Microsoft GH-600 Developing in Agentic AI Systems Exam Practice Test

The Copilot setup workflow must be present on the repository’s default branch to be used for new coding-agent sessions. Moving .github/workflows/copilot-setup-steps.yml there ensures the setup procedure is discoverable for every newly created agent environment.

The package-registry credential should be stored as an environment secret in the Copilot environment and exposed using the required variable name, NPM_TOKEN. This permits package installation without committing the token into workflow YAML, instructions, source code, or pull requests.

Disabling network controls does not resolve missing credentials and expands risk unnecessarily. Repository instructions can describe setup expectations but cannot safely substitute for an injected runtime secret. Adding the raw token to YAML permanently exposes it to repository history and anyone with repository access.

Study-guide topics: ephemeral environments, setup workflows, environment secrets, and secure dependency access.

===============

In plan mode, Copilot creates a plan before implementation and saves that plan to plan.md. This makes the proposed approach available for review, refinement, and continuation rather than immediately executing repository changes.

The plan file creates a durable handoff point between planning and implementation. A developer can inspect the proposed work, assess dependencies and risk, adjust tasks, and decide whether implementation should proceed. This separation is essential for workflows that require approval before modification.

Plan mode does not automatically open a pull request or create a branch. It also does not begin implementation simply because a plan was generated. Those actions require a subsequent transition to an implementation workflow or a direct instruction from the user.

Study-guide topics: planning mode, durable plans, state persistence, and staged agent execution.

===============

CodeQL findings and secret-detection results are the intended selections. CodeQL analyzes code for patterns associated with vulnerabilities and programming errors. Secret scanning identifies sensitive material, including supported credential and token patterns, that may have been introduced into the generated changes. Both provide concrete security evidence that a reviewer can evaluate alongside the proposed fix.

Linting generally evaluates coding conventions and selected correctness rules; a generic linting failure is not necessarily a security finding. Median time to merge measures delivery performance rather than the security of a particular change.

The wording of option D creates an important technical distinction. Dependency vulnerability detection is also a genuine automated security signal. GitHub explicitly documents dependency analysis alongside CodeQL and secret scanning in the coding agent’s security checks. Repository-level dependency alerts, however, may concern existing vulnerabilities rather than changes introduced by this pull request. B and C are the clearest intended pair, but D cannot be dismissed as unrelated to security.

Reviewers should determine whether each finding applies to the proposed changes and whether the underlying vulnerability has actually been resolved.

Relevant curriculum topics are automated evaluation signals, security scanning, and evidence-based assessment of agent outputs.

Answer area

Correct selection

To draft and open the pull request, use

GitHub Copilot coding agent assigned to an issue

To automate the pull request review before the human review, use

GitHub Copilot code review on the pull request

The workflow requires two distinct capabilities: implementing the requested change and reviewing the resulting change. Assigning the issue to the Copilot coding agent supplies the implementation task. The agent can inspect the repository, modify code, add or update tests, and open a pull request for review. This matches the requirement to turn an assigned issue into a proposed implementation. GitHub—Use Copilot cloud agent on GitHub .

Copilot code review examines the pull request and produces review feedback. It therefore belongs after the implementation has produced a reviewable diff and before the workflow requests the intended human review. The automation must request or configure this review at the appropriate stage; assigning an issue alone does not establish the complete review sequence.

CI, automated code review, and human review provide complementary checks. CI validates executable requirements such as tests and lint rules. Automated review highlights potential code issues. Human reviewers retain responsibility for assessing the proposed change and satisfying applicable approval requirements. GitHub—Copilot code review .

Study-guide topics: agent integration into the SDLC, issue-to-pull-request workflows, automated validation, and human review.

===============

Starting a new Copilot Chat conversation establishes a separate conversational context for the documentation task. The unrelated refactoring exchanges remain in their original conversation instead of continuing to influence the new thread. This directly addresses the requirement to separate tasks while preserving other conversations.

Conversation history contributes information beyond the latest prompt. Earlier instructions, assumptions, terminology, and design decisions can continue to affect subsequent responses within the same session. A fresh conversation provides a clear task boundary, allowing the developer to supply the feature requirements and relevant documentation context explicitly.

Changing from sidebar chat to inline chat changes the interaction surface; it does not provide the same explicit separation of conversational history. Referencing a file supplies relevant context but does not reliably remove earlier instructions. The maximum requests setting governs agent execution limits rather than conversation isolation. Clearing history is also unnecessary when the previous work can remain available in its own session.

