Free GitHub Certified: Agentic AI Developer (GH-600) Sample Questions

Correct answer: A — In the session memory file at /memories/session/plan.md

• A. The Plan agent automatically writes its structured plan to this session memory file, making it an inspectable artifact that persists across sessions and is available for later review.
• B. Planning happens before any pull request exists, and the Plan agent does not open a pull request on its own as part of producing a plan.
• C. The planning workflow does not automatically file a GitHub issue; the plan is captured as a session memory artifact instead.
• D. This file holds standing custom instructions that shape agent behavior generally, not the output of a single planning session.

Correct answer: B — A clear problem description, acceptance criteria, and hints about which files are likely involved

• A. A one-line report with no scope or acceptance criteria leaves the agent guessing about what a successful fix looks like, which invites unpredictable changes. This is too vague to serve as a well-formed task definition.
• B. A clear problem statement paired with acceptance criteria and file hints gives the agent a bounded, verifiable target, which is exactly what defining inputs and success criteria before delegation means. This combination lets both the agent and the reviewer judge whether the resulting change actually solves the problem.
• C. Dumping the entire file tree does not narrow scope or define what a correct outcome looks like; it adds noise rather than the specific constraints the agent needs. Volume of context is not a substitute for clear acceptance criteria.
• D. A deadline alone says nothing about what the finished work must satisfy, so the agent still lacks measurable success criteria. Time pressure without scope definition tends to produce rushed, poorly bounded changes.

Correct answer: A — The final decision to review, test, and merge the pull request

• A. Final review, testing, and the merge decision are the human checkpoint that agents are not permitted to bypass; the agent cannot merge to the default branch itself, and this step catches issues the agent may have missed. This ownership stays with a person no matter how strong the agent's track record is.
• B. Commit message writing is one of the routine steps the coding agent can perform on its own as part of implementation. It is not a decision point that needs to stay human-owned.
• C. Running an already-configured linter is a mechanical, automated step the agent can trigger as part of its workflow. It does not require a human to perform it directly.
• D. Generating the plan is typically produced by the agent itself before execution; it is reviewed by a human, but the generation step is agent-owned, not the human-owned action described here. The human's role is approving the plan, not producing it.

Correct answer: A — The CLI executes file edits and commands without asking permission for each step

• A. This is correct: granting full permissions removes the per-action confirmation prompts, letting the CLI modify files and run commands unattended for the rest of the task.
• B. Incorrect. Autopilot-style full permissions expand what the CLI can do without asking, rather than narrowing it to read-only operations.
• C. Incorrect. Granting broad execution permission is about skipping confirmation prompts, not about changing whether output goes to a local commit versus a pull request.
• D. Incorrect. Removing per-action approval prompts does not turn off session logging; the audit trail continues to be produced regardless of the permission level chosen.

Correct answer: A — user with repository write access

• A. This is correct: GitHub requires approval from a user with repository write access before an Actions workflow triggered by the agent's pull request will run.
• B. Incorrect. Billing administrators manage cost and license settings; they are not the role responsible for approving CI runs from agent PRs.
• C. Incorrect. There is no built-in mechanism where a second AI agent serves as the human approval gate for Actions runs.

Correct answer: A — The agent loads normally with read and edit access; the unrecognized name is silently ignored.

• A. Unrecognized tool names are ignored rather than causing an error, which lets product-specific tool names be listed safely alongside valid aliases.
• B. Configuration loading does not fail on an unrecognized entry; it is simply dropped while the rest of the list is honored.
• C. An invalid entry does not invalidate the other valid entries in the same list; read and edit remain active.
• D. Unrecognized names are dropped, not turned into new server registrations, since no such auto-provisioning behavior exists.

Correct answer: A — github

• A. This built-in server is the one documented as providing read-only tools scoped to the source repository.
• B. This built-in server instead provides browser automation limited to localhost, not repository-scoped read access.
• C. No built-in MCP server by this name ships with custom agents by default.

