GitHub Copilot CLI assessment

GitHub Copilot CLI — assessment

Ten questions on Copilot CLI, with an emphasis on its permission model. The flags are verified against the installed binary — the site records which version and when.

10 questions · 80% to pass · unlimited retries · nothing is recorded outside this browser

— best score %.

You run Copilot CLI with both `--allow-all-tools` and `--deny-tool 'shell(git push)'`. What happens when the agent tries to push?
- It is permitted, because the broader flag wins.
- It is refused — denial takes precedence over any allow, including `--allow-all-tools`.
- It prompts you to choose.
- The CLI refuses to start with contradictory flags.
What is the difference between `--available-tools` and `--allow-tool`?
- `--available-tools` controls which tools the model can see at all; `--allow-tool` controls which are approved without prompting.
- `--available-tools` applies only in interactive mode.
- `--available-tools` approves tools; `--allow-tool` only lists them.
- They are aliases for the same behaviour.
You need to run Copilot CLI non-interactively in CI. Which flag does that require, and what is the consequence?
- `--silent`, which suppresses prompts.
- No flag; CI runs are automatically approved.
- `--no-ask-user`, which grants tool permissions.
- `--allow-all-tools`, which removes every approval prompt — so the run must be constrained by denials, path limits and a restricted environment instead.
You approve `https://api.example.com` with `--allow-url`. Does the agent now have access to `http://api.example.com`?
- Yes, because the host matches.
- Only if `--allow-all-urls` is also set.
- Yes, but only for read requests.
- No — URL permissions are protocol-aware, so approving the HTTPS origin does not approve the plaintext one.
Which flag limits file access to one extra directory rather than disabling path checks altogether?
- `--disallow-temp-dir`
- `--add-dir`
- `--allow-all-paths`
- `--available-tools`
What does `--yolo` do?
- Approves tools but still confirms file writes.
- The same as `--allow-all`: it enables all tool, path and URL permissions and removes every confirmation prompt.
- Enables experimental features only.
- Runs the agent in a sandbox with no filesystem access.
Your CI job exports a deployment token in its environment and you want Copilot CLI not to see it. Which flag addresses that?
- There is no flag; unset the variable manually.
- `--secret-env-vars`, which strips the named variables from shell and MCP environments and redacts them from output.
- `--log-level none`, which stops secrets being logged.
- `--excluded-tools`, which hides the shell from the model.
Which are true of autopilot mode? Select all that apply.
Select all that apply.
- It restricts the agent to read-only operations.
- It disables the permission system.
- Its continuation messages are capped, with a default limit that can be raised or lowered.
- It is a higher-risk mode because it proceeds without pausing for approval at each step.
Where does Copilot CLI read repository-level custom instructions from?
- `.github/copilot-instructions.md`
- `~/.copilot/instructions.md` only.
- `copilot.config.json` in the repository root.
- It does not support custom instructions.
You want a scripted run to emit machine-readable output for a later step. Which option does that?
- `--log-level debug`, which prints structured logs.
- `--output-format json`, which emits JSONL — one object per line.
- `--silent`, which leaves only parseable text.
- `--share`, which writes the session to a file.

of 10 answered

Unanswered questions are marked incorrect.

Your score

Academy milestone recorded in this browser. This is not a certification, and no organisation is told about it.

Every question

Answers are scored and stored in this browser only. Nothing is sent anywhere, no account is required, and this is not a certification —the Academy explains how progress works.

GitHub Copilot CLI — assessment

GitHub Copilot CLI — assessment

Solid

Worth rereading

Every question