A new conversation can still receive applicable repository instructions and deliberately supplied context; it is the previous conversation that is separated.

Study-guide topics: conversational state, context isolation, and task boundaries. Reference: VS Code—Manage agent sessions .

===============

The most effective intervention occurs before the issue becomes an executable assignment. Acceptance criteria define the observable conditions that constitute success, while implementation directions establish boundaries and clarify how the work should proceed. Providing both before assignment reduces the need for the agent to infer missing requirements during planning.

Applied to this scenario, the issue should distinguish required outcomes from optional improvements and identify constraints that the implementation must respect. Where steps are ambiguous, the author should resolve the ambiguity or explicitly require clarification before execution. Reviewable criteria also give the agent and maintainers a shared basis for evaluating whether the resulting changes satisfy the original request.

Options A and D intervene after assignment or execution has begun. They may support later correction, but they do not prevent the initial plan from being based on unclear directions. Option C addresses dependency availability, which is a separate environmental concern.

The governing design principle is to make the task sufficiently definite before delegating action. Relevant curriculum topics include defining inputs and success criteria, validating agent plans, and separating preparation from execution.

The correct selection is --allow-all . GitHub Copilot CLI uses a permission model for potentially consequential operations such as invoking tools, modifying files, accessing filesystem paths, running shell commands, and reaching external URLs. Normally, these operations can require explicit approval. The --allow-all startup option grants all available permissions for the session, allowing Copilot to execute those operations without prompting for approval on each individual action. GitHub also provides --yolo as an alias for the same permission configuration.

This option is appropriate only when the execution environment is sufficiently isolated and trusted. GitHub specifically recommends using broad permissions in a sandbox or similarly disposable environment because the agent can modify or delete files and execute commands autonomously once approval barriers are removed.

/compact manages conversation context rather than permissions. --agent=Task selects an agent profile and does not globally pre-authorize tool execution. The GH-600 study guide explicitly assesses configuring agent tools, tool permissions, execution contexts, and safe autonomous actions , making permission scoping a core operational skill.

Study Guide Reference Topics: Implement Tool Use and Environment Interaction; configure agent tool permissions; evaluate execution context; safe autonomous execution.

===============

Signal

Execution context

The eyes emoji reaction appears on the issue.

The agent acknowledges the assignment and will create the draft pull request.

The pull request timeline shows Copilot started work.

The agent session is actively running and generating live logs.

A draft pull request exists, but GitHub Actions checks are not running.

A human must manually approve and run the workflows.

The eyes reaction signals that Copilot has acknowledged the issue assignment. It is an early lifecycle indicator that the coding agent accepted the work and will begin its workflow.

A pull-request timeline event showing that Copilot started work indicates an active session. This is the appropriate place to observe ongoing status updates and session activity while the agent creates or revises the draft pull request.

When the draft pull request exists but its workflows have not started, the likely state is pending manual authorization. GitHub can require a user with write access to approve and run workflows associated with the pull request, especially where the workflow originates from an untrusted context or requires explicit approval.

These indicators are complementary: issue reactions establish acknowledgement, timeline events show active execution, and inactive checks can identify an approval gate rather than an agent failure.

Study-guide topics: asynchronous coding agents, execution signals, workflow approval, and pull-request observability.

===============

Statement

Answer

The agent responded with messages.

Yes

The agent can edit files in the repository.

No

The agent analyzed files in the repository.

Yes

The log contains successful message-return events, confirming that the agent responded. It also shows successful model activity associated with the agent session, which supports the conclusion that the agent processed available information.

The log does not provide evidence of an actual file-edit tool invocation or successful repository write. An editAgent panel label identifies the interaction context; it is not equivalent to proof that the agent had or used file-edit permissions. Therefore, the correct response for file-edit capability is No.

The model responses and session activity demonstrate analysis, but they do not establish every possible capability of the agent. Effective log analysis distinguishes between evidence of observed actions and assumptions based on an agent’s name, panel, or intended role.

Study-guide topics: log interpretation, evidence-based evaluation, tool-call analysis, and capability verification.

