Free Microsoft Developing in Agentic AI Systems GH-600 Exam Questions

The filter action:artifact.destroy selects the audit event associated with manual deletion of a workflow artifact. It directly targets the activity described in the scenario, allowing the investigator to examine the recorded actor and associated event details.

A repository filter narrows the search to a particular repository but does not distinguish artifact deletion from other recorded operations. It can usefully accompany the action filter when investigating a specific project. A workflow-run action concerns workflow execution rather than the manual removal of its stored artifacts. The generic operation:remove option does not select the documented artifact deletion event.

The investigation should correlate the deletion event with its timestamp and repository information, then inspect the actor recorded for that event. This identifies the account associated with the action; additional context may be needed when an application or automated identity performed it.

Artifact retention and audit logging serve separate purposes. Retention controls how long outputs are normally preserved, while the audit log records relevant administrative and user activity. Searching the audit log does not restore deleted content.

Study-guide topics: accountability, evidence preservation, actor attribution, and audit trails. Reference: GitHub---Organization audit log events.

Human-in-the-loop execution provides the appropriate autonomy level because the agent's actions affect production deployment and access to production secrets. The agent can prepare changes and perform permitted validation, while an authorized person approves the production transition. This retains useful automation while placing human judgment at the consequential execution boundary.

GitHub Actions environments support required reviewers. A job referencing a protected environment must satisfy its protection rules before proceeding. GitHub explicitly documents that when approval is required, the job cannot access environment secrets until a required reviewer approves it. The approval gate therefore controls an operational capability, rather than merely asking the model to behave cautiously.

Option A removes the oversight required by the scenario. Option B prevents the agent from performing the requested deployment work. Option D restricts execution to non-production environments and consequently does not provide a controlled route to production.

The workflow should bind deployment to the protected production environment and align reviewer permissions with organizational policy. Relevant curriculum topics are risk-based autonomy levels, explicit authorization for compliance-sensitive changes, and least-privilege execution.

An MCP server exposing the internal documentation is the appropriate solution because Model Context Protocol extends Copilot with information and capabilities located outside the repository's native context. GitHub describes MCP as a mechanism for integrating Copilot with external systems, enabling it to obtain context or invoke functionality that would otherwise be unavailable from the codebase alone.

This architecture is appropriate for proprietary library documentation because the internal API knowledge can remain centrally maintained rather than being duplicated into every repository. The MCP integration can expose a controlled documentation lookup/search capability, allowing Copilot to retrieve relevant definitions, usage patterns, or internal API information when required.

Option A is inferior because copilot-instructions.md is designed for concise repository-specific instructions and conventions, not as a substitute for a potentially large external documentation corpus. GitHub recommends it for persistent guidance such as building, testing, and repository conventions. Option C would remove context rather than add proprietary knowledge. Plan mode affects workflow sequencing and does not provide new external information.

Study Guide Reference Topics: Implement Tool Use and Environment Interaction; MCP-based context augmentation; external knowledge integration; tool-mediated retrieval.

The primary failure is insufficient task definition. ''Fix the login bug'' does not identify the observed behavior, expected behavior, reproduction conditions, affected component, or completion criteria. The agent must infer these details, creating a substantial risk of incomplete changes or work outside the intended scope. A clear issue description supplies the information needed to construct and implement an appropriate plan.

For this scenario, the description should identify how the login failure occurs, which authentication path is affected, what successful behavior looks like, and which existing behavior must remain intact. Relevant error messages, reproduction steps, and expected tests make the task independently verifiable. These details turn an ambiguous request into a bounded engineering assignment.

Enabling memory does not supply missing requirements reliably. MCP rate limits govern service interaction rather than task clarity. Additional setup resources address environmental capacity or dependency preparation, not uncertainty about what must change.

The corrective action therefore belongs at task intake, where developers define the agent's inputs and success conditions. The relevant curriculum topics are defining agent inputs, outputs, and success criteria and mitigating poorly scoped task assignments.

A preToolUse hook evaluates the proposed command before the shell tool executes it. The hook can inspect command arguments and return permissionDecision: 'deny' when a pattern indicates a high-risk operation, while allowing low-risk commands to continue automatically.

This is the correct enforcement point because the requirement is preventive. A policy banner only informs the user or agent; it cannot block execution. Logging submitted prompts provides audit information but does not evaluate the actual shell command. Ignoring the hooks directory simply removes the repository-scoped enforcement mechanism.

The hook should use precise matching rules. For example, it can deny sudo, destructive recursive deletion, and piping untrusted remote content into a shell, while allowing commands such as git status, package metadata inspection, and test execution. Rules should avoid broad string matching that blocks harmless commands merely because they contain similar text.

Study-guide topics: pre-execution guardrails, shell-command approval, policy enforcement, and autonomous tool safety. Reference: GitHub Copilot---Hooks reference.

