The correct configuration is Enable the Public Code Filter and configure enterprise proxy controls.

Enabling the Public Code Filter helps ensure that Copilot does not surface code that matches public repositories, which reduces exposure to licensed or copied snippets and supports compliance guardrails. Configuring enterprise proxy controls allows you to enforce strict data handling so prompts and suggestions from private repositories are not retained or used for model training, which satisfies the requirement that private code must never be included in training data.

Disable telemetry and turn off Copilot for all users is not appropriate because it removes the benefit of Copilot entirely and telemetry settings do not control whether private prompts or code are used for model training. Copilot Business and Enterprise already provide policy controls that address training and data usage without disabling the product.

VPC Service Controls is a Google Cloud perimeter feature and it does not configure Copilot or GitHub Enterprise, so it does not address how Copilot handles private repository data.

Use Copilot only within private GitHub Actions workflows does not control Copilot training behavior. Workflow context does not change the product’s data usage or training policies, so this does not meet the stated requirement.

Full AWS Practitioner Certification Question