GH-300 Official Certification Question Bank (125 Questions)
125 curated questions sourced directly from official Microsoft Learn study domains, GH-300 exam prep guides, and real test sets covering all core competency areas of the GH-300 exam.
Q101 [Scenario]: A developer accidentally types an active AWS Secret Key into a file context while writing a function with Copilot active. What prevents this key from being exposed?
Before prompts reach the LLM backend or completions return to the IDE, Copilot's Post-Processing & Proxy Security Filters scan payloads for hardcoded secrets, API tokens, and private credentials. Furthermore, pairing Copilot with GitHub Secret Scanning blocks commits containing leaked keys.
- Proxy filters inspect client payloads in real time to redact credentials.
- GitHub Secret Scanning provides secondary protection during push/commit.
Which component acts as the immediate real-time guardrail blocking credentials before prompt transmission?
Q102 [Scenario]: An enterprise legal team conducts an audit to confirm eligibility for Microsoft's Copilot Copyright Commitment. They find 'Suggestions matching public code' is set to 'Allow' for one org. What is the impact?
To qualify for Microsoft's Copilot Copyright Commitment (IP Indemnification), the organization policy for 'Suggestions matching public code' must be strictly configured to 'Block'. Leaving it on 'Allow' forfeits legal coverage against third-party copyright claims for that organization.
- Public code filter MUST be set to 'Block' across all managed orgs.
- Allowing verbatim public code matching invalidates IP indemnification protections.
What is the legal consequence of leaving public code matching set to 'Allow' in an enterprise setting?
Q103 [Scenario]: A developer is using Copilot Chat to refactor a payment processing module. After 2 hours in the same chat thread, Copilot starts suggesting outdated syntax from a task completed earlier in the conversation. How should the developer fix this?
Long chat threads accumulate stale tokens in conversational history, causing the model to weight outdated instructions higher than current tasks. Running the /clear command or starting a New Topic purges the active conversation context window.
- Excessive chat history clutters the active window with obsolete context.
- Use
/clearor New Topic when switching logical tasks.
How should a developer resolve context degradation caused by an overly long chat thread?
Q104 [Scenario]: In a 50GB monorepo, @workspace queries take a long time or return irrelevant results from unrelated microservices. How can the lead architect scope Copilot's context?
The team can define a .copilotignore file at the root or within subdirectories to exclude unrelated microservices, build artifacts, and vendor files from Copilot's workspace indexing, keeping prompt context focused.
.copilotignorelimits indexing in large repositories.- Excluding irrelevant subfolders speeds up
@workspaceprocessing and improves accuracy.
Which mechanism best optimizes @workspace response quality in massive monorepos?
Q105 [Scenario]: A junior developer uses Copilot to implement password hashing and accepts a suggestion calling bcrypt.hash_password_secure(). During testing, the build fails with an AttributeError. What happened?
Copilot generated an AI Hallucination—synthesizing a plausible-sounding method name that does not exist in the official bcrypt library. This highlights the necessity of human review, compiler validation, and static analysis.
- Generative AI predicts likely text strings, not validated library indexes.
- Always verify generated method signatures against official framework docs.
What phenomenon occurred when Copilot generated bcrypt.hash_password_secure()?
Q106 [Scenario]: An enterprise engineering team wants Copilot Enterprise on GitHub.com to answer questions using strictly their internal compliance frameworks stored across 3 documentation repos. How should this be set up?
An administrator should create a Copilot Knowledge Base, attach the 3 Markdown documentation repositories, and index them. Developers can then target that Knowledge Base during chat sessions on GitHub.com.
- Knowledge Bases aggregate multiple Markdown documentation repositories.
- Available on Copilot Enterprise for grounded organizational queries.
What Copilot Enterprise feature allows grounding queries across multiple internal documentation repos?
Q107 [Scenario]: After installing the Copilot VS Code extension behind a strict corporate SSL-inspecting proxy, developers receive 'Self-signed certificate in chain' connection errors. What setting addresses this in enterprise deployments?
In VS Code settings, developers or IT admins must configure http.proxyStrictSSL: false or import the corporate custom Root CA bundle via http.proxyAuthorization to allow Copilot to negotiate secure proxy handshakes.
- Corporate SSL inspection requires importing custom root certificates into the IDE.
- Ensures secure traffic flow to Copilot backend endpoints.
Which configuration allows Copilot to route through corporate SSL-inspecting proxies?
Q108 [Scenario]: A team wants Copilot Chat to always generate TypeScript code using strict explicit return types and clean architecture boundaries without repeating this request in every prompt. How should this be enforced?
Create a .github/copilot-instructions.md file in the repository root containing explicit project guidelines. Copilot Chat automatically loads these Custom Instructions for every chat query within that repository.
.github/copilot-instructions.mdprovides automated repository-level prompt context.- Enforces project-wide coding standards across all team chat interactions.
What repository file automatically injects team style rules into all Copilot Chat interactions?
Q109 [Scenario]: An enterprise bank is modernizing a legacy COBOL codebase to Java microservices. How can they leverage Copilot Chat to accelerate this transition?
Developers can highlight COBOL procedures, use /explain to document business rules, and then prompt Copilot to generate corresponding Java functional equivalents, followed by /tests to verify behavioral parity.
- Use
/explainto extract business logic from legacy syntax. - Prompt cross-language translation and generate test suites to verify functional equivalence.
What sequence of Copilot actions best supports modernizing legacy code bases?
Q110 [Scenario]: A security scan flags a malicious package dependency in a Node.js project. The developer admits accepting an unverified npm import path suggested by Copilot. What attack vector occurred?
This is a Slopsquatting (Package Hallucination) attack. Malicious actors register package names that generative AI models commonly hallucinate, waiting for developers to blindly execute npm install on suggested code.
- Always verify generated import statements against trusted package registries.
- Integrate Dependabot or security linters to flag non-existent or malicious imports.
What security risk involves malicious packages uploaded to registries matching common AI-hallucinated names?