Correct answer: A — A personal access token stored as a Copilot secret named COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN

• A. Storing a personal access token as a Copilot secret with the COPILOT_MCP_ prefix and referencing it lets the GitHub remote MCP server authenticate for access beyond the current repository.
• B. A plain repository variable is not treated as a Copilot secret and args is not evaluated for a remote server, so this would neither authenticate the request nor grant broader scope.
• C. There is no org-wide access flag inside an individual server entry; broader repository access is granted through an authenticated token, not a boolean setting.
• D. A remote endpoint cannot be reinterpreted as a local process by changing type to local; the type must match how the server is actually reached, and this would break the connection rather than widen access.

Correct answer: A — Registry only

• A. Registry only restricts MCP usage to servers listed in the configured registry, which matches the goal of blocking any server that has not been vetted and published there.
• B. Allow all removes restrictions entirely and permits any MCP server, which is the opposite of what the organization is trying to enforce.
• C. Enabled everywhere governs whether MCP support itself is turned on across the organization; it does not restrict which servers may be used once MCP is enabled.
• D. There is no policy option that disables only local servers while leaving remote servers unrestricted; access is governed by the registry-based policy, not by server transport.

Correct answers: A, B, C — Creating a new branch to hold its work; Writing commit messages and pushing commits to that branch; Opening a pull request for the completed work

• A. Branch creation is one of the core autonomous actions the agent automates for a task, forming the destination for its committed work.
• B. The agent automates commit message writing and pushing to its working branch as part of standard autonomous execution.
• C. Opening a pull request to present the completed work is a standard autonomous action the agent performs once its task is done.
• D. The agent cannot mark its own pull request as Ready for review; that step requires human action, so this is not within its autonomous capability.
• E. The agent cannot approve or merge a pull request; merging authority is intentionally withheld and requires human review and approval.
• F. Workflows triggered by the agent's pushed code do not run automatically by default; a user with write access must click Approve and run workflows first.

Correct answer: A — vscode

• A. Setting target to vscode scopes the custom agent to the VS Code environment specifically, which is exactly the restriction described in the scenario.
• B. github-copilot is the other valid value for this property, but it scopes the agent to the github.com interface, the opposite of what the scenario asks for.
• C. cloud-agent is not a documented valid value for the target property, which only accepts vscode or github-copilot.

Correct answer: A — Closing or discarding the agent's pull request and branch, since the change was never merged into the default branch.

• A. This is correct. Because the agent cannot push to or merge into the default branch, the migration only ever existed on its own branch, so simply closing the pull request and discarding the branch fully undoes the exposure.
• B. Incorrect. The agent has no push access to the default branch at all, so it could never force-push over its history in the first place; this describes a capability the agent does not have.
• C. Incorrect. A compensating migration assumes the original change already reached a deployed environment, which contradicts the premise that the change stayed isolated on the agent's own branch.
• D. Incorrect. There is no administrator console that snapshots and restores the whole repository on the agent's behalf; recovery here relies on the branch never having merged, not on a restore feature.

Correct answer: A — It attempts to resolve the identified issue itself before completing the pull request.

• A. This is correct. The agent attempts to resolve issues identified by its pre-completion scans, including secret detection, dependency checks, and CodeQL, before it finishes the pull request.
• B. Incorrect. Secret scanning and related checks run as part of the agent's own pre-completion process, not only after a human has already approved the pull request.
• C. Incorrect. The agent's remediation is limited to the code and pull request it is working on; it does not reach into external production systems to rotate live credentials.
• D. Incorrect. Silently discarding the branch and starting over with no record would erase the finding rather than surface and address it, which contradicts the documented remediation behavior.

Correct answer: A — Repository memory under /memories/repo/ is workspace-scoped and does not transfer between different projects

• A. This is correct: repository memory is tied to a single workspace, so conventions captured while working in one project do not carry over into a different, unrelated project.
• B. This statement about session memory is true in general but does not explain why cross-repository conventions fail to carry over, since the scenario is about repository-scoped, not session-scoped, knowledge.
• C. This is true of user memory in isolation, but the conventions in question were captured as repository-level knowledge, not as a universal user preference, so this does not explain the observed behavior.
• D. Write-access validation governs who can create a GitHub-hosted fact, not why local VS Code repository memory fails to transfer between separate workspaces.

