GH-600 Microsoft Developing in Agentic AI Systems Free Practice Exam Questions (2026 Updated)

Target 1 → A. contents: read

Target 2 → B. contents: write

Target 3 → F. pull-requests: write

The correct configuration applies the principle of least privilege to the workflow ' s GITHUB_TOKEN. At the workflow-level permissions: block, contents: read permits repository content to be checked out and inspected without granting modification capability. GitHub documents that when individual permissions are specified, unspecified permissions are set to none, providing a tighter security boundary than broadly assigning unnecessary scopes.

The update_artifacts job performs repository modifications, so contents: write is granted specifically to that job. Job-level permissions override the workflow-level configuration for that job, ensuring that the analysis job remains read-only while the repository-writing job receives only the additional authority it requires.

Creating or interacting with pull requests requires pull-requests: write . GitHub additionally controls whether workflows may create or approve pull requests through the repository or organization Allow GitHub Actions to create and approve pull requests setting; this capability must be explicitly enabled.

This directly aligns with the GH-600 study-guide objectives to scope permissions and execution contexts to enforce least privilege and require controlled authorization for higher-risk actions.

Option C is the intended answer because it grants a specific tool permission associated with Git rather than enabling every tool or allowing general file modification. The -p argument supplies the prompt programmatically, making the command suitable for a script that requests a summary of recent repository activity.

Option A grants unnecessarily broad tool access. Option B denies the Git capability needed to inspect commit history. Option D authorizes file-writing functionality, which is unrelated to producing a read-only summary.

The permission boundary nevertheless requires precise interpretation. Allowing Git is not inherently equivalent to enforcing read-only behavior: Git includes commands that modify files, repository state, and remote branches. A strict implementation should authorize only the required inspection commands, such as git log, using the permission-pattern syntax supported by the installed CLI version. The prompt should request summarization, but the prompt itself is not an access-control mechanism.

Therefore, C is the narrowest relevant selection among the supplied options, while command-specific restrictions are necessary to establish a genuinely read-only execution policy.

Relevant curriculum topics are selecting required tools, configuring tool permissions, and applying least privilege to agent execution.

Allowing only read and search removes approval friction for operations that inspect repository content without modifying it. The edit and execute tools remain available in the agent profile, but they continue to require explicit approval because they are not included in the command’s approval bypass.

Using no option preserves the default approval behavior for all tools, including low-risk inspection tools, which does not meet the velocity requirement. Allowing all tools would remove the approval safeguard for file modifications and shell execution. Denying edit and execute prevents those tools from being used at all, rather than keeping them available under human control.

This design separates tool availability from automatic authorization. Read-only operations can proceed autonomously, while potentially impactful operations remain subject to a human decision at the point of use.

Study-guide topics: tool approval boundaries, least privilege, read-only execution, and controlled agent autonomy.

===============

Answer area

Correct selection

To draft and open the pull request, use

GitHub Copilot coding agent assigned to an issue

To automate the pull request review before the human review, use

GitHub Copilot code review on the pull request

The workflow requires two distinct capabilities: implementing the requested change and reviewing the resulting change. Assigning the issue to the Copilot coding agent supplies the implementation task. The agent can inspect the repository, modify code, add or update tests, and open a pull request for review. This matches the requirement to turn an assigned issue into a proposed implementation. GitHub—Use Copilot cloud agent on GitHub .

Copilot code review examines the pull request and produces review feedback. It therefore belongs after the implementation has produced a reviewable diff and before the workflow requests the intended human review. The automation must request or configure this review at the appropriate stage; assigning an issue alone does not establish the complete review sequence.

CI, automated code review, and human review provide complementary checks. CI validates executable requirements such as tests and lint rules. Automated review highlights potential code issues. Human reviewers retain responsibility for assessing the proposed change and satisfying applicable approval requirements. GitHub—Copilot code review .

Study-guide topics: agent integration into the SDLC, issue-to-pull-request workflows, automated validation, and human review.

===============

The mcp-servers property connects a custom agent to the Model Context Protocol servers required for its planned work. MCP configuration makes defined external tools and services available to the agent in a controlled, declarative manner.

Adding a broad natural-language instruction such as “Use all available tools” does not configure a server connection, authenticate a tool, or define which external capabilities are available. It is also poor least-privilege design because it encourages unrestricted tool use without establishing a technical permission boundary.

Setting tools: [] removes all configured tools and would prevent the agent from using required capabilities. Deleting the tools line could cause the agent to inherit or expose a broader default tool set than intended. Repository-wide instructions can guide behavior, but they do not replace the agent-specific configuration needed to associate MCP servers with that agent.

A well-designed configuration identifies only the MCP servers necessary for the role, supplies secrets through approved environment mechanisms, and limits the resulting tools to the agent’s defined task.

