Try each one before opening the answer. Every option is explained, with the GitHub documentation page that proves it.
Question 1 · choose 1
A widely used public repository triages issues with a GitHub Agentic Workflow that sets labels and closes duplicates. After a bad week, maintainers want every automated issue change to wait for a person, whatever its confidence. Which automation level should the repository use?
AFull control
BCautious
CBalanced
DFull automation, with the automation told to explain each change
Show the answer and why
AFull control
Correct
Full control holds every change for review and applies nothing automatically.
BCautious
Incorrect
Cautious still applies high-confidence changes automatically.
CBalanced
Incorrect
Balanced still applies some changes without review.
DFull automation, with the automation told to explain each change
Incorrect
Full automation applies every change unless flagged uncertain; explanations don't hold changes back.
A repository's automation level sets the confidence threshold for automated issue changes, whether they come from Copilot automations, GitHub Agentic Workflows or the APIs. Full control holds every change for review, while the other levels let some or all changes apply automatically.
An enterprise lets agents edit files and run tests freely but classifies git push to protected remotes as high risk, needing a person's approval every single time, even for developers who run with /yolo. Which managed-settings rule fits?
AA permissions.allow rule for everything except git push
BA preToolUse hook returning ask for git push, deployed in the repository
CA permissions.ask rule such as Shell(git push *)
DA one-time approval with "don't ask again in this repo" for git push
Show the answer and why
AA permissions.allow rule for everything except git push
Incorrect
An allow list permits operations without a prompt; it doesn't force a fresh approval for push.
BA preToolUse hook returning ask for git push, deployed in the repository
Incorrect
A repository hook can be edited or disabled in the repository; a managed ask rule is the one that bypass mode and saved grants can't satisfy.
CA permissions.ask rule such as Shell(git push *)
Correct
A managed ask rule requires fresh, one-time approval that bypass mode, hooks or saved grants can't satisfy.
DA one-time approval with "don't ask again in this repo" for git push
Incorrect
A persisted grant is exactly what a managed ask rule refuses to accept.
Managed permissions use deny, ask and allow rules with selectors such as Shell(git push *). An ask rule requires a fresh, one-time approval before the operation can proceed, even if it would otherwise be allowed; it can't be satisfied by bypass (allow-all or YOLO) mode, an auto-approval setting, a hook or a grant persisted from an earlier approval, so the next request prompts again.
What is a repository's default automation level for automated issue changes?
ACautious
BFull automation
CBalanced
DFull control
Show the answer and why
ACautious
Correct
Cautious is the default: only high-confidence changes apply automatically.
BFull automation
Incorrect
Full automation is not the default.
CBalanced
Incorrect
Balanced is not the default.
DFull control
Incorrect
Full control is not the default.
A repository's automation level sets the confidence threshold for automated issue changes. The default is Cautious, so only high-confidence changes apply automatically and everything else is held for review until you change the level.
Where does a repository administrator change the automation level for automated issue changes?
AIn each automation's tool list
BIn copilot-setup-steps.yml
CIn the organization's Copilot policies page, under the agents and automations section
DRepository Settings, under Planning, in Agent suggestions for issues
Show the answer and why
AIn each automation's tool list
Incorrect
Tools decide what an automation can do; the level is a repository setting.
BIn copilot-setup-steps.yml
Incorrect
Setup steps configure the agent's environment.
CIn the organization's Copilot policies page, under the agents and automations section
Incorrect
The automation level is set per repository.
DRepository Settings, under Planning, in Agent suggestions for issues
Correct
The automation level is set on that settings page.
To set the automation level, open the repository's Settings, choose Agent suggestions for issues in the Planning section, select a level under Automation level, and save. Configuring an automation level is rolling out gradually.
How are local and cloud sandboxes for Copilot billed?
ABoth are included in every Copilot seat
BBoth are billed per session
CLocal sandboxing is included; cloud sandboxing is billed by usage
DLocal sandboxing is billed; cloud is free
Show the answer and why
ABoth are included in every Copilot seat
Incorrect
Cloud sandboxing is billed based on usage.
BBoth are billed per session
Incorrect
Local sandboxing is included at no extra cost.
CLocal sandboxing is included; cloud sandboxing is billed by usage
Correct
Local sandboxing costs nothing extra, and cloud sandboxes are metered.
DLocal sandboxing is billed; cloud is free
Incorrect
It is the other way round.
Local sandboxing is included in the standard GitHub Copilot seat at no additional cost. Cloud sandboxing is billed based on usage, measured across three meters.
A developer whose Copilot seat comes from their organization can't start copilot --cloud sessions. What is the likely reason?
ACloud sandboxes require a separate cloud account
BAn owner hasn't enabled the Cloud Sandbox access policy, which is off by default
C--cloud only works with -p
DCloud sandboxes need Windows 11
Show the answer and why
ACloud sandboxes require a separate cloud account
Incorrect
Sandboxing uses your existing Copilot authentication.
BAn owner hasn't enabled the Cloud Sandbox access policy, which is off by default
Correct
Cloud sandboxing for organization seats needs that policy, disabled by default.
C--cloud only works with -p
Incorrect
Cloud sandboxes can't be combined with -p.
DCloud sandboxes need Windows 11
Incorrect
Cloud sandboxes run in GitHub-hosted Linux environments.
If you get Copilot through an organization, an organization or enterprise owner must enable the Cloud Sandbox access policy, which is disabled by default. Sandboxing uses your existing Copilot sign-in.