GitHub Copilot common mistakes
GitHub Copilot · Understand the traps and how to avoid them.
Treating Copilot's output as trustworthy by default and submitting it without reviewing for security, licensing, or correctness issues, rather than applying the review-and-verify discipline the exam tests.
Candidates conflate 'the suggestion compiles' with 'the suggestion is safe and correct.' Copilot generates plausible-looking code that can contain injection flaws, outdated APIs, or copied patterns, so the habit of fast acceptance carries over into exam scenarios about responsible use.
What to do instead
For any scenario asking what to do with a suggestion, default to the position that the developer remains accountable: review, test, and validate before accepting. Learn the specific risk categories (security vulnerabilities, insecure dependencies, license/attribution concerns, bias, hallucinated APIs) so you can match the correct safeguard to each scenario rather than answering generically.
Assuming Copilot suggestions are always original or always copied, instead of recognizing that output can match public code and that duplicate-detection and filters exist to manage that risk.
Candidates oversimplify the licensing question in one direction. The exam expects knowledge that suggestions may resemble public code and that GitHub provides mechanisms (such as a code-referencing/duplication filter and public code matching) to surface or block matches.
What to do instead
Study what the duplication filter does, what it does not guarantee, and how organizations can enable or block suggestions matching public code. Practice answering questions by identifying which control applies to the specific licensing concern described.
Confusing the different Copilot surfaces (inline completions in the editor, the chat pane, inline chat, and agent-style features) and answering questions about one as if they applied to another.
The features overlap in name and purpose, and candidates who only use one surface generalize from it. Exam items often hinge on which interface supports which action, such as where you can attach context, run a command, or generate tests.
What to do instead
Build a comparison table of each surface: where it lives, what it can do, what context it can see, and typical use cases. For each practice question, first identify the surface being described, then answer.
Ignoring slash commands, chat participants (such as @workspace), and context references when answering questions about getting better answers, treating chat as a plain text box.
Candidates who have not explored the chat syntax assume it behaves like a generic chatbot. The exam tests knowledge of built-in commands for explaining, fixing, testing, and documenting code, and of participants that scope the model to a workspace or specific domain.
What to do instead
Memorize the common slash commands and what each is for, and learn which chat participants exist and what context they add. Practice mapping a described goal (for example, 'generate unit tests for the open file') to the exact command or participant that achieves it.
Believing Copilot trains on or retains your private repository content by default, or conversely believing no telemetry or data handling exists at all, instead of knowing the actual data-flow model.
Candidates mix up consumer and business/enterprise plans, code-completion telemetry, and model training policies. The exam probes which data is sent, what is retained, and under what settings.
What to do instead
Learn the data pipeline at a conceptual level: what context is sent with a request, what is retained for suggestions versus chat, which settings govern telemetry and snippet retention, and how business/enterprise policies differ. Anchor answers on the documented default for the plan described in the question.
Assuming Copilot has live access to the entire codebase or to the internet by default, rather than understanding how context is assembled and limited.
Candidates overestimate the model's awareness. Copilot works from the prompt, open files, and whatever context the surface provides; without explicit context the answer may be generic or wrong.
What to do instead
Study how context is gathered for each surface: surrounding code, open tabs, referenced files, and workspace indexing where available. Answer questions about poor suggestions by diagnosing missing or irrelevant context first.
Writing vague prompts like 'fix this' or 'make it better' and expecting the exam to reward brevity, instead of crafting prompts with explicit goal, context, constraints, and expected output.
Candidates transfer casual chat habits into exam scenarios. The exam rewards recognizing that specificity, examples, and constraints improve output quality and reduce hallucination.
What to do instead
Practice a repeatable prompt structure: state the task, provide the relevant code or context, specify constraints (language version, style, edge cases), and describe the desired output format. When a question asks why a suggestion was poor, look for missing context or underspecified requirements as the cause.
Providing too much irrelevant context, such as pasting an entire file or several unrelated files, and assuming more context is always better.
Candidates learn that context helps and then overcorrect. Excess or noisy context dilutes the signal, can exceed limits, and can mislead the model toward irrelevant patterns.
What to do instead
Learn to select and scope context deliberately: reference the specific files, functions, or selections that matter, and use participants or references to narrow scope. In scenario questions, prefer the answer that supplies targeted, relevant context over the one that dumps everything.
Treating Copilot as a replacement for tests, documentation, and code review, and choosing answers that skip verification steps in the name of speed.
The productivity narrative encourages accepting suggestions quickly, so candidates pick the fastest-sounding option. Exam items test whether you pair acceleration with the engineering practices that keep quality high.
What to do instead
When a question asks how to use Copilot to improve productivity, favor answers that combine generation with verification: write tests, review diffs, run linters, and document assumptions. Learn concrete workflows such as generating boilerplate, writing tests first, explaining unfamiliar code, and drafting commit messages and docs.
Assuming content exclusions are absolute and instantaneous, or that they cover every surface and every context path, instead of knowing their scope and limitations.
Candidates treat exclusion settings as a blanket guarantee. The exam tests that exclusions apply to specified repositories or paths, depend on correct configuration, and may not cover every way content can reach the model.
What to do instead
Study how content exclusions are configured at the organization level, what file paths and repositories they target, and their documented limitations. For scenario questions, choose the answer that both configures exclusions correctly and adds complementary controls such as policy review and auditing.