Study-guide topics: MCP integration, agent tool configuration, and least-privilege environment access.

===============

A fine-grained PAT restricted to product-api provides an enforceable repository-level authorization boundary for agent1. GitHub fine-grained personal access tokens can be limited to selected repositories and assigned only the repository permissions required by the workload. Consequently, even if agent1 attempts to access billing-service or infra-terraform, the credential does not authorize access to those repositories. GitHub specifically recommends fine-grained PATs when repository access must be restricted to particular repositories.

This directly aligns with the GH-600 objective to configure an agent ' s scope to a specific repository and define execution boundaries through repository context and permissions. Microsoft Learn defines execution context as including the repository an agent can access and emphasizes that repository scope is the first boundary limiting agent behavior.

Option A provides behavioral guidance but is not a security authorization boundary. Option B controls the permissions available to the workflow token but does not, by itself, establish the required cross-repository credential restriction. Option D only prevents certain push operations; it does not stop agent1 from reading or otherwise accessing the other repositories.

Study Guide Reference Topics: Implement Tool Use and Environment Interaction → execution context and boundaries; repository-specific agent scope; tool permissions; least-privilege authentication.

Separate branches isolate each agent’s proposed changes and allow the team to inspect them independently. Adding a required status check for file-level overlap detects conflicting modifications before either pull request is merged, preventing one agent’s work from silently overwriting another’s changes.

A read-only tool configuration prevents both agents from making required changes, so it avoids conflict by eliminating implementation capability rather than controlling it. CODEOWNERS approval adds review accountability for a specific file but does not automatically detect overlap between independent agent outputs. A single concurrency group serializes entire workflows and reduces throughput even where the agents work on unrelated files.

The selected solution maintains parallel development while creating a merge-time control for the actual risk: overlapping file changes. It also produces reviewable evidence of the overlap check in pull request status results.

Branch isolation does not eliminate semantic conflicts, such as incompatible API assumptions. Teams should therefore combine overlap detection with normal pull request review and integration testing.

Study-guide topics: parallel agent coordination, branch isolation, merge controls, and conflict detection.

The API key should be stored as a secret in the Copilot environment and referenced by name from the MCP configuration. This keeps the secret value out of repository files, agent prompts, pull requests, and ordinary workflow output while allowing the MCP server to receive the required credential at runtime.

A plaintext key in a configuration file is unacceptable because repository history, forks, logs, and code review systems can expose it. A Codespaces user secret is scoped to a user development environment and does not provide the intended runtime secret for the Copilot agent environment. A GitHub Actions secret is useful for workflow expressions, but the scenario requires the key to be available to the MCP server configuration itself.

The prefixed environment-secret approach creates a clear boundary: the configuration references an identifier, while the secret value is resolved only in the authorized execution environment. This supports rotation without changing tracked configuration content.

Study-guide topics: MCP authentication, secrets management, secure environment configuration, and credential isolation.

The first statement is Yes . When an MCP server is configured for a repository, GitHub Copilot cloud agents can use the enabled MCP tools autonomously during assigned tasks. GitHub specifically notes that Copilot does not request interactive approval before invoking configured MCP tools, making careful tool allowlisting and credential protection important.

The second statement is No . For repository-level MCP integration, Copilot cloud agent currently supports MCP tools , but it does not support MCP resources or MCP prompts exposed by the server. Resources and prompts are available in other MCP-capable Copilot experiences, such as IDE chat, but they are not consumed by the cloud coding agent in this configuration.

The third statement is Yes under the planned configuration. Litware requires agent1 to access all available tools . GitHub custom-agent configuration supports this by omitting the tools property or specifying tools: [ " * " ]. Likewise, an MCP server can use " * " to expose all of its tools. Consequently, newly introduced MCP1 tools fall within that wildcard authorization and become available without individually adding each tool name.

Study Guide Reference Topics: MCP tool integration, custom-agent tool configuration, autonomous tool invocation, MCP capability boundaries, and least-privilege agent execution.

Repository custom agent profiles belong in .github/agents/ and use Markdown files with agent configuration and instructions. When the intended changes concern the agents’ roles, available tools, or operating guidance, these profiles are the appropriate implementation point.

An agent profile provides a durable definition that can be shared with other repository contributors. Keeping that definition under version control makes changes reviewable and enables the team to associate a particular agent configuration with the code revision used during evaluation. This is useful when diagnosing why an agent’s behavior changed after its instructions or capabilities were modified.

Editor settings and MCP connection settings address different concerns. They can affect the environment in which an agent operates, but they do not replace the agent’s own profile. Changing a server connection is appropriate for transport or authentication requirements; changing an agent profile is appropriate for agent behavior and capability selection.

