GitHub Copilot Certification GH-300 — Intensive Crash Course
3-Part Exam Crash Course
All four exam domains in one intensive reference. Read straight through or jump to the part you need. Covers responsible AI, all three plan tiers, setup and configuration, command gotchas, five hard scenario questions, and the ten cheats that determine whether you pass.
Part 1 — Domain Knowledge
1.1 What GitHub Copilot Is at a Technical Level
Copilot does NOT learn from your individual code or organisation's code in real-time (unless you are on Enterprise with knowledge bases configured).
1.2 Hallucinations
A hallucination is when Copilot generates output that is syntactically plausible but factually incorrect — e.g., suggesting a method that does not exist, inventing package names, or citing behaviour that does not match the actual library.
The correct exam response: developers must verify all suggestions against official documentation. Copilot has no self-verification mechanism.
1.3 Bias in AI-Generated Code
- Demographic bias — code dealing with names or identities may reflect historical assumptions from training data.
- Security bias — older code contained insecure patterns (SQL injection via string concatenation, no input validation) that Copilot may reproduce.
- Language/framework bias — heavily-represented languages get better suggestions; underrepresented ones get weaker ones.
- Recency bias — older patterns are more represented than newer best practices.
Developers must review suggestions critically and cannot assume Copilot follows current best practices automatically.
1.4 Privacy — What Data Copilot Sends to GitHub
- The code surrounding your cursor (context window — typically a few hundred lines before and after)
- Your prompt (if using Chat)
- File metadata (file type, language identifier)
- Telemetry about accepted/rejected suggestions (configurable)
- For Business and Enterprise plans: GitHub does NOT use your code to train the model by default
- Copilot does not have access to private repositories it hasn't been given context for
- Copilot does not remember context between separate chat sessions (unless knowledge bases are configured)
1.5 Security Risks
| Risk | What It Means |
|---|---|
| Insecure code suggestions | Copilot may suggest code with SQL injection, hardcoded credentials, missing input validation, or deprecated cryptography. |
| Secrets in prompts | Real API keys, passwords, or connection strings in prompts or open files are transmitted to GitHub's servers. Never include real secrets in prompts. |
| Suggested vulnerable dependencies | Copilot may suggest packages with known vulnerabilities or that no longer exist. Always use dependency scanning. |
| Licence compliance | Some suggestions may resemble training data closely. Use Copilot's duplication detection filter to reduce verbatim reproduction. |
1.6 Responsible Use Principles
- Human oversight is mandatory — Copilot is an assistant, not a replacement for developer judgement.
- Suggestions are drafts — treat every suggestion as a draft that might be wrong.
- Context quality determines suggestion quality — clear, complete context produces better suggestions.
- Transparency — teams should know which code was AI-assisted.
- Continuous verification — test AI-generated code as rigorously as manually written code. AI-generated tests should also be reviewed.
"IaC eliminates ALL infrastructure errors" — FALSE. It reduces them. Same applies to Copilot: "Copilot writes correct code" is never a true statement on this exam.
2.1 The Three Plan Tiers
This is the highest-weight single topic on the exam. Know every cell of this table.
| Feature | Individual | Business | Enterprise |
|---|---|---|---|
| Inline code completion | Yes | Yes | Yes |
| Copilot Chat (IDE) | Yes | Yes | Yes |
| Copilot Chat (GitHub.com) | Yes | Yes | Yes |
| Copilot CLI | Yes | Yes | Yes |
| Copilot Mobile | Yes | Yes | Yes |
| Org-level seat management | No | Yes | Yes |
| Org-level policy controls | No | Yes | Yes |
| Content exclusions | No | Yes | Yes |
| Audit logs | No | Yes | Yes |
| SAML/SSO enforcement | No | Yes | Yes |
| No model training on org data | No | Yes | Yes |
| Knowledge bases | No | No | Enterprise ONLY |
| PR summaries | No | No | Enterprise ONLY |
| Bing search in Chat | No | No | Enterprise ONLY |
| Enterprise-level policy cascade | No | No | Enterprise ONLY |
The Enterprise-Only Trio: Knowledge Bases + PR Summaries + Bing Search. Business plan has NONE of these three. This appears in multiple questions.
Individual plan has ZERO organisation management — no policies, no seat management, no audit logs, no content exclusion configuration, no SSO enforcement. It is a single-user subscription.
2.2 Core Features
Inline Code Completion ("Ghost Text")
- Appears in grey/muted text as you type. Accept with Tab; dismiss with Escape; cycle alternatives with Alt+] / Alt+[.
- Works in all supported IDEs. Available in all plan tiers.
- Reads surrounding code context — open files, cursor position, language, file structure.
Copilot CLI
gh copilot suggest— suggest a shell command to accomplish a described task.gh copilot explain— explain what a shell command does.
Copilot CLI does NOT execute commands autonomously — it only suggests or explains shell commands.