The correct answer is Edit mode. GitHub Copilot's Edit mode is designed for situations where the developer wants granular control over which files may be changed and what modifications should be applied. In Edit mode, you explicitly select the working set of files, provide natural-language instructions describing the required changes, and then review the proposed edits before accepting or discarding them. GitHub describes Edit mode as appropriate for quick, specific updates to a defined set of files and for scenarios where the developer wants tighter control over the editing process.

Agent mode differs because Copilot determines which files and tools are required, can execute terminal commands, and iterates autonomously toward completing the task. Ask mode is intended primarily for explanations, questions, and code suggestions rather than coordinated file modification. Plan mode generates an implementation strategy before execution and is appropriate when the approach must be reviewed before coding begins.

Therefore, where the requirement explicitly emphasizes selecting specific files and prescribing precise edits rather than delegating scope determination to the agent, Edit mode provides the correct level of developer control.

Study Guide Reference Topics: Prepare agent architecture and SDLC processes; selecting appropriate Copilot interaction modes; controlled code modification; human-directed versus autonomous execution.

The required change concerns one agent's behavior, making its custom agent profile the appropriate scope. The file .github/agents/agent1.agent.md defines instructions for agent1. Its Markdown instruction body can specify the required JSON structure, mandatory properties, allowed values, and prohibition of explanatory prose or Markdown fences.

Repository-wide instructions apply more broadly and could alter the behavior of agent2 and agent3, contrary to the requirement. The setup workflow prepares the execution environment rather than defining the agent's response contract. A file under .github/instructions uses instruction applicability rules; naming it after an agent does not automatically bind it exclusively to that agent.

The evaluation finding should be converted into a precise behavioral requirement and tested against representative inputs. For example, checks should distinguish valid JSON from text containing a JSON fragment and should reject missing fields or unexpected properties.

An agent instruction improves adherence but is not a mathematical guarantee of schema compliance. Production consumers should validate the returned object before using it. Relevant curriculum topics are revising instructions based on evaluation results and specifying expected output constraints.

The configuration must be changed on the agent that performs the delegation. Orchestrator is responsible for coordinating the workflow, so its allowed subagent list must include Summarizer. Adding the new agent to that list makes it an available delegation target alongside Planner, Implementer, and Reviewer.

An agent's agents property identifies the custom agents it can invoke as subagents. The tools property serves a different purpose: it identifies available capabilities such as reading files, editing code, or invoking agents. Adding a custom agent's name to the tools list does not register that agent as a callable subagent. The agent invocation tool must also be available; the scenario already establishes that Orchestrator delegates to other subagents.

Changing Reviewer's configuration would enable a relationship originating from Reviewer, rather than the requested direct invocation by Orchestrator. A handoff also represents a different interaction pattern from having the orchestrating agent invoke a subagent and receive its result.

Availability does not force execution on every task. Orchestrator's instructions should indicate when a summary is required and what information it should contain.

Study-guide topics: delegation permissions, orchestrator responsibilities, and specialized subagents. Reference: VS Code---Subagents.

The Copilot setup workflow must be present on the repository's default branch to be used for new coding-agent sessions. Moving .github/workflows/copilot-setup-steps.yml there ensures the setup procedure is discoverable for every newly created agent environment.

The package-registry credential should be stored as an environment secret in the Copilot environment and exposed using the required variable name, NPM_TOKEN. This permits package installation without committing the token into workflow YAML, instructions, source code, or pull requests.

Disabling network controls does not resolve missing credentials and expands risk unnecessarily. Repository instructions can describe setup expectations but cannot safely substitute for an injected runtime secret. Adding the raw token to YAML permanently exposes it to repository history and anyone with repository access.

Study-guide topics: ephemeral environments, setup workflows, environment secrets, and secure dependency access.

GitHub Copilot CLI plan mode is specifically designed for situations in which an implementation strategy must be developed and reviewed before code modifications begin. In plan mode, Copilot can inspect and analyze the repository, ask clarifying questions, and construct a structured implementation plan while protecting project files from normal editing operations. The resulting plan can then be reviewed and approved before Copilot proceeds with implementation. GitHub explicitly describes plan mode as a mechanism for identifying misunderstandings before code is written and maintaining human control over complex, multi-step work.

Option A is incorrect because --agent=AGENT selects a custom agent; it does not establish a planning-and-approval phase. Option B is the opposite of the requirement: --allow-all grants Copilot broad permission to use tools, paths, and URLs without individual approval. Option D is also incorrect because /compact relates to managing conversation/context size rather than establishing an implementation plan.

Therefore, switching to plan mode is the appropriate first action when the development process requires human review and agreement before changes are applied.

Study Guide Reference Topics: Prepare agent architecture and SDLC processes; human-in-the-loop development; planning before implementation; controlled agent execution.