The source selects C. Its applicability depends on the omitted planned changes actually concerning custom agent configuration.

Study-guide topics: agent profiles, configuration management, and SDLC traceability. Reference: GitHub—Creating custom agents .

===============

Statement

Answer

The .github/upgrades folder contains all the required reports.

Yes*

The tasks.md file contains all the changes and their implementation status.

Yes

The assessment.md file lists all the breaking changes and their implementation status.

No

*For the standard upgrade-generated reports, including their scenario subfolder.

GitHub Copilot upgrade stores its generated workflow state under .github/upgrades/{scenarioId}. This includes the assessment, plan, task tracking, and related scenario records. Consequently, the parent .github/upgrades folder contains the standard upgrade reports through its scenario subdirectories. The PDF’s marked “No” for the first statement conflicts with that documented storage structure unless an additional, unstated reporting requirement applies.

The tasks.md file tracks execution progress. It identifies the upgrade tasks and records their implementation status as work proceeds. In this context, “all the changes” means the tracked upgrade tasks, rather than a complete line-by-line replacement for the Git diff.

The assessment has a different purpose. It describes the application’s compatibility issues, breaking changes, dependencies, and upgrade scope. It is not the authoritative execution-status record. Identifying a breaking change in an assessment does not establish that its remediation has been implemented or validated.

These files collectively separate the original findings, planned response, and execution progress, making the upgrade reviewable across sessions.

Study-guide topics: durable workflow state, progress tracking, and generated artifacts. Reference: Microsoft Learn—GitHub Copilot upgrade state management .

===============

Yes, Yes, Yes

Comprehensive and Detailed 150 to 250 words of Explanation From Agentic AI Developer/Course Guide/topics:

All three statements are supported by explicit operational signals in the supplied logs.

The first statement is Yes . Each relevant session records Passing 1 MCP server(s) to SDK: [github] followed by github: type=http. These entries show that the GitHub MCP server is being supplied to the agent session as an available remote MCP integration. The CLIMCPServerEnabled=false entry concerns the separate CLI MCP configuration flag and does not negate the subsequently logged GitHub server passed to the SDK.

The second statement is Yes . The logs explicitly state workspace isolation mode selected for session and indicate that worktree creation is skipped. Therefore, the selected session isolation mechanism is workspace isolation rather than a separate Git worktree.

The third statement is Yes . Two distinct entries identify new Copilot CLI sessions with isNewSession: true: one beginning with session ID de04f0fe... and another with 6852c5dc.... Later MCP/configuration events do not contain another isNewSession: true record, so the evidence shows exactly two newly started sessions.

This type of log interpretation directly maps to the GH-600 requirement to identify failures and execution characteristics by analyzing logs, traces, outputs, and workflow artifacts , and to use operational signals when evaluating multi-agent behavior.

Study Guide Reference Topics: Perform Evaluation, Error Analysis, and Tuning; log and trace analysis; execution-context evaluation; MCP observability; multi-agent session analysis.

Copilot memory is an organization-level capability. Configuring it through the organization’s Copilot settings establishes the governance boundary, availability, and policy controls consistently for the developers and repositories covered by that organization.

Personal settings are unsuitable because they create inconsistent behavior between developers and do not provide centralized administration. A repository-level configuration can supply repository instructions and scoped context, but it does not replace the organization-level control that enables and governs the memory capability. An individual agent profile defines role behavior, tool access, prompts, and delegation settings; it is not the tenant-level location for enabling Copilot memory.

Organization configuration is particularly important when agents must retain approved context, recurring preferences, and workflow guidance across sessions without each developer configuring behavior independently. Central governance also allows administrators to maintain predictable controls over which organizational information is available to Copilot.

Study-guide topics: organizational governance, persistent context, and centralized agent configuration.

The selected location is appropriate when the planned developer changes concern repository-defined custom agents. Files under .github/agents/ define reusable agent roles that can be stored and reviewed alongside the application code. Their .agent.md format combines YAML configuration with Markdown instructions describing the agent’s responsibilities and expected behavior.

This arrangement allows the team to maintain specialized planning, implementation, and review roles consistently. Changes to an agent’s instructions or configuration can pass through the repository’s normal pull request process, providing a record of how the development workflow evolves.

The alternative locations serve different configuration purposes. .vscode/mcp.json configures MCP server connections for the workspace. .vscode/settings.json contains editor settings. Neither is the primary location for defining a repository’s custom agent profile.

The question’s planned changes are not reproduced in its supplied statement. Therefore, B is the source-selected answer under the custom-agent interpretation; a requirement specifically about MCP connectivity would require different configuration.

Study-guide topics: custom agent architecture, repository-scoped configuration, and version-controlled development workflows. Reference: VS Code—Custom agent file locations and structure .