Copilot Mobile
- Available in the GitHub Mobile app (iOS and Android). Provides Copilot Chat on mobile.
- Does NOT provide inline code completion in a mobile code editor.
- Available on all three plan tiers.
PR Summaries (Enterprise ONLY)
- Generates a natural language summary of the changes based on the diff, commit messages, and file names.
- Fills in the PR description field on GitHub.com.
- Org/enterprise admins can control whether the feature is enabled.
Knowledge Bases (Enterprise ONLY)
- Admin creates a knowledge base by selecting repositories to index.
- Copilot indexes code, documentation, markdown from those repositories.
- Developers can ask Copilot Chat questions about internal APIs, conventions, and private codebase content.
- Solves the problem of Copilot not knowing your organisation's private code.
Content exclusions PREVENT Copilot from using files as context. Knowledge bases do the OPPOSITE — they add private repo content as context. These are frequently confused.
Copilot Extensions
- Third-party developers build extensions using the Copilot Extensibility Platform.
- Appear as additional slash commands or agents in Copilot Chat.
- Organisation admins can allow or block specific extensions for their org.
2.3 Agent Mode vs Standard Mode
| Feature | Standard Mode | Agent Mode |
|---|---|---|
| Can create/modify files | No — suggests only | Yes — autonomously |
| Can run terminal commands | No | Yes — with user confirmation |
| Developer applies changes | Always manually | Copilot applies; dev confirms steps |
| IDE support | All supported IDEs | Primarily VS Code |
| Default mode? | Yes | No — must be activated |
"Scaffold a REST API with endpoints and generate tests all in one workflow without manually applying each change" → Agent mode.
"Ask Copilot to suggest a refactoring to review before applying" → Standard mode.
3.1 Supported IDEs
| IDE | Completion | Chat | Agent Mode |
|---|---|---|---|
| VS Code | Yes | Yes | Yes (full) |
| Visual Studio | Yes | Yes | No |
| JetBrains (IntelliJ, PyCharm, etc.) | Yes | Yes | Partial |
| Neovim | Yes | No Chat features | No |
| Xcode | Yes | Limited | No |
| Azure Data Studio | Yes | Yes | No |
| GitHub Codespaces | Yes (uses VS Code) | Yes | Yes |
Not supported: Eclipse, Emacs, Sublime Text, Atom (discontinued), TextMate, most browser-based editors (except Codespaces).
Neovim only supports inline completion — NOT Chat features. @terminal is VS Code-specific only.
3.2 Content Exclusions — Most-Tested Topic in Domain 3
What they DO: Files matching the pattern will NOT be sent to the model as context.
What they DO NOT do:
- Do NOT prevent developers from opening those files
- Do NOT disable Copilot entirely in the IDE
- Do NOT prevent developers from typing in those files
- Are NOT a security measure to prevent reading sensitive files (devs can still read manually)
- Business plan: Organisation owners
- Enterprise plan: Enterprise administrators
- Individual plan users: CANNOT configure org-level content exclusions (there is no org)
- Regular developers/members: CANNOT configure org-level content exclusions
Answer: Organisation owner (Business) or enterprise admin (Enterprise) configures content exclusions with a pattern matching those files (e.g.,
config/production.yml).
3.3 Organisation and Enterprise Policies
Enterprise (top — cannot be overridden)
└── Organisation (can override if enterprise allows)
└── Individual user (can configure own IDE only)
Enterprise policies can be: Allowed (org can choose) / Required (all orgs must enable) / Blocked (all orgs cannot use).
3.4 Custom Instructions — .github/copilot-instructions.md
- File path:
.github/copilot-instructions.md— exactly this path, in the.githubdirectory. - Scope: only the repository where the file lives. Does not carry over to other repos.
- Effect: guides Copilot Chat behaviour (style, framework preferences, conventions). Does NOT affect inline code completion. Does NOT enforce policies.
Custom instructions are NOT secret — the file is in the repository, readable by anyone with repo access. They cannot PREVENT Copilot from doing something, only guide it.
Part 2 — Command and Feature Gotchas
| Command | Purpose | Exam Scenario |
|---|---|---|
/explain | Describe what code does in natural language | Developer inherits unfamiliar 200-line function and wants to understand it |
/fix | Fix a bug, error, or problem in selected code | Null pointer exception needs correcting |
/tests | Generate unit tests for a function or class | Developer wants pytest test cases for a Python function |
/doc | Generate documentation comments (JSDoc, docstring, etc.) | Developer wants JSDoc comments on all public TypeScript functions |
/new | Scaffold a new file or component from a description | Developer wants a new React user profile component |
/newNotebook | Create a new Jupyter notebook | Data scientist wants a new analysis notebook |
/clear | Clear conversation history | Context has drifted and developer wants a fresh start |
/help | Show available slash commands | New Copilot user wants to discover what's available |
/fix CHANGES code. /explain DESCRIBES code. Never confuse these two in a scenario question — the exam relies on this distinction heavily.
