Develop a security and compliance plan →easyMultiple SelectObjective-mapped

AZ-400 Develop a security and compliance plan Practice Question

Your team is adopting GitHub Copilot for code generation. The compliance team requires that all code generated by AI is reviewed and that proprietary code is not used as training data. Which TWO settings should you configure in your GitHub organization?

⚠ Common exam trap

The trap here is that candidates might confuse the 'Suggestions matching public code' setting (which blocks suggestions that match public code to avoid license violations) with the data privacy setting that controls training data usage, or think that disabling Copilot entirely is the only way to meet compliance, when in fact the two correct settings allow safe usage without violating policies.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Configure a branch protection rule that requires all code to be reviewed before merging.

Branch protection rules enforce mandatory pull request reviews before merging, which satisfies the compliance requirement that all AI-generated code must be reviewed by a human before entering the main branch. Additionally, disabling the 'Allow GitHub to use my data for training' option in the organization's Copilot settings prevents proprietary code from being used as training data, directly addressing the compliance requirement that proprietary code not be used for training. Together, these two settings allow the team to use GitHub Copilot safely while meeting compliance.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Configure a branch protection rule that requires all code to be reviewed before merging.
Why this is correct
Configuring a branch protection rule that requires at least one approved pull request review on protected branches (e.g., main) enforces a mandatory human review checkpoint before any Copilot-generated code can be merged. This ensures AI-suggested changes are inspected for correctness, security, and compliance, meeting the core safety requirement while still allowing Copilot usage.
✗
Disable Copilot for all repositories in the organization.
Why it's wrong here
Disabling Copilot for all repositories in the organization is an unnecessarily drastic control that eliminates the productivity gains of AI assistance without addressing the underlying risks. Instead, safe use can be achieved through targeted policies such as requiring code reviews, restricting data usage, and disabling training-data sharing, so a complete organization-wide ban is not required for compliance.
✓
Disable the 'Allow GitHub to use my data for training' option in the organization's Copilot settings.
Why this is correct
Disabling the 'Allow GitHub to use my data for training' option in the organization's Copilot settings is essential to prevent your proprietary code snippets from being ingested into future AI model training data. This policy-level control (configurable by enterprise owners) aligns with data confidentiality requirements and ensures that internal code is not used for GitHub's model improvement beyond the immediate code-completion context.
✗
Enable 'Suggestions matching public code' to block suggestions that match public code.
Why it's wrong here
This feature is on by default to block suggestions that match public code, but does not address training data usage.
✗
Enable 'Allow GitHub to use my code snippets for product improvements' to improve Copilot.
Why it's wrong here
Enabling 'Allow GitHub to use my code snippets for product improvements' would explicitly grant GitHub permission to retain and use your code snippets for training/improving Copilot models, which directly conflicts with your compliance requirement to keep code out of training data. This setting should be left disabled; note that it is separate from the public-code-matching filter, which only blocks suggestions that duplicate public code and does not affect data usage.

Go deeper

1 more way this is tested on AZ-400

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Your organization is adopting GitHub Copilot and wants to ensure that no proprietary code is used to train models. Which setting should you configure in the GitHub organization?

easy

A.Enable secret scanning.
B.Enable Dependabot alerts.
C.Disable GitHub Copilot for the organization.
✓ D.Opt out of allowing GitHub to use code snippets for product improvement.

Why D: GitHub provides an organization-level setting to opt out of allowing GitHub to use code snippets for product improvement, which prevents Copilot from training on that code. Option A is incorrect because secret scanning is unrelated to model training. Option B is incorrect because Dependabot alerts focus on dependency vulnerabilities, not data usage. Option C is incorrect because disabling Copilot prevents its use but does not address the underlying data usage for training; the organization may still want to use Copilot while preventing training on proprietary code.

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.

AZ-400 Develop a security and compliance plan Practice Question

Why each option matters

Option-by-option breakdown

Related to this question

1 more way this is tested on AZ-400