AZ-400 Develop a security and compliance plan Practice Question
Your team uses GitHub Copilot for code suggestions. To comply with your organization's data protection policies, you need to ensure that code snippets and prompts sent to Copilot are not stored or used by Microsoft for service improvement. What should you configure?
⚠ Common exam trap
Many exam-takers confuse data protection controls for Copilot with broader Microsoft security tools like Defender for Cloud or Purview DLP, which address different compliance aspects and do not directly control Copilot's data storage behavior.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable the 'Data Exclusion' setting in Copilot's enterprise settings
GitHub Copilot's enterprise settings include a 'Data Exclusion' feature that, when enabled, prevents Microsoft from storing or using your code snippets and prompts for service improvement. This directly addresses the data protection policy requirement by ensuring that your organization's code is not retained or analyzed by Microsoft beyond the immediate suggestion generation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set a compliance grade in Microsoft Defender for Cloud
Why it's wrong here
Microsoft Defender for Cloud provides security posture management and regulatory compliance scoring for your Azure resources, but it does not manage GitHub Copilot settings or control how Copilot stores or processes code snippets. Its compliance grades apply to cloud infrastructure, not Copilot enterprise policy configurations.
- ✓
Enable the 'Data Exclusion' setting in Copilot's enterprise settings
Why this is correct
Enabling the 'Data Exclusion' setting in Copilot's enterprise settings is the correct action because it instructs GitHub not to store or use your code snippets for service improvement purposes, aligning with your requirement to ensure code is not retained or used for model training. This setting is specifically designed to prevent Microsoft from retaining or using your code data beyond what is necessary to provide the Copilot service.
- ✗
Apply a Microsoft Purview Data Loss Prevention policy
Why it's wrong here
Microsoft Purview Data Loss Prevention (DLP) policies help protect sensitive data across services like Exchange, SharePoint, and endpoints, but they do not control GitHub Copilot's underlying data storage or retention behavior. Copilot's data handling is governed by its own enterprise settings, not by Purview DLP, so applying a DLP policy won't prevent Microsoft from storing or using code snippets.
- ✗
Configure Azure OpenAI Service content filtering
Why it's wrong here
Azure OpenAI Service content filtering is a safety mechanism that screens prompts and completions for harmful or policy-violating content in Azure OpenAI deployments; it is a separate service from GitHub Copilot. Copilot's data handling for enterprise customers is controlled through GitHub's Copilot admin settings, not through Azure OpenAI content filters, so this does not address the requirement.
Go deeper
Related to this question
Learn chapter
Managing Infrastructure as Code Using Azure
Key term
Feature
A feature is a distinct unit of functionality that delivers value to the user, often managed and tracked throughout the software development lifecycle.
Key term
GitHub
GitHub is a cloud-based platform for storing, tracking, and collaborating on code using Git version control.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.