===============

Target

Correct selection

Condition identifying the pull request author

github.event.pull_request.user.login == ' github-copilot[bot] '

r.user.type ===

' User '

r.user.login !==

' github-copilot[bot] '

The first target must inspect the pull request’s author rather than the account that triggered the workflow. The expression github.event.pull_request.user.login identifies that author, whereas github.actor identifies the initiating actor and can differ during subsequent workflow activity. Using the bot identity supplied in the question, the selected condition identifies pull requests that the blocking step must reject.

The review predicate then requires an approved review, an existing reviewer object, a reviewer type of User, and a login different from the specified bot. These selections implement the intended distinction between a human approval and an automated review.

For merge enforcement, the resulting check must also be required by branch protection or a repository ruleset. A failed workflow alone does not universally prevent merging. The review-querying job additionally needs appropriate pull-request read permission. A production implementation should evaluate current effective approvals and rerun when reviews change, rather than accepting any historical approval indefinitely. It should also match the actual bot login recorded in its event payload.

Relevant curriculum topics are enforcing human review, identifying accountable actors, and implementing controls outside the model’s instructions.

The agent_session_id field associates an activity with a particular agent session. It supports correlation of multiple events generated during the same agent-run lifecycle and helps investigators trace the origin of a change.

The actor_is_agent field identifies whether the event actor is an agent. This is the direct classification field for distinguishing agent-initiated activity from activity initiated by a human account or another type of actor.

The user field can identify an account associated with the event but does not independently establish that the action was performed by an agent. The action field identifies the recorded operation, such as a repository or workflow action, but does not itself identify the actor type.

Using both selected fields provides the most useful audit result: one confirms agent origin and the other supplies the session-level correlation needed to investigate the agent’s activity sequence.

Study-guide topics: audit fields, agent attribution, session correlation, and accountability.

===============

Yes, Yes, Yes

Comprehensive and Detailed 150 to 250 words of Explanation From Agentic AI Developer/Course Guide/topics:

All three statements are supported by explicit operational signals in the supplied logs.

The first statement is Yes . Each relevant session records Passing 1 MCP server(s) to SDK: [github] followed by github: type=http. These entries show that the GitHub MCP server is being supplied to the agent session as an available remote MCP integration. The CLIMCPServerEnabled=false entry concerns the separate CLI MCP configuration flag and does not negate the subsequently logged GitHub server passed to the SDK.

The second statement is Yes . The logs explicitly state workspace isolation mode selected for session and indicate that worktree creation is skipped. Therefore, the selected session isolation mechanism is workspace isolation rather than a separate Git worktree.

The third statement is Yes . Two distinct entries identify new Copilot CLI sessions with isNewSession: true: one beginning with session ID de04f0fe... and another with 6852c5dc.... Later MCP/configuration events do not contain another isNewSession: true record, so the evidence shows exactly two newly started sessions.

This type of log interpretation directly maps to the GH-600 requirement to identify failures and execution characteristics by analyzing logs, traces, outputs, and workflow artifacts , and to use operational signals when evaluating multi-agent behavior.

Study Guide Reference Topics: Perform Evaluation, Error Analysis, and Tuning; log and trace analysis; execution-context evaluation; MCP observability; multi-agent session analysis.

Repository custom agent profiles belong in .github/agents/ and use Markdown files with agent configuration and instructions. When the intended changes concern the agents’ roles, available tools, or operating guidance, these profiles are the appropriate implementation point.

An agent profile provides a durable definition that can be shared with other repository contributors. Keeping that definition under version control makes changes reviewable and enables the team to associate a particular agent configuration with the code revision used during evaluation. This is useful when diagnosing why an agent’s behavior changed after its instructions or capabilities were modified.

Editor settings and MCP connection settings address different concerns. They can affect the environment in which an agent operates, but they do not replace the agent’s own profile. Changing a server connection is appropriate for transport or authentication requirements; changing an agent profile is appropriate for agent behavior and capability selection.

The source selects C. Its applicability depends on the omitted planned changes actually concerning custom agent configuration.

Study-guide topics: agent profiles, configuration management, and SDLC traceability. Reference: GitHub—Creating custom agents .

===============

Target

Selection

Dropdown 1

' search '

Dropdown 2

' read '

The visible configuration describes an implementation planner. Providing search and read supports the information-gathering work needed to produce a technically grounded plan: locating relevant code and inspecting its contents. The listed documentation tools supplement repository context with external technical reference material.

This tool selection also establishes a practical boundary between planning and implementation. A planner can explain proposed changes and produce Markdown in its response without needing permission to modify repository files. Granting editing or command-execution capabilities would expand its authority beyond the visible planning role.