Correct answer: A — /memories/session/plan.md

• A. This is the correct path: the Plan agent writes its implementation plan into session memory specifically, at this file location, which is cleared when the conversation ends.
• B. This path belongs to repository memory, a different scope that persists across conversations in a workspace; the Plan agent does not write plan.md there.
• C. This path belongs to user memory, which stores cross-workspace personal preferences, not the Plan agent's session-specific implementation plan.

Correct answer: B — Re-verify the claim against the current code, then store a corrected memory that reflects what the citations now show.

• A. Incorrect — discarding the fact entirely throws away a still-useful pattern instead of correcting it, and the system is designed to heal stale memories rather than delete the underlying insight.
• B. Correct — the memory system performs just-in-time verification by checking cited code locations before use, and when a citation no longer supports the claim, the agent stores a corrected version reflecting current evidence, which is the self-healing behavior described for this system.
• C. Incorrect — treating a stored fact as permanently authoritative contradicts the system's citation-checking design, which exists specifically to catch facts that have gone stale as code changes.
• D. Incorrect — the described workflow handles drift through automated re-verification and correction rather than routing every citation mismatch to a human, which would undermine the purpose of the self-healing mechanism.

Correct answer: B — Have the agent re-check its recorded decisions and current state against the durable artifacts it produced earlier, then reconcile before proceeding.

• A. Incorrect — unaddressed contradictions tend to compound over a long-running task rather than self-resolve, since nothing forces the agent to reconcile them.
• B. Correct — reviewing the earlier recorded decisions and artifacts, then explicitly reconciling the current action against them, is how drift is detected and corrected during extended execution without losing prior progress.
• C. Incorrect — discarding all completed work is a costly overreaction when the earlier progress is still valid; the goal is to reconcile the drift, not erase legitimate progress.
• D. Incorrect — turning off validation removes the mechanism that would catch further contradictions, making the drift more likely to persist rather than be corrected.

Correct answer: A — When a memory is validated as still correct during use, the agent is encouraged to store it again, which refreshes its timestamp and resets the inactivity clock

• A. The system avoids complex curation by having agents re-store a memory when it is confirmed valid during use, which refreshes its timestamp; this organic refresh is what protects actively used, accurate memories from the unused-for-28-days expiration.
• B. There is no documented usage-count threshold that grants permanent exemption; the refresh mechanism is based on re-storing the memory to reset its timestamp, not on accumulating a use count.
• C. No manual administrator marking step is described for exempting individual memories from expiration; the refresh happens automatically through agent behavior during retrieval and validation.
• D. The design intentionally avoids a separate archival tier or duplication step, favoring a simple timestamp-refresh approach over maintaining parallel long-term storage.

Correct answer: A — A Request button appears directly in the reviewer picker on draft pull requests

• A. Correct. A Request button now appears in the reviewer picker directly on draft pull requests, removing the need to search for Copilot to get preliminary feedback before publishing.
• B. Incorrect. Copilot's review is a Comment-only review and does not trigger an automatic merge of a draft pull request.
• C. Incorrect. The improvement makes requesting review on drafts easier, not disabled.
• D. Incorrect. There is no requirement to convert a draft pull request into a CodeQL workflow to request review.

Correct answer: A — copilot-instructions.md gives repository-wide review guidance, while AGENTS.md communicates broader architectural context and intentional patterns

• A. Correct. copilot-instructions.md supplies repository-wide guidance for reviews, while AGENTS.md communicates broader architecture and intentional design patterns that help shape contextually appropriate feedback.
• B. Incorrect. The two files serve complementary, not identical, purposes and can both be used together.
• C. Incorrect. AGENTS.md is read by Copilot code review to shape feedback, not limited to environment execution.
• D. Incorrect. copilot-instructions.md remains a supported mechanism and is not deprecated by AGENTS.md.

