Free Practice Questions for Microsoft GH-600 Exam

A fine-grained PAT restricted to product-api provides an enforceable repository-level authorization boundary for agent1. GitHub fine-grained personal access tokens can be limited to selected repositories and assigned only the repository permissions required by the workload. Consequently, even if agent1 attempts to access billing-service or infra-terraform, the credential does not authorize access to those repositories. GitHub specifically recommends fine-grained PATs when repository access must be restricted to particular repositories.

This directly aligns with the GH-600 objective to configure an agent ' s scope to a specific repository and define execution boundaries through repository context and permissions. Microsoft Learn defines execution context as including the repository an agent can access and emphasizes that repository scope is the first boundary limiting agent behavior.

Option A provides behavioral guidance but is not a security authorization boundary. Option B controls the permissions available to the workflow token but does not, by itself, establish the required cross-repository credential restriction. Option D only prevents certain push operations; it does not stop agent1 from reading or otherwise accessing the other repositories.

Study Guide Reference Topics: Implement Tool Use and Environment Interaction → execution context and boundaries; repository-specific agent scope; tool permissions; least-privilege authentication.

Statement

Selection

The command will prevent runaway loops.

Yes

The command will allow the agent to use all tools.

Yes

The command will allow targeted human intervention at key decision points.

No

The first statement is Yes in the context of autopilot continuation. The option --max-autopilot-continues 10 places a ceiling on automatic continuation messages, preventing the agent from initiating an unlimited sequence of those continuations. This limit should not be confused with a timeout for every subprocess or a guarantee that an individual command cannot hang.

The second statement is Yes because --yolo is an alias for granting all permissions. It authorizes tool, path, and URL access without ordinary permission prompts, subject to any stronger enforced restrictions. The script therefore provides broad authority rather than a restricted dependency-maintenance permission set.

The third statement is No. Combining programmatic prompting with autopilot and broad permissions is designed for execution without routine human interaction. The command does not establish explicit approval checkpoints before consequential actions. An operator’s ability to interrupt execution is different from a workflow that deliberately pauses for review.

The Bash options improve shell error handling but do not create agent approval gates or replace the continuation limit.

Relevant curriculum topics are autonomy levels, execution bounds, and the distinction between permission approval and autonomous continuation.

Requirement

Correct action

Create durable run outputs that are downloadable after completion

Use the upload-artifact action and configure artifact retention in the CI workflow.

Provide ongoing, human-reviewable task progress signals inside the pull request

Watch for pull request body updates and pull request timeline events.

Provide a real-time view of agent actions for audit and troubleshooting

Select View session to stream live agent logs.

The requirements distinguish three forms of evidence: retained outputs, reviewable progress, and live execution details. Each serves a different purpose during an extended agent task.

The upload-artifact action preserves files generated by the workflow, such as validation reports, implementation plans, and decision records. Configuring retention determines how long those files remain available after execution. The workflow must actually generate and upload the relevant records; artifact storage does not automatically capture every agent decision. GitHub documents artifacts as the mechanism for storing and sharing workflow-produced data. GitHub Actions—Store and share data .

Pull request body updates and timeline events provide progress information where reviewers already evaluate the proposed change. They associate the evolving work with the pull request and help reviewers follow iterations without reconstructing the entire session.

Selecting View session exposes detailed agent activity during execution, supporting immediate troubleshooting and inspection. Assigning an issue starts work, while approving workflows authorizes CI execution; neither substitutes for the required evidence mechanisms. GitHub—Troubleshoot Copilot cloud agent .

Study-guide topics: durable task state, execution observability, artifact retention, and traceable progress.

===============

Target

Value

tools

[ ' execute ' ]

agents

[ ' security-reviewer ' ]

The agents property identifies the custom agent profile that lead-dev is permitted to invoke. Adding security-reviewer establishes the delegated specialist relationship required by the workflow.

The source configuration uses the execute tool for the lead agent’s subagent invocation capability. Without the appropriate invocation capability, adding the target agent name alone does not permit the orchestration step to run.

The user-invocable: false value can remain. It prevents direct selection of lead-dev in the user interface while still allowing it to operate as part of an orchestrated workflow. This is useful for internal coordinator roles that should be reached only through a parent workflow.

Read, search, or edit tools do not identify the target specialist. They may be needed for other lead-dev tasks, but they do not solve the failed subagent invocation.

Study-guide topics: subagent invocation, custom agent frontmatter, delegation permissions, and orchestrated security review.

===============

The errorOccurred hook is designed to respond to failures during an agent session. It can invoke a shell command when an agent execution encounters an error, enabling automated capture of diagnostic information, cleanup actions, or controlled escalation.

A postToolUse hook runs after individual tool calls, whether or not the overall agent execution subsequently fails. It is suitable for logging or post-processing tool activity but does not specifically target an execution failure. A session-end event indicates that a session has ended; it does not necessarily represent an error condition. agentStop is not the defined hook required by the scenario.