The distinction between generating Markdown and saving a Markdown file is important. The selected tools support producing a plan in conversation. If the requirements instead demanded that the planner write that plan directly into the repository, an appropriate file-writing capability or a separate persistence step would be necessary.

Tool names must also resolve to capabilities available in the configured environment. Merely listing a documentation tool does not install or authenticate its MCP server.

Study-guide topics: tool selection, least-privilege planning, and environment capabilities. Reference: VS Code—Use tools with agents .

The agent session log is the appropriate starting point when the reported problem concerns an agent’s interaction, execution sequence, or tool activity within the development environment. It provides information closer to the failing behavior than repository-level workflow usage statistics.

A useful investigation establishes what the agent was asked to do, which operations it attempted, what responses those operations returned, and where progress stopped or diverged from the intended result. Session diagnostics can help distinguish an instruction problem from an unavailable tool, a rejected operation, or an execution error. VS Code also provides detailed chat debugging facilities for inspecting interactions and diagnosing failures.

GitHub Actions usage metrics primarily describe workflow consumption. Runner logs are relevant when evidence points to a hosted workflow or runner problem. The token permissions block becomes relevant when the failure concerns authorization to a GitHub resource. None should be assumed to be the root cause before examining the reported execution.

The PDF selects B; the underlying Dev1 incident description is not included, so this selection assumes a session-level agent issue.

Study-guide topics: diagnostic evidence, tool-call inspection, and failure localization. Reference: VS Code—Debug chat interactions .

The intended distinction is between delegating analytical work and allowing the agent to provide the final approval of its own work. Approving all Git commits would remove independent review of changes that include security-sensitive remediation and compatibility modifications across multiple projects.

Human validation of assessment.md is similarly important because the assessment determines the scope and direction of the upgrade. Incorrectly classified dependencies, missed projects, or an incomplete vulnerability analysis can propagate into the implementation plan. Microsoft’s guidance explicitly recommends reviewing the assessment for missing projects, problematic dependencies, and application-specific concerns before proceeding.

Generating the assessment and checking whether a task file exists are appropriate automated activities. An agent can also inspect the plan’s dependency relationships and flag potential ordering problems. Such assistance does not transfer final accountability for accepting the plan.

The wording should not be interpreted as prohibiting automated assessment validation. Agents can run valuable consistency checks; the unsafe delegation is treating those checks as sufficient independent approval of their own conclusions.

Study-guide topics: human oversight, independent validation, and approval boundaries. Reference: Microsoft Learn—Best practices for GitHub Copilot upgrade .

===============

Statement

Answer

The .github/upgrades folder contains all the required reports.

Yes*

The tasks.md file contains all the changes and their implementation status.

Yes

The assessment.md file lists all the breaking changes and their implementation status.

No

*For the standard upgrade-generated reports, including their scenario subfolder.

GitHub Copilot upgrade stores its generated workflow state under .github/upgrades/{scenarioId}. This includes the assessment, plan, task tracking, and related scenario records. Consequently, the parent .github/upgrades folder contains the standard upgrade reports through its scenario subdirectories. The PDF’s marked “No” for the first statement conflicts with that documented storage structure unless an additional, unstated reporting requirement applies.

The tasks.md file tracks execution progress. It identifies the upgrade tasks and records their implementation status as work proceeds. In this context, “all the changes” means the tracked upgrade tasks, rather than a complete line-by-line replacement for the Git diff.

The assessment has a different purpose. It describes the application’s compatibility issues, breaking changes, dependencies, and upgrade scope. It is not the authoritative execution-status record. Identifying a breaking change in an assessment does not establish that its remediation has been implemented or validated.

These files collectively separate the original findings, planned response, and execution progress, making the upgrade reviewable across sessions.

Study-guide topics: durable workflow state, progress tracking, and generated artifacts. Reference: Microsoft Learn—GitHub Copilot upgrade state management .

===============

The selected location is appropriate when the planned developer changes concern repository-defined custom agents. Files under .github/agents/ define reusable agent roles that can be stored and reviewed alongside the application code. Their .agent.md format combines YAML configuration with Markdown instructions describing the agent’s responsibilities and expected behavior.

This arrangement allows the team to maintain specialized planning, implementation, and review roles consistently. Changes to an agent’s instructions or configuration can pass through the repository’s normal pull request process, providing a record of how the development workflow evolves.