Correct answer: A — Context or environment issue, because the ephemeral environment was missing configuration the task depended on

• A. The plan and code were sound, and the failure traces directly to a missing API key in the ephemeral environment. That is a condition external to the agent's own logic and tool usage, which is exactly what defines a context or environment issue.
• B. The scenario explicitly states the plan and code changes were logically correct, so the requirements were understood properly. A reasoning error would require a flaw in the agent's decision-making, which is not present here.
• C. Nothing indicates the wrong test runner was invoked; the tests failed because a credential was absent, not because of how the test tool was called.
• D. The plan is described as logically correct, so there is no indication a necessary step was omitted from it. The missing piece was environmental configuration, not a planning gap.

Correct answer: A — context or environment issue

• A. Missing network access in the ephemeral environment is a condition outside the agent's own logic and tool choices, which is the defining trait of a context or environment issue.
• B. Tool misuse would involve the agent invoking a tool incorrectly, not the environment lacking network access to a registry.
• C. A plan artifact mismatch describes a divergence between the agent's stated plan and its final output, not a blocked network path in the environment.

Correct answer: A — head

• A. Correct — Copilot code review pulls repository custom instructions and agent context from the pull request's head branch, so edits made within that PR are reflected in its own reviews immediately.
• B. Incorrect — the base branch is the target of the merge; Copilot code review does not wait for changes to land there before applying updated instructions.
• C. Incorrect — there is no separate 'default branch only' rule for reading custom instructions during a pull request review; the head branch of the PR is what's read.

Correct answer: A — lifecycle hook

• A. Correct — a lifecycle hook runs custom logic at a defined point in the session, such as immediately before a tool call, making it the mechanism for inserting a required approval step.
• B. Incorrect — feedback mechanisms like thumbs up/down or `/feedback` report on past behavior after the fact; they don't gate or intercept a tool call before it runs.
• C. Incorrect — this refers to checking dependencies against a vulnerability database, which is unrelated to gating tool execution with an approval step.

Correct answers: A, C, F — Restricting each agent's tools list to only the capabilities its assigned task requires.; Assigning each agent a non-overlapping task boundary so their file edits don't collide.; Using Fleet mode to dispatch agents in parallel while each retains its own isolated context.

• A. Correct. Restricting each agent's tool list to only what its task needs enforces least privilege and limits how much one agent's actions can interfere with another's.
• B. Incorrect. Giving every agent identical, unrestricted MCP access removes the boundaries that keep parallel agents from stepping on each other's work.
• C. Correct. Non-overlapping task boundaries mean agents are less likely to edit the same files or duplicate the same work when running in parallel.
• D. Incorrect. A single shared tools list across all agents removes the per-agent restriction that isolation depends on.
• E. Incorrect. Allowing unrestricted auto-invocation regardless of task overlap increases the chance that multiple agents pick up the same or conflicting work.
• F. Correct. Fleet mode is designed to dispatch multiple sub-agents in parallel while each keeps its own isolated execution context, supporting safe simultaneous execution.

Correct answer: B — unset (omitted)

• A. Incorrect. An empty list disables all tool access rather than granting access to every available tool.
• B. Correct. Omitting the tools property is what grants the agent access to every available tool instead of a restricted subset.
• C. Incorrect. Pointing tools at a single MCP server would scope the agent to that server's tools only, not grant access to everything available.

Correct answer: A — The stream of subagent lifecycle events recorded for the session

• A. The recorded stream of selection, start, completion, failure, and deselection events for the session is exactly the durable record that allows an analyst to replay the sequence after the fact.
• B. The firewall allow-list controls what network destinations an agent's environment can reach; it says nothing about the order in which sub-agents were invoked.
• C. Seat licensing usage reflects billing and consumption across users, not the sequence of events within a single multi-agent session.
• D. Frontmatter is fixed configuration written before any run starts; it does not change per invocation and cannot show what actually happened during a specific run.

