Copilot Security, Code Review & Enterprise assessment

Copilot Security, Code Review & Enterprise — assessment

Ten questions on security, code review and running Copilot across an organisation. Several of these turn on limitations that are documented but easy to miss — which is exactly why they are worth testing.

10 questions · 80% to pass · unlimited retries · nothing is recorded outside this browser

— best score %.

Your organisation configures content exclusion for a directory of sensitive files. A developer then uses agent mode in Copilot Chat on that directory. What happens?
- The files are excluded everywhere, including agent mode.
- Agent mode is blocked entirely for that repository.
- Content exclusion does not apply to Edit and Agent modes in Copilot Chat, so the exclusion does not protect those files there.
- The developer is prompted to confirm each excluded file.
Which are documented limitations of content exclusion? Select all that apply.
Select all that apply.
- It prevents any secret from ever reaching a model.
- It does not apply to symlinks.
- It applies identically across every Copilot surface.
- It does not apply to repositories on remote filesystems.
Content exclusion is in place, but an IDE still supplies type information and hover definitions. What is the accurate statement?
- Semantic information is also excluded, so nothing derived leaks.
- Copilot may still use semantic information the IDE supplies indirectly, so exclusion is not a guarantee that nothing derived from those files is used.
- Type information is not sent under any circumstances.
- This makes content exclusion useless.
Which plans can configure content exclusion and policy management?
- Any paid plan, including Pro+ and Max.
- All plans, including Free.
- Copilot Business and Copilot Enterprise only.
- Enterprise only.
A developer asks whether the public-code filter means generated code is safe to ship from a licensing perspective.
- No, because the filter does not work.
- Yes — with the filter on, output carries no licence obligations.
- Yes, but only on Enterprise.
- No — it blocks completions matching public code, which reduces one specific risk but is not a licence clearance for the output.
Where should secrets live so Copilot does not surface them in suggestions?
- Outside the repository entirely — in a secret manager or environment configuration — so there is nothing in the working tree to surface.
- In a comment marked `# do not suggest`.
- Anywhere; push protection catches all of them.
- In a committed `.env` file excluded by content exclusion.
What is the best use of Copilot code review on a pull request?
- A first pass that catches mechanical issues before a human reviewer spends attention on design and correctness.
- A way to satisfy a compliance requirement for two reviewers.
- A replacement for human review on routine changes.
- A gate that blocks merges until it approves.
You are rolling Copilot out to 200 engineers. What most reliably predicts whether adoption succeeds?
- Whether a single model is mandated organisation-wide.
- Whether everyone is on the largest available plan.
- How quickly seats are assigned.
- Whether teams are given concrete practices for using and reviewing it, rather than only licences and access.
Which is a legitimate way to measure whether Copilot is helping your organisation?
- Measuring reduction in headcount.
- Counting accepted suggestions as lines of productive code.
- Asking the vendor for a productivity figure.
- Combining usage data with outcome signals your team already tracks, while acknowledging that attribution is genuinely hard.
An engineer says "private repositories are completely safe with Copilot, so we need no policy." What is the accurate response?
- Correct, provided the repository is on Enterprise.
- Correct — private repositories are entirely exempt.
- Repository visibility is one factor among several — data handling, model hosting, exclusion limits and organisation policy all bear on it, and none of them reduces to "private is safe".
- Wrong — private repositories get no protections at all.

of 10 answered

Unanswered questions are marked incorrect.

Your score

Academy milestone recorded in this browser. This is not a certification, and no organisation is told about it.

Every question

Answers are scored and stored in this browser only. Nothing is sent anywhere, no account is required, and this is not a certification —the Academy explains how progress works.

Copilot Security, Code Review & Enterprise — assessment

Copilot Security, Code Review & Enterprise — assessment

Solid

Worth rereading

Every question