Understand GitHub Copilot data and architecture
Domain 3 is only 10-15% of GH-300, but it is dense. Expect sequence questions: what happens inbound, what happens outbound, what is retained, and which limitations belong to the exam source rather than the live product.
The seven-step request lifecycle
The official training splits a Copilot request into inbound steps 1-4 and outbound steps 5-7. Memorize that split. A natural exam question asks which action happens on the way into the model and which action happens on the way out.
Inbound: transmit the prompt, gather context, build the prompt, pass through the proxy, filter toxicity, then generate with the LLM.
Outbound: validate the response, run final proxy checks, deliver only passing suggestions, and repeat for the next prompt.
Inbound: steps 1-4
- Secure prompt transmission and context gathering. The prompt is transmitted over HTTPS while Copilot gathers context. The named context sources are code before and after the cursor, filename and file type, adjacent open tabs, project structure and file paths, and programming languages and frameworks. This same step also includes pre-processing with Fill-in-the-Middle, or FIM, which considers both preceding and following code.
- Proxy filter. The built prompt passes to a proxy service hosted in a GitHub-owned Microsoft Azure tenant. On the inbound leg, the proxy blocks prompt injection and jailbreak attempts. This is not the same as toxicity filtering.
- Toxicity filtering before intent extraction. The training names hate speech and inappropriate content, plus personal data such as names, addresses, or identification numbers.
- Code generation with the LLM. After the inbound checks, the LLM generates the candidate response.
Fill-in-the-Middle is a named technique inside secure prompt transmission and context gathering. Do not turn it into an eighth official lifecycle step.
Outbound: steps 5-7
- Post-processing and response validation. The toxicity filter runs again on the output. Then the proxy applies a final layer for code quality, including XSS and SQL injection checks, plus optional public-code matching. If the response fails, it can be truncated or discarded.
- Suggestion delivery and feedback loop. Only responses that pass all filters are delivered. Copilot can grow from accepted suggestions and learn from modifications and rejections.
- Repeat for subsequent prompts. The lifecycle repeats each time the user makes another request.
The toxicity filter runs on both legs. It checks inbound content before generation and checks outbound content during post-processing.
The proxy runs on both legs. Inbound, it blocks prompt injection and jailbreak attempts. Outbound, it applies quality and security checks and optional public-code matching.
| Step | Leg | What happens | Common wrong answer |
|---|---|---|---|
| 1 | Inbound | HTTPS transmission, context gathering, and FIM prompt building. | Only the current line is used. |
| 2 | Inbound | Proxy service blocks prompt injection and jailbreak attempts. | The proxy is only an output filter. |
| 3 | Inbound | Toxicity filtering checks harmful content and personal data. | This is the same as injection defense. |
| 4 | Inbound | The LLM generates a candidate response. | The response has already been delivered. |
| 5 | Outbound | Post-processing validates the response, including toxicity, XSS, SQL injection, and optional public-code matching. | Quality checks happen only before the model. |
| 6 | Outbound | Passing suggestions are delivered and feedback is captured from accepts, edits, and rejects. | Failed responses are still shown with warnings. |
| 7 | Outbound | The cycle repeats for later prompts. | The first prompt creates a permanent session rule. |
If any part of a response fails the checks, the source says it is either truncated or discarded. Do not choose an answer that says Copilot always delivers the full response with a warning banner.
Retention and training use
Retention depends on where Copilot is used. The most testable contrast is editor completions versus chat outside the editor.
Editor completions
In the code editor, prompts are not retained. The source says Copilot discards prompts once a suggestion is returned.
Chat outside the editor
Copilot Chat used outside the editor typically retains prompts, suggestions, and supporting context for 28 days. The same 28-day qualifier applies to CLI, Mobile, and Chat on GitHub.com. Retention within the editor may vary.
Training exclusion by plan
The clean table is the exam value. Business and Enterprise exclude data from training by default. Free and Pro do not. Individual subscribers can opt out of sharing prompts used to fine-tune the model.
| Plan | Data excluded from training by default? | What to remember |
|---|---|---|
| Free | No | Individual plan. User-level choices matter. |
| Pro | No | Individual subscribers can opt out. |
| Business | Yes | Organization plan with stronger administrative controls. |
| Enterprise | Yes | Enterprise plan with enterprise governance. |
The confirmed 28-day retention figure is for Copilot Chat used outside the editor, plus CLI, Mobile, and Chat on GitHub.com. Do not flatten that into every editor completion prompt.
