.
Explanation
Correct Answer
A:GitHub content exclusion is not universally enforced in autonomous editor modes.
Incorrect Answers
B:IDE-derived metadata can disclose structure even when raw file content is excluded. gitHub content exclusion is not universally enforced in autonomous editor modes.
C:Certain remote filesystem scenarios are excluded from the documented protection. GitHub content exclusion is not universally enforced in autonomous editor modes.
D:Content exclusions may not cover symbolic links even if their targets are sensitive. gitHub content exclusion is not universally enforced in autonomous editor modes.
Question 432
A custom MCP server reads a file excluded by GitHub policy. What safeguard is missing?
- Enforce access controls and redaction at the MCP server itself.
- Confirm current exclusion support for remote filesystem repositories before relying on it.
- Account for type and hover metadata that may reveal semantic details indirectly.
- Check the documented unsupported Agent and Edit mode coverage and restrict tool access separately.
Explanation
Correct Answer
A:GitHub's exclusion policy cannot guarantee compliance by external tools.
Incorrect Answers
B:Certain remote filesystem scenarios are excluded from the documented protection. GitHub's exclusion policy cannot guarantee compliance by external tools.
C:IDE-derived metadata can disclose structure even when raw file content is excluded. gitHub's exclusion policy cannot guarantee compliance by external tools.
D:GitHub content exclusion is not universally enforced in autonomous editor modes. What safeguard is missing. GitHub's exclusion policy cannot guarantee compliance by external tools.
Question 433
A repository uses a symbolic link into a secrets directory. What risk should be assessed?
- Enforce access controls and redaction at the MCP server itself.
- Check the documented unsupported Agent and Edit mode coverage and restrict tool access separately.
- Account for type and hover metadata that may reveal semantic details indirectly.
- Review current exclusions limitations for symlinks and enforce filesystem-level denial.
Explanation
Correct Answer
D:Content exclusions may not cover symbolic links even if their targets are sensitive.
Incorrect Answers
A:GitHub's exclusion policy cannot guarantee compliance by external tools. content exclusions may not cover symbolic links even if their targets are sensitive.
B:GitHub content exclusion is not universally enforced in autonomous editor modes. What risk should be assessed. Content exclusions may not cover symbolic links even if their targets are sensitive.
C:IDE-derived metadata can disclose structure even when raw file content is excluded. content exclusions may not cover symbolic links even if their targets are sensitive.
Question 434
A team works from a remote filesystem mounted in the IDE. What should they verify?
- Check the documented unsupported Agent and Edit mode coverage and restrict tool access separately.
- Enforce access controls and redaction at the MCP server itself.
- Review current exclusions limitations for symlinks and enforce filesystem-level denial.
- Confirm current exclusion support for remote filesystem repositories before relying on it.
Explanation
Correct Answer
D:Certain remote filesystem scenarios are excluded from the documented protection.
Incorrect Answers
A:GitHub content exclusion is not universally enforced in autonomous editor modes. What should they verify. Certain remote filesystem scenarios are excluded from the documented protection.
B:GitHub's exclusion policy cannot guarantee compliance by external tools. certain remote filesystem scenarios are excluded from the documented protection.
C:Content exclusions may not cover symbolic links even if their targets are sensitive. Certain remote filesystem scenarios are excluded from the documented protection.
Question 435
A developer assumes an exclusion stops all indirect knowledge of a forbidden class. What limitation matters?
- Review current exclusions limitations for symlinks and enforce filesystem-level denial.
- Account for type and hover metadata that may reveal semantic details indirectly.
- Confirm current exclusion support for remote filesystem repositories before relying on it.
- Enforce access controls and redaction at the MCP server itself.
Explanation
Correct Answer
B:IDE-derived metadata can disclose structure even when raw file content is excluded.
Incorrect Answers
A:Content exclusions may not cover symbolic links even if their targets are sensitive. IDE-derived metadata can disclose structure even when raw file content is excluded.
C:Certain remote filesystem scenarios are excluded from the documented protection. iDE-derived metadata can disclose structure even when raw file content is excluded.
D:GitHub's exclusion policy cannot guarantee compliance by external tools. iDE-derived metadata can disclose structure even when raw file content is excluded.
