GH-300 · Domain 3 of 6

GH-300 Domain 3: Understand GitHub Copilot data and architecture

This domain explains what happens between a keystroke and a suggestion. It covers how Copilot gathers context and builds prompts, how data is used and shared, proxy filtering and post-processing, the suggestion lifecycle, and the limits of large language models.

Exam weight
10–15%
Official functional groups
2
Estimated questions estimate
6–9
Suggested study time estimate
6–9 hrs

About 10 min read Reviewed October 2026

Overview

Understand GitHub Copilot data and architecture asks you to describe Copilot's pipeline rather than use it. It has two official groups. Describing data handling and flow covers explaining data usage, flow and sharing, describing input processing and prompt building, and explaining proxy filtering and post-processing. Understanding lifecycle and limitations covers visualizing the code suggestion lifecycle and describing the limits of LLMs and of Copilot itself.

You should be able to trace a request: the editor extension collects context such as the current file, cursor position and related open tabs, builds a prompt, and sends it over an encrypted connection to a GitHub-hosted proxy. The proxy screens the input, the model generates a response, and post-processing checks it for toxic content, likely vulnerabilities and, when configured, matches with public code before it reaches the developer. The domain was not changed in the August 2026 update.

How it's tested

Data and architecture questions usually describe a step in the request flow or a privacy concern and ask what happens, where it happens or why. Others describe disappointing output and ask which model limitation explains it. Knowing the pipeline order and what each stage does answers most of them.

  • Order the pipeline

    You arrange or identify stages: context gathering, prompt building, proxy screening, model inference, post-processing and display.

  • Where is it filtered

    A safeguard such as toxicity screening or public code matching is described, and you name the stage that applies it.

  • Explain the limitation

    A weak suggestion is described, and you pick the LLM limitation behind it, such as limited context window or training cutoff.

Reasoning it through

A security reviewer asks where Copilot checks generated code for matches with public repositories. One option says the IDE scans open files before sending the prompt, another says the model avoids memorised code. Matching against public code happens on the returned suggestion during post-processing, after the model generates it, so the post-processing stage is the correct answer.

Functional groups 2

Official functional groups from the GitHub (Microsoft) outline, in outline order.

3.1 Describe data handling and flowData usage and sharing, input processing and prompt building, proxy filtering and post-processing.
What it means
This group covers three official skills: explain data usage, flow and sharing; describe input processing and prompt building; and explain proxy filtering and post-processing. It describes the path a Copilot request takes and how data is treated along it.
What to understand
The client extension gathers context from the active file, cursor position, neighboring open tabs and, for Chat, the conversation and referenced files. It assembles a prompt and sends it securely to a proxy hosted by GitHub, which screens for harmful content and prompt manipulation before the model runs. Post-processing checks output for toxicity, common insecure patterns and public code matches. Business and Enterprise data is not used to train models, and retention differs by surface.
How it shows up
Expect a question about which context Copilot sends, where filtering occurs, or how plan type affects data use.
Common confusion
Thinking the whole repository is sent for every inline suggestion; completions use nearby, relevant snippets within a limited context window.
3.2 Understand lifecycle and limitationsThe code suggestion lifecycle and the limitations of LLMs and Copilot.
What it means
This group covers two official skills: visualize the code suggestion lifecycle, and describe the limitations of LLMs and of Copilot. It connects the pipeline to the quality and reliability of what developers receive.
What to understand
A suggestion moves from user action through context collection, prompt construction, proxy screening, model generation, post-processing and display, then is accepted, edited or dismissed, with engagement telemetry recorded. LLMs predict probable tokens, so they can be wrong, inconsistent between runs, limited by the context window, unaware of events after training, and weaker in less common languages or frameworks. Copilot also cannot see files you have not provided or that are excluded.
How it shows up
Look for a scenario where output quality is poor and you must choose the limitation or lifecycle stage responsible.
Common confusion
Assuming identical prompts always produce identical suggestions; model output is probabilistic and can vary.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Context gathering

    The extension collects code near the cursor, open tabs and other signals.

    Remember
    Opening related files improves context.
    Tested as
    Prompt-building questions.
    Trap
    Assuming the whole repository is read.

  • Prompt building

    Context is combined into a prompt sent with the request.

    Remember
    Built on the client before sending.
    Tested as
    Input processing questions.
    Trap
    Placing it on the server only.

  • Copilot proxy

    GitHub-hosted service between the client and the model.

    Remember
    Screens input and routes requests.
    Tested as
    Pipeline order questions.
    Trap
    Confusing it with a corporate network proxy.

  • Input filtering

    Screening prompts for harmful content and manipulation attempts.

    Remember
    Happens before the model runs.
    Tested as
    Where-is-it-filtered questions.
    Trap
    Placing it after generation.

  • Post-processing

    Checks on generated output before it is shown.

    Remember
    Includes toxicity, vulnerability and public code checks.
    Tested as
    Where-is-it-filtered questions.
    Trap
    Thinking output goes straight to the editor.

  • Public code matching

    Comparison of suggestions against public GitHub code.

    Remember
    Applied to output when the filter is set to block.
    Tested as
    Overlaps with Domain 6.
    Trap
    Assuming the model itself avoids matches.

  • Context window

    The amount of text the model can consider at once.

    Remember
    Large projects exceed it.
    Tested as
    Limitation questions.
    Trap
    Expecting full-project awareness.

  • Training cutoff

    The date after which the model has no knowledge.

    Remember
    Explains missing new APIs.
    Tested as
    Limitation questions.
    Trap
    Blaming the proxy.

  • Non-determinism

    Model output can vary for the same input.

    Remember
    Regenerate or refine prompts if needed.
    Tested as
    Lifecycle questions.
    Trap
    Expecting repeatable answers.