Failure hooks should be used carefully. Their commands should collect only the required diagnostics and must avoid exposing secrets in logs. If the failure itself results from a prohibited operation, the hook should preserve the reason and relevant metadata so that a human can distinguish policy denial from a technical execution failure.

Study-guide topics: lifecycle hooks, failure handling, diagnostic collection, and accountability.

===============

D is the best answer among the available choices. The key detail is that Summarizer is explicitly listed in Orchestrator ' s agents property. Current VS Code agent orchestration behavior states that explicitly listing a custom agent in the parent ' s agents array overrides disable-model-invocation: true for that coordinator. Therefore, option A does not explain the failure in this scenario.

Likewise, user-invocable: false does not prohibit programmatic or subagent invocation. It merely prevents users from manually selecting that agent from the agent picker; this setting is commonly used specifically for worker agents that should only operate as subagents.

Option C is also incorrect because Summarizer ' s function is to produce a summary, not modify repository content. It therefore does not inherently require editing tools.

The agents property establishes which subagents the coordinator is permitted to invoke; it does not itself define the sequence of workflow transitions. Handoffs are the mechanism for defining explicit guided transitions between agents. If the workflow expects Summarizer to run as the next defined phase but no corresponding transition/invocation exists, the missing handoff can explain why execution stops after Modifier.

Study Guide Reference Topics: Orchestrate Multi-Agent Coordination; custom subagents; agents restrictions; agent invocation controls; sequential handoffs and workflow transitions.

===============

An environment variable mapping connects the defined environment secret to the exact environment variable required by the MCP server at startup. This allows the MCP server to receive the API key without embedding the secret’s value in repository configuration.

A default environment variable is not sufficiently targeted because it can expose data more broadly than necessary. An Actions repository secret is a secret storage mechanism, but the scenario already uses an environment secret and requires controlled injection into the MCP server process. The JSON configuration should reference the mapping or variable name; it must not contain the raw key value.

The mapping provides the least-privilege boundary: only the intended secret is made available, under the expected variable name, to the MCP process that needs it. It also supports credential rotation because the stored secret can be replaced without modifying committed MCP configuration.

Study-guide topics: MCP credential injection, environment secrets, least privilege, and secure tool startup.

===============

The filter action:artifact.destroy selects the audit event associated with manual deletion of a workflow artifact. It directly targets the activity described in the scenario, allowing the investigator to examine the recorded actor and associated event details.

A repository filter narrows the search to a particular repository but does not distinguish artifact deletion from other recorded operations. It can usefully accompany the action filter when investigating a specific project. A workflow-run action concerns workflow execution rather than the manual removal of its stored artifacts. The generic operation:remove option does not select the documented artifact deletion event.

The investigation should correlate the deletion event with its timestamp and repository information, then inspect the actor recorded for that event. This identifies the account associated with the action; additional context may be needed when an application or automated identity performed it.

Artifact retention and audit logging serve separate purposes. Retention controls how long outputs are normally preserved, while the audit log records relevant administrative and user activity. Searching the audit log does not restore deleted content.

Study-guide topics: accountability, evidence preservation, actor attribution, and audit trails. Reference: GitHub—Organization audit log events .

A job-level concurrency group coordinates executions that share the same group value across workflow runs. The expression ci-${{ github.ref }} places executions for the same ref into the same group while allowing other refs to use independent groups.

Under the default concurrency behavior, a group permits at most one running execution and one pending execution. When another execution enters an occupied group, it becomes pending; an existing pending execution can be replaced by the newer one. This is a concurrency limit rather than a guarantee that every queued execution will eventually run.

The strategy.max-parallel setting controls simultaneous jobs generated by a matrix within a workflow run. It does not establish the required coordination between separate workflow runs. A matrix definition also does not create a shared concurrency lock. The cancel-in-progress property controls whether an active execution is cancelled, but a cancellation expression alone does not define the necessary group.

Group names should be chosen carefully when multiple jobs or workflows share a repository, because identical names can coordinate those executions too.

Study-guide topics: job synchronization, concurrency groups, and bounded execution. Reference: GitHub Actions—Workflow syntax: job concurrency.

===============

Target 1 → A. contents: read

Target 2 → B. contents: write

Target 3 → F. pull-requests: write

The correct configuration applies the principle of least privilege to the workflow ' s GITHUB_TOKEN. At the workflow-level permissions: block, contents: read permits repository content to be checked out and inspected without granting modification capability. GitHub documents that when individual permissions are specified, unspecified permissions are set to none, providing a tighter security boundary than broadly assigning unnecessary scopes.

The update_artifacts job performs repository modifications, so contents: write is granted specifically to that job. Job-level permissions override the workflow-level configuration for that job, ensuring that the analysis job remains read-only while the repository-writing job receives only the additional authority it requires.

Creating or interacting with pull requests requires pull-requests: write . GitHub additionally controls whether workflows may create or approve pull requests through the repository or organization Allow GitHub Actions to create and approve pull requests setting; this capability must be explicitly enabled.

This directly aligns with the GH-600 study-guide objectives to scope permissions and execution contexts to enforce least privilege and require controlled authorization for higher-risk actions.