===============

The agent session log is the appropriate starting point when the reported problem concerns an agent’s interaction, execution sequence, or tool activity within the development environment. It provides information closer to the failing behavior than repository-level workflow usage statistics.

A useful investigation establishes what the agent was asked to do, which operations it attempted, what responses those operations returned, and where progress stopped or diverged from the intended result. Session diagnostics can help distinguish an instruction problem from an unavailable tool, a rejected operation, or an execution error. VS Code also provides detailed chat debugging facilities for inspecting interactions and diagnosing failures.

GitHub Actions usage metrics primarily describe workflow consumption. Runner logs are relevant when evidence points to a hosted workflow or runner problem. The token permissions block becomes relevant when the failure concerns authorization to a GitHub resource. None should be assumed to be the root cause before examining the reported execution.

The PDF selects B; the underlying Dev1 incident description is not included, so this selection assumes a session-level agent issue.

Study-guide topics: diagnostic evidence, tool-call inspection, and failure localization. Reference: VS Code—Debug chat interactions .

The copilot/* toolset grants the agent access to the Copilot-provided tools while avoiding unrelated tool groups. This directly meets the requirement to allow only the Copilot toolset for the test agent.

Keeping tool-a and tool-b would expand access beyond the stated requirement. Using github/* would expose the broader GitHub tool group rather than limiting the profile to the Copilot toolset. The MCP configuration retains its server structure; changing the server property name does not configure which tools the agent may use.

Toolsets are an important control surface for specialized agents. They let an architect define a narrow capability set for testing, planning, review, or implementation roles. The selected toolset should still be backed by an available and authorized MCP configuration; naming a toolset does not bypass server authentication or policy restrictions.

Study-guide topics: MCP toolsets, custom agent capabilities, and least-privilege tool access.

===============

Target

Value

tools

[ ' execute ' ]

agents

[ ' security-reviewer ' ]

The agents property identifies the custom agent profile that lead-dev is permitted to invoke. Adding security-reviewer establishes the delegated specialist relationship required by the workflow.

The source configuration uses the execute tool for the lead agent’s subagent invocation capability. Without the appropriate invocation capability, adding the target agent name alone does not permit the orchestration step to run.

The user-invocable: false value can remain. It prevents direct selection of lead-dev in the user interface while still allowing it to operate as part of an orchestrated workflow. This is useful for internal coordinator roles that should be reached only through a parent workflow.

Read, search, or edit tools do not identify the target specialist. They may be needed for other lead-dev tasks, but they do not solve the failed subagent invocation.

Study-guide topics: subagent invocation, custom agent frontmatter, delegation permissions, and orchestrated security review.

===============

Starting a new Copilot Chat conversation establishes a separate conversational context for the documentation task. The unrelated refactoring exchanges remain in their original conversation instead of continuing to influence the new thread. This directly addresses the requirement to separate tasks while preserving other conversations.

Conversation history contributes information beyond the latest prompt. Earlier instructions, assumptions, terminology, and design decisions can continue to affect subsequent responses within the same session. A fresh conversation provides a clear task boundary, allowing the developer to supply the feature requirements and relevant documentation context explicitly.

Changing from sidebar chat to inline chat changes the interaction surface; it does not provide the same explicit separation of conversational history. Referencing a file supplies relevant context but does not reliably remove earlier instructions. The maximum requests setting governs agent execution limits rather than conversation isolation. Clearing history is also unnecessary when the previous work can remain available in its own session.

A new conversation can still receive applicable repository instructions and deliberately supplied context; it is the previous conversation that is separated.

Study-guide topics: conversational state, context isolation, and task boundaries. Reference: VS Code—Manage agent sessions .

===============

Target

Correct selection

tools

[ ' search ' , ' read ' ]

user-invocable

false

The agent needs inspection capabilities without file-modification capabilities. Setting tools to [ ' search ' , ' read ' ] gives it the ability to locate relevant code and examine file contents while excluding the editing capability supplied by edit. This is appropriate for a reviewer whose output consists of findings or recommendations rather than applied changes.

The alternative list containing edit would directly contradict the requirement. The agent tool enables delegation to another agent and is not the required substitute for searching and reading repository content. Likewise, none is not the documented way to configure a useful read-only tool list.

Setting user-invocable: false independently prevents manual selection of the agent. That property governs discoverability and invocation, while tools governs available capabilities. Both settings are necessary because hiding an agent does not make its operations read-only, and restricting its tools does not automatically hide it.

The result is a specialized reviewer that can be incorporated into a controlled workflow without being offered as a normal user-selected editing agent.

Relevant curriculum topics are tool selection, least-privilege permissions, and agent invocation controls.