Context windows and source-vs-product wording
For Domain 3, the official training gives small context figures. Those figures are useful for recognizing exam-source language, not for describing every current model.
Exam-source wording: approximately 200-500 lines of code or up to a few thousand tokens, and Copilot Chat with a 4k-token context window.
Current product reality: current models are far larger. The site teaches the exam-source figures only because they appear in the official study material. Do not present them as a current universal limit.
Use the figures carefully. A question may use them to test whether you read the training module, but a real-world answer should acknowledge that model context has moved on.
Other limitations named in the source
| Limitation category | What it means on the exam |
|---|---|
| Code quality and correctness | Copilot can make errors, introduce security concerns, or misinterpret context. |
| Language and framework specificity | Performance varies, especially on niche technologies. |
| Dependency on training data | Suggestions can reflect bias, outdated practices, or copyright concerns. |
| Complex problem solving | High-level design and creative problem solving remain limited. |
LLM fundamentals: fine-tuning and LoRA
GH-300 is not a machine-learning theory exam, but the official material includes enough LLM vocabulary to test basic distinctions.
Fine-tuning
Fine-tuning trains on a smaller target dataset while using knowledge from the pretrained source model. If a question asks which dataset adapts the model to a narrower task, think target dataset.
LoRA
LoRA, or Low-Rank Adaptation, adds smaller trainable parts to each layer instead of changing everything. The original model stays unchanged, which saves time and resources.
The facts brief says GitHub explicitly uses LoRA. The exam source contrasts LoRA against adapters and prefix-tuning. If the question asks for the GitHub-used approach that keeps the original model unchanged and trains smaller parts, choose LoRA.
| Concept | Correct cue | Distractor to avoid |
|---|---|---|
| Fine-tuning | Target dataset adapts a pretrained source model. | Training a model from nothing. |
| LoRA | Small trainable parts are added; the original model is unchanged. | Changing every model weight. |
| Adapters | Named as a contrast in the source. | Do not pick it when the question asks what GitHub explicitly uses. |
| Prefix-tuning | Named as another contrast in the source. | Do not confuse it with LoRA. |
Domain 3 exam traps
These are the patterns that make the data-flow objective hard. They are all grounded in the canonical facts brief and are safe to use when reviewing practice questions.
| Trap | Correct answer | Why the wrong answer sounds tempting |
|---|---|---|
| Proxy vs toxicity | Proxy blocks prompt injection and jailbreak attempts inbound; toxicity filtering checks harmful content and personal data. | Both are filters, so stems blur them together. |
| FIM position | FIM is part of context gathering and prompt building in step 1. | Because it has a name, it looks like a separate step. |
| Outbound security | Post-processing includes checks for XSS and SQL injection, plus optional public-code matching. | Candidates assume security checks happen only before generation. |
| Retention | Editor completion prompts are discarded after the suggestion returns; outside-editor chat is typically retained 28 days. | Questions often omit the location qualifier. |
| Context figures | Use 200-500 lines and 4k tokens only as exam-source wording. | Current models are larger, so real-world memory can pull you away from the source. |
Inbound protects and builds the prompt. Outbound validates and delivers the response. If you can classify a step as prompt-side or response-side, most lifecycle questions become straightforward.
Rapid review: classify the data-flow clue
When a stem describes code before and after the cursor, adjacent open tabs, file paths, or languages and frameworks, it is testing step 1 context gathering. When it says prompt injection or jailbreak, it is testing the inbound proxy. When it says XSS, SQL injection, optional public-code matching, or a response being truncated or discarded, it is testing outbound post-processing.
Public-code matching appears in the outbound lifecycle, but the settings and indemnity consequences are covered in Suggestions matching public code and IP indemnity.
The night-before cheat sheet
Seven steps
1-4 inbound: context and FIM, proxy injection defense, toxicity filter, LLM generation.
5-7 outbound: response validation, delivery and feedback, repeat.
Both legs
Toxicity filtering runs inbound and outbound. The proxy runs inbound and outbound. Inbound proxy means injection defense. Outbound proxy means quality checks and optional public-code matching.
Retention
Editor completions discard prompts once the suggestion returns. Chat outside the editor, CLI, Mobile, and GitHub.com chat are typically retained 28 days.
Training and models
Free and Pro are not excluded from training by default. Business and Enterprise are. Fine-tuning uses a target dataset and source model. GitHub explicitly uses LoRA.