Microsoft GH-600 Practice Exam Questions & Answers

The agent_session_id field associates an activity with a particular agent session. It supports correlation of multiple events generated during the same agent-run lifecycle and helps investigators trace the origin of a change.

The actor_is_agent field identifies whether the event actor is an agent. This is the direct classification field for distinguishing agent-initiated activity from activity initiated by a human account or another type of actor.

The user field can identify an account associated with the event but does not independently establish that the action was performed by an agent. The action field identifies the recorded operation, such as a repository or workflow action, but does not itself identify the actor type.

Using both selected fields provides the most useful audit result: one confirms agent origin and the other supplies the session-level correlation needed to investigate the agent's activity sequence.

Study-guide topics: audit fields, agent attribution, session correlation, and accountability.

In plan mode, Copilot creates a plan before implementation and saves that plan to plan.md. This makes the proposed approach available for review, refinement, and continuation rather than immediately executing repository changes.

The plan file creates a durable handoff point between planning and implementation. A developer can inspect the proposed work, assess dependencies and risk, adjust tasks, and decide whether implementation should proceed. This separation is essential for workflows that require approval before modification.

Plan mode does not automatically open a pull request or create a branch. It also does not begin implementation simply because a plan was generated. Those actions require a subsequent transition to an implementation workflow or a direct instruction from the user.

Study-guide topics: planning mode, durable plans, state persistence, and staged agent execution.

Repository memory is supported by citations to the code that establishes the remembered fact. When a fact appears relevant to a new task, Copilot checks its supporting citations against the current branch before relying on it. This validation prevents an observation from an earlier repository state from being treated automatically as current truth.

The branch check is particularly important when work spans release branches, experimental changes, or pull requests that were never merged. A memory may have been accurate when created but no longer describe the code now being edited. If its supporting code is absent or no longer supports the claim, the remembered fact should not influence the task.

Option A incorrectly describes memory as permanently retained information requiring only manual intervention. Option B substitutes pull-request disposition for validation of the underlying evidence. Option C incorrectly treats repository knowledge as usable only by its original contributor.

The governing mechanism is evidence validation at the point of use, not an assumption that all previously stored information remains authoritative.

Relevant curriculum topics are task-relevant memory, stale-context prevention, and maintaining state consistency across branches and sessions.

A fine-grained PAT restricted to product-api provides an enforceable repository-level authorization boundary for agent1. GitHub fine-grained personal access tokens can be limited to selected repositories and assigned only the repository permissions required by the workload. Consequently, even if agent1 attempts to access billing-service or infra-terraform, the credential does not authorize access to those repositories. GitHub specifically recommends fine-grained PATs when repository access must be restricted to particular repositories.

This directly aligns with the GH-600 objective to configure an agent's scope to a specific repository and define execution boundaries through repository context and permissions. Microsoft Learn defines execution context as including the repository an agent can access and emphasizes that repository scope is the first boundary limiting agent behavior.

Option A provides behavioral guidance but is not a security authorization boundary. Option B controls the permissions available to the workflow token but does not, by itself, establish the required cross-repository credential restriction. Option D only prevents certain push operations; it does not stop agent1 from reading or otherwise accessing the other repositories.

Study Guide Reference Topics: Implement Tool Use and Environment Interaction execution context and boundaries; repository-specific agent scope; tool permissions; least-privilege authentication.

The correct answer is Edit mode. GitHub Copilot's Edit mode is designed for situations where the developer wants granular control over which files may be changed and what modifications should be applied. In Edit mode, you explicitly select the working set of files, provide natural-language instructions describing the required changes, and then review the proposed edits before accepting or discarding them. GitHub describes Edit mode as appropriate for quick, specific updates to a defined set of files and for scenarios where the developer wants tighter control over the editing process.

Agent mode differs because Copilot determines which files and tools are required, can execute terminal commands, and iterates autonomously toward completing the task. Ask mode is intended primarily for explanations, questions, and code suggestions rather than coordinated file modification. Plan mode generates an implementation strategy before execution and is appropriate when the approach must be reviewed before coding begins.

Therefore, where the requirement explicitly emphasizes selecting specific files and prescribing precise edits rather than delegating scope determination to the agent, Edit mode provides the correct level of developer control.

Study Guide Reference Topics: Prepare agent architecture and SDLC processes; selecting appropriate Copilot interaction modes; controlled code modification; human-directed versus autonomous execution.

Allowing only read and search removes approval friction for operations that inspect repository content without modifying it. The edit and execute tools remain available in the agent profile, but they continue to require explicit approval because they are not included in the command's approval bypass.

Using no option preserves the default approval behavior for all tools, including low-risk inspection tools, which does not meet the velocity requirement. Allowing all tools would remove the approval safeguard for file modifications and shell execution. Denying edit and execute prevents those tools from being used at all, rather than keeping them available under human control.

This design separates tool availability from automatic authorization. Read-only operations can proceed autonomously, while potentially impactful operations remain subject to a human decision at the point of use.

Study-guide topics: tool approval boundaries, least privilege, read-only execution, and controlled agent autonomy.

An environment variable mapping connects the defined environment secret to the exact environment variable required by the MCP server at startup. This allows the MCP server to receive the API key without embedding the secret's value in repository configuration.

A default environment variable is not sufficiently targeted because it can expose data more broadly than necessary. An Actions repository secret is a secret storage mechanism, but the scenario already uses an environment secret and requires controlled injection into the MCP server process. The JSON configuration should reference the mapping or variable name; it must not contain the raw key value.

The mapping provides the least-privilege boundary: only the intended secret is made available, under the expected variable name, to the MCP process that needs it. It also supports credential rotation because the stored secret can be replaced without modifying committed MCP configuration.

Study-guide topics: MCP credential injection, environment secrets, least privilege, and secure tool startup.