Question 436
A managed company wants a privacy review before enabling Copilot agents. What should it inventory?
- Audit agent filesystem permissions and connector scopes in addition to Copilot policy.
- Check the current data-handling contract for the exact plan, product, and feature.
- Review output storage, sharing, and deployment policies separately from repository visibility.
- Assess data categories, allowed tools, scopes, and plan-specific processing rules.
Explanation
Correct Answer
D:Privacy posture depends on actual enabled capabilities and permissions.
Incorrect Answers
A:Runtime access can be broader than conversational content filtering. What should it inventory. Privacy posture depends on actual enabled capabilities and permissions.
B:Different surfaces and plans may have different session and retention rules. Privacy posture depends on actual enabled capabilities and permissions.
C:Private input access does not automatically control later sharing of generated artifacts. privacy posture depends on actual enabled capabilities and permissions.
Question 437
An employee wants an exception to share a production secret with an AI assistant. What should the privacy owner recommend?
- Use redacted examples and approved secret-access mechanisms instead of pasting credentials.
- Audit agent filesystem permissions and connector scopes in addition to Copilot policy.
- Review output storage, sharing, and deployment policies separately from repository visibility.
- Assess data categories, allowed tools, scopes, and plan-specific processing rules.
Explanation
Correct Answer
A:Least disclosure reduces risk without blocking debugging.
Incorrect Answers
B:Runtime access can be broader than conversational content filtering. What should the privacy owner recommend. Least disclosure reduces risk without blocking debugging.
C:Private input access does not automatically control later sharing of generated artifacts. least disclosure reduces risk without blocking debugging.
D:Privacy posture depends on actual enabled capabilities and permissions. least disclosure reduces risk without blocking debugging.
Question 438
A compliance officer assumes all Copilot conversations have a single fixed retention period. What should be done?
- Use redacted examples and approved secret-access mechanisms instead of pasting credentials.
- Assess data categories, allowed tools, scopes, and plan-specific processing rules.
- Check the current data-handling contract for the exact plan, product, and feature.
- Audit agent filesystem permissions and connector scopes in addition to Copilot policy.
Explanation
Correct Answer
C:Different surfaces and plans may have different session and retention rules.
Incorrect Answers
A:Least disclosure reduces risk without blocking debugging. Different surfaces and plans may have different session and retention rules.
B:Privacy posture depends on actual enabled capabilities and permissions. different surfaces and plans may have different session and retention rules.
D:Runtime access can be broader than conversational content filtering. What should be done. Different surfaces and plans may have different session and retention rules.
Question 439
A team enables a private repository for Copilot and concludes all generated outputs must stay private forever. What must be checked?
- Check the current data-handling contract for the exact plan, product, and feature.
- Use redacted examples and approved secret-access mechanisms instead of pasting credentials.
- Review output storage, sharing, and deployment policies separately from repository visibility.
- Assess data categories, allowed tools, scopes, and plan-specific processing rules.
Explanation
Correct Answer
C:Private input access does not automatically control later sharing of generated artifacts.
Incorrect Answers
A:Different surfaces and plans may have different session and retention rules. private input access does not automatically control later sharing of generated artifacts.
B:Least disclosure reduces risk without blocking debugging. Private input access does not automatically control later sharing of generated artifacts.
D:Privacy posture depends on actual enabled capabilities and permissions. private input access does not automatically control later sharing of generated artifacts.
Question 440
An administrator wants to review which tools can read a project's confidential directories. What should be inspected?
- Check the current data-handling contract for the exact plan, product, and feature.
- Review output storage, sharing, and deployment policies separately from repository visibility.
- Audit agent filesystem permissions and connector scopes in addition to Copilot policy.
- Use redacted examples and approved secret-access mechanisms instead of pasting credentials.
Explanation
Correct Answer
C:Runtime access can be broader than conversational content filtering.
Incorrect Answers
A:Different surfaces and plans may have different session and retention rules. runtime access can be broader than conversational content filtering.
B:Private input access does not automatically control later sharing of generated artifacts. What should be inspected. Runtime access can be broader than conversational content filtering.
D:Least disclosure reduces risk without blocking debugging. Runtime access can be broader than conversational content filtering.