  • Data use by plan

    Business and Enterprise data is not used for model training.

    Remember
    Retention varies by surface such as IDE or Chat.
    Tested as
    Data sharing questions.
    Trap
    Assuming all plans behave the same.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Stages of a Copilot request

ConceptMeaningKey differenceCommon trap
Client context gathering Collects code and signals in the editor Runs locally before sending Assuming it reads every file
Proxy input screening Filters prompts on GitHub's service Before the model Placing it after generation
Model generation The LLM produces candidate output Probabilistic prediction Expecting deterministic output
Post-processing Checks and filters returned output After the model, before display Thinking nothing checks output

LLM limitations that affect Copilot

ConceptMeaningKey differenceCommon trap
Hallucination Plausible but false output Content error Treating it as a network fault
Context window limit Only so much input fits Input size limit Expecting whole-repo awareness
Training cutoff No knowledge after a date Time-based gap Confusing it with exclusions

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Whole repository context

    What candidates pick
    Say Copilot sends the full repository for each completion.
    Why it looks right
    Copilot seems to know the project.
    Why it's wrong
    Inline completions use nearby code and related open files within a limited context window, not every file.

    Clue to watch for The scenario asks why opening a file improved suggestions.

  2. Filtering happens in the IDE

    What candidates pick
    Pick the editor extension as the stage that screens for toxic content.
    Why it looks right
    The extension builds the prompt.
    Why it's wrong
    Toxicity and harmful content screening runs on GitHub's proxy service and in post-processing, not only on the client.

    Clue to watch for The question names a safety check and asks where it runs.

  3. Public code check is pre-generation

    What candidates pick
    Say the prompt is checked against public repositories before sending.
    Why it looks right
    It sounds like prevention.
    Why it's wrong
    Matching compares the generated suggestion with public code after the model responds, during post-processing.

    Clue to watch for Wording such as before the suggestion is displayed.

  4. All plans train models

    What candidates pick
    Assume Copilot Business prompts improve the public model.
    Why it looks right
    AI products often learn from usage.
    Why it's wrong
    GitHub states that Copilot Business and Enterprise data is not used to train its models.

    Clue to watch for The scenario names a business plan and a data concern.

  5. Proxy means corporate proxy

    What candidates pick
    Pick the company's network proxy as the Copilot proxy stage.
    Why it looks right
    Both are called proxy.
    Why it's wrong
    The Copilot proxy is GitHub's own hosted service that screens and routes requests to the model.

    Clue to watch for The question describes GitHub-side filtering.

  6. Output is deterministic

    What candidates pick
    Expect the same suggestion every time for the same code.
    Why it looks right
    Software usually behaves repeatably.
    Why it's wrong
    LLM generation is probabilistic, so suggestions can differ between requests even with similar context.

    Clue to watch for Two developers report different suggestions for the same code.

Answer framework

To answer a data and architecture question, place the scenario on the request pipeline with these steps.

  1. Decide whether the question is about input, the service in the middle, the model, the output, or what happens after the developer responds.
  2. For input, think of the client collecting the active file, cursor position, open tabs and chat history to build a prompt.
  3. For safeguards on the way in, choose the GitHub-hosted proxy, which screens prompts before they reach the model.
  4. For safeguards on the way out, choose post-processing, which checks toxicity, insecure patterns and public code matches before display.
  5. For poor results, name the LLM limitation involved, such as context window size, training cutoff, hallucination or non-deterministic output.

Practice question

A compliance officer asks at which point Copilot compares a generated suggestion with code in public GitHub repositories when the organization blocks suggestions matching public code. Which stage performs this check?

Want more like this? The GH-300 practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Learn this domain by drawing the pipeline yourself. On one page, sketch the developer's editor, the extension gathering context, the prompt, the GitHub-hosted proxy, the model, post-processing and the returned suggestion. Label each box with what it does and which safeguards apply there. Redraw it from memory until the order is automatic.

Next, read GitHub's Copilot Trust Center and documentation on data handling. Note what is sent, how it is transmitted, which plans exclude data from model training, and how retention differs between IDE completions, Chat and other surfaces. Write these as short facts rather than paragraphs.

Then study LLM limitations with examples: an invented API for hallucination, a missing new feature for the training cutoff, an incomplete answer in a large codebase for the context window. Testing this in your editor helps, for example by closing and opening related tabs and watching suggestion quality change. Finish by linking the post-processing filters to Domain 6 settings, since those questions often draw on both areas, and use practice questions to check your stage placement.

FAQ

How much of GH-300 is Domain 3, Understand GitHub Copilot data and architecture?

Understand GitHub Copilot data and architecture is 10–15% of the exam, about six to nine questions.

What context does Copilot send for an inline suggestion?

Relevant code around the cursor in the current file, snippets from related open tabs, the file path and language, and similar signals, within the model's context window.

What does the Copilot proxy do?

It is a GitHub-hosted service that receives requests, screens prompts for harmful content and manipulation attempts, and routes them to the model.

What happens in post-processing?

Generated output is checked before display, including toxicity filtering, screening for common insecure patterns, and public code matching when the organization or user blocks matches.

Is my code used to train Copilot models?

GitHub states that Copilot Business and Enterprise data is not used for model training. Individual plan settings and retention periods vary, so check current GitHub documentation.

Why does Copilot give different suggestions for the same code?

LLM output is probabilistic, and small context differences, such as which tabs are open, change the prompt and therefore the result.

Other Artificial Intelligence & Machine Learning certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 3 knowledge

You have covered data flow, prompt building, proxy filtering, post-processing, the suggestion lifecycle and model limitations. Test whether you can place each step correctly.

Take the GH-300 practice test Check your GH-300 readiness

Keep going