If /tests generates unittest instead of pytest, Copilot failed to detect pytest in the project — it is NOT a plan restriction. Fix: add pytest to requirements.txt or specify the framework in the prompt.
| Variable | Scope | Key Exam Fact |
|---|---|---|
@workspace | All files in the currently open workspace folder | NOT the internet. NOT other repos. Just local project files. |
@file | A specific file you reference by path | Use when you want Copilot focused on one file, not the whole project |
@terminal | Output currently shown in the IDE's integrated terminal | VS Code-specific. Use with /fix @terminal to fix errors shown in terminal. |
@vscode | VS Code settings, extensions, keybindings, tasks | VS Code-specific. For questions about IDE configuration. |
@github | GitHub issues, pull requests, repositories | Accesses GitHub data (issues, PRs), NOT the internet. |
#file | A specific file, referenced inline in a message | Inline reference; @file is a context participant |
#selection | Currently selected text in the editor | Included automatically when you open inline chat on selected code |
#editor | Content of the currently visible active editor tab | What's visible now; @file can reference any file by path |
@workspace = local project files only. NOT internet. NOT other repositories. If the exam asks "Does @workspace give Copilot internet access?" — the answer is NO.
Best workflow for fixing a terminal error: /fix @terminal — Copilot reads the error message automatically and proposes a fix. No copy-pasting needed.
@github accesses GitHub data (issues, PRs). Real-time web search = Bing integration. These are two completely different things. Bing search is Enterprise-only on GitHub.com.
Copilot in VS Code, JetBrains, etc. has NO internet access. Its knowledge ends at training cutoff. The ONLY context where real-time internet search exists is Copilot Chat on GitHub.com with Bing search — and only on the Enterprise plan.
In standard mode, Copilot suggests code but does not execute it. Cannot run tests, execute builds, or verify its own suggestions. In agent mode, Copilot CAN execute terminal commands — but only with explicit user permission for each action, and only in VS Code.
Copilot has no self-verification mechanism. It generates statistically likely continuations. Suggestions can be syntactically valid but logically wrong. The exam will never present "Copilot writes correct code" as a true statement.
Even large blocks of code that appear correct must be reviewed as rigorously as human-written code.
- If the question is about preventing Copilot from using a file's content as context → content exclusion
- If the question is about removing a user's access entirely → revoke their seat
- If the question is about disabling a feature for everyone in the org → org-level policy
Part 3 — Hard Scenario Questions
A developer at a company using Copilot Business notices Copilot won't use files in their config/ directory as context. Their colleague at a different company with Copilot Individual has no such restriction. What is the most likely explanation?
A team wants Copilot to answer questions like "what parameters does our internal login() function accept?" based on their actual private codebase. What is the minimum plan required and what must be configured?
A developer sees a TypeError: Cannot read properties of undefined (reading 'user') in their VS Code terminal at app.js:47. What is the most efficient Copilot workflow to fix this?
@terminal automatically includes the terminal output (error + stack trace). /fix @terminal reads the error and proposes a fix in one step. Option A uses /explain which describes rather than fixes. Option B misses the terminal context.An enterprise security admin wants content exclusions for **/secrets/** and **/.env to apply across ALL organisations in the enterprise and cannot be overridden by org owners. What is the correct approach?
A developer runs /tests on a Python function but the output uses unittest instead of pytest. Why, and what is the best corrective action?
requirements.txt, pyproject.toml, etc. If pytest is absent, it defaults to unittest. The fix: add pytest to the project's dependency file, or specify in the prompt: /tests use pytest. Options C and D are false — plan tier has no bearing on test frameworks.Ten facts you must recall without thinking. Read these aloud. Cover them and test yourself.
Knowledge Bases + PR Summaries + Bing Search = Enterprise ONLY. Business has none of these three.
(a) Configured by org owners or enterprise admins only.
(b) Exclude file content from context — do NOT disable Copilot.
(c) Use glob patterns.
Path: .github/copilot-instructions.md. Scope: that repo only. Effect: guides Chat only — does NOT affect inline completion or enforce policies.
@workspace = all files in the currently open workspace folder. NOT the internet. NOT other repositories.
/fix = CHANGE the code to make it work. /explain = DESCRIBE what the code does. Never confuse in a scenario question.
@terminal = include terminal output as context. Best use: /fix @terminal to fix the error currently shown in the terminal.
Agent mode = Copilot can create files, modify multiple files, run terminal commands (with user confirmation). Standard mode = suggest only.
Copilot in VS Code / JetBrains has NO internet access. Bing search is only on GitHub.com, only on Enterprise plan.
Individual plan = no org management at all. No policies, no seat management, no audit logs, no content exclusions, no SSO.
No matter how confident a suggestion looks, Copilot can be wrong. Human review is always required. The exam never presents "Copilot writes correct code" as true.