The alternative locations serve different configuration purposes. .vscode/mcp.json configures MCP server connections for the workspace. .vscode/settings.json contains editor settings. Neither is the primary location for defining a repository’s custom agent profile.

The question’s planned changes are not reproduced in its supplied statement. Therefore, B is the source-selected answer under the custom-agent interpretation; a requirement specifically about MCP connectivity would require different configuration.

Study-guide topics: custom agent architecture, repository-scoped configuration, and version-controlled development workflows. Reference: VS Code—Custom agent file locations and structure .

===============

The tasks.md file is the execution-tracking document for the upgrade scenario. It records individual tasks, their validation criteria, and their completion status. Microsoft’s upgrade walkthrough specifically directs users to review this file when checking the status of every upgrade step.

A task can include several concrete verification activities, such as restoring dependencies, building the solution, correcting compilation errors, running the test suite, and rerunning tests after fixes. Reviewing these entries reveals whether implementation has merely been attempted or has satisfied the defined checks.

The assessment identifies upgrade issues and scope; it does not serve as the live record of completed work. A plan describes intended actions and ordering, which also differs from evidence that execution and testing succeeded.

The phrase “before App1 is upgraded” requires temporal care. Before execution, tasks.md identifies the steps and checks that must be performed. It cannot prove that future tests have already passed. Completion and test results become available as the agent executes and updates the tasks.

Study-guide topics: execution validation, task status, and acceptance criteria. Reference: Microsoft Learn—Execute and verify a Copilot upgrade .

===============

Copilot memory is an organization-level capability. Configuring it through the organization’s Copilot settings establishes the governance boundary, availability, and policy controls consistently for the developers and repositories covered by that organization.

Personal settings are unsuitable because they create inconsistent behavior between developers and do not provide centralized administration. A repository-level configuration can supply repository instructions and scoped context, but it does not replace the organization-level control that enables and governs the memory capability. An individual agent profile defines role behavior, tool access, prompts, and delegation settings; it is not the tenant-level location for enabling Copilot memory.

Organization configuration is particularly important when agents must retain approved context, recurring preferences, and workflow guidance across sessions without each developer configuring behavior independently. Central governance also allows administrators to maintain predictable controls over which organizational information is available to Copilot.

Study-guide topics: organizational governance, persistent context, and centralized agent configuration.

The mcp-servers property connects a custom agent to the Model Context Protocol servers required for its planned work. MCP configuration makes defined external tools and services available to the agent in a controlled, declarative manner.

Adding a broad natural-language instruction such as “Use all available tools” does not configure a server connection, authenticate a tool, or define which external capabilities are available. It is also poor least-privilege design because it encourages unrestricted tool use without establishing a technical permission boundary.

Setting tools: [] removes all configured tools and would prevent the agent from using required capabilities. Deleting the tools line could cause the agent to inherit or expose a broader default tool set than intended. Repository-wide instructions can guide behavior, but they do not replace the agent-specific configuration needed to associate MCP servers with that agent.

A well-designed configuration identifies only the MCP servers necessary for the role, supplies secrets through approved environment mechanisms, and limits the resulting tools to the agent’s defined task.

Study-guide topics: MCP integration, agent tool configuration, and least-privilege environment access.

===============

A fine-grained PAT restricted to product-api provides an enforceable repository-level authorization boundary for agent1. GitHub fine-grained personal access tokens can be limited to selected repositories and assigned only the repository permissions required by the workload. Consequently, even if agent1 attempts to access billing-service or infra-terraform, the credential does not authorize access to those repositories. GitHub specifically recommends fine-grained PATs when repository access must be restricted to particular repositories.

This directly aligns with the GH-600 objective to configure an agent ' s scope to a specific repository and define execution boundaries through repository context and permissions. Microsoft Learn defines execution context as including the repository an agent can access and emphasizes that repository scope is the first boundary limiting agent behavior.

Option A provides behavioral guidance but is not a security authorization boundary. Option B controls the permissions available to the workflow token but does not, by itself, establish the required cross-repository credential restriction. Option D only prevents certain push operations; it does not stop agent1 from reading or otherwise accessing the other repositories.

Study Guide Reference Topics: Implement Tool Use and Environment Interaction → execution context and boundaries; repository-specific agent scope; tool permissions; least-privilege authentication.