Correct answers: A, B, C — The pull request note naming which custom agent produced the changes; The Agent-Logs-Url trailer linking the commit to its full session logs; The captured subagent lifecycle event stream for that session

• A. This note gives reviewers immediate attribution of which agent produced the work, a core piece of a review/audit artifact set.
• B. This trailer is the permanent link from the commit to the complete session reasoning, making it essential for auditing why a change was made.
• C. This event stream is the durable record of selections, starts, completions, and failures across agents, letting reviewers reconstruct decisions and handoffs after the fact.
• D. Ruleset text describes merge policy for the whole repository and does not document what any particular agent decided or produced during the workflow.
• E. A local developer's installed extensions are personal tooling configuration and have no bearing on what agents decided or produced in the workflow.
• F. A billing invoice reflects license consumption costs and provides no information about agent decisions, handoffs, or outcomes.

Correct answer: A — The sub-agent's tools property was misconfigured, granting write access

• A. A read-only sub-agent committing a change directly contradicts its declared tools property, so the most direct explanation is that its tool configuration was overridden or misconfigured to include write-capable tools.
• B. A context window that is too small would cause the sub-agent to lose relevant history or reasoning quality, not grant it a tool it was never configured to have.
• C. Branch protection rulesets control who can merge into a protected branch, but a disabled ruleset would not explain how a read-only agent obtained the ability to write a commit at all.
• D. MCP registry access policy governs which MCP servers an agent may connect to, not whether a sub-agent's own tools property includes write-capable actions like committing a file.

Correct answer: A — ephemeral, GitHub-hosted

• A. Each cloud agent session runs on a fresh, ephemeral GitHub-hosted virtual machine, so a failed or compromised session leaves no persistent state that could affect later runs.
• B. A persistent self-hosted runner would retain state between sessions, which is the opposite of the isolation the ephemeral runner model is designed to provide.
• C. A shared org-wide runner would risk one session's failure or misbehavior affecting other concurrent sessions, contrary to the per-session isolation cloud agent actually uses.

Correct answer: A — The filename, minus its .md or .agent.md extension.

• A. Correct. The identifier that lets a lower-level profile override a higher-level one of the same agent is the filename with its extension stripped, which is why renaming a file changes an agent's identity.
• B. Incorrect. The description is used for intent-matching and documentation purposes, not for deduplicating an agent's identity across levels.
• C. Incorrect. The commit SHA is used to pin which version of a profile an already-started session follows, not to identify which agent a file represents.
• D. Incorrect. The target field selects an environment such as an editor or cloud agent context; it does not serve as the agent's cross-level identifier.

Correct answers: A, B, C — Delete the agent profile file via a normal commit, leaving its full history visible in the repository's Git log.; Leave existing pull requests and issue comments that reference credentials-bot untouched rather than editing or deleting them.; Communicate the retirement so other teams stop assigning new work to the agent going forward.

• A. Correct. A normal delete commit removes the agent from active use while the file's prior history stays intact in the log, preserving the record of what the agent was and did.
• B. Correct. Keeping historical references untouched preserves the trail of which agent produced which change, which is exactly what auditability of past work requires.
• C. Correct. Announcing the retirement stops new work from being assigned to a agent that is being phased out, which is part of managing the lifecycle transition cleanly, alongside preserving prior records.
• D. Incorrect. Force-pushing to erase commit history destroys the very audit trail the team is trying to preserve, making past decisions untraceable.
• E. Incorrect. Rewriting historical descriptions to remove agent attribution actively undermines auditability rather than supporting it.

Correct answer: A — The workflow permission change is a security risk requiring tighter review, while the typo fix is low operational risk needing only standard review

• A. Expanding token permissions can enable privilege escalation and is a security concern warranting elevated scrutiny, while a wiki typo is trivial and low-impact.
• B. Risk classification depends on what the change touches, not on which actor or permission set produced it.
• C. A documentation typo has minimal blast radius and does not outweigh a token permission change in operational or security risk.
• D. Broadened token permissions are fundