Using Content Exclusions to Stop Copilot From Surfacing Sensitive Data
You are designing a source control strategy for a team that uses GitHub Copilot. The team wants to ensure that code suggestions do not include sensitive data. Which approach should you recommend?
Quick Answer
Content exclusions in GitHub Copilot settings let you define patterns — regexes for API keys, tokens, PII — that Copilot will never pull into its suggestion context. That's the most targeted fix here: it stops sensitive data from influencing or appearing in code suggestions without disabling Copilot for the whole team.
⚠ Common exam trap
Watch out — candidates often confuse reactive scanning (secret scanning or pre-commit hooks) with proactive prevention (content exclusions), leading candidates to choose a post-commit detection method instead of a real-time suggestion filter.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure content exclusions in GitHub Copilot settings to block sensitive data patterns
GitHub Copilot's content exclusions allow you to define patterns (e.g., regex for API keys, tokens, or PII) that Copilot will block from being used as context for code suggestions. This directly prevents sensitive data from appearing in suggestions without disabling the tool entirely. It is the most targeted and least disruptive approach to meet the team's goal.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use pre-commit hooks to scan for secrets
Why it's wrong here
Client-side, not integrated with Copilot.
- ✗
Disable GitHub Copilot for the organization
Why it's wrong here
Overly restrictive.
- ✗
Enable secret scanning for the repository
Why it's wrong here
Detects after commit.
- ✓
Configure content exclusions in GitHub Copilot settings to block sensitive data patterns
Why this is correct
Prevents suggestions with secrets.
Go deeper
Related to this question
Learn chapter
Source Control Strategy Design
Key term
Regex
Regex (regular expression) is a sequence of characters that defines a search pattern, used to match, find, or manipulate text in strings.
Key term
GitHub
GitHub is a cloud-based platform for storing, tracking, and collaborating on code using Git version control.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 823 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your team uses GitHub Copilot for code suggestions. To comply with your organization's data protection policies, you need to ensure that code snippets and prompts sent to Copilot are not stored or used by Microsoft for service improvement. What should you configure?
easy- A.Set a compliance grade in Microsoft Defender for Cloud
- ✓ B.Enable the 'Data Exclusion' setting in Copilot's enterprise settings
- C.Apply a Microsoft Purview Data Loss Prevention policy
- D.Configure Azure OpenAI Service content filtering
Why B: GitHub Copilot's enterprise settings include a 'Data Exclusion' feature that, when enabled, prevents Microsoft from storing or using your code snippets and prompts for service improvement. This directly addresses the data protection policy requirement by ensuring that your organization's code is not retained or analyzed by Microsoft beyond the immediate suggestion generation.
Variation 2. Your organization is adopting GitHub Copilot for developers. Which security measure should you implement to ensure that no proprietary code is inadvertently shared with the AI model?
hard- A.Use a separate network segment for development
- ✓ B.Configure content exclusions in the GitHub Copilot settings
- C.Disable GitHub Copilot for all users
- D.Enable audit logging for Copilot usage
Why B: GitHub Copilot's content exclusions allow administrators to specify files or repositories that should not be sent to the AI model for code completion suggestions. This prevents proprietary or sensitive code from being transmitted to GitHub's servers, ensuring compliance with security policies. Other options like network segmentation or audit logging do not directly block code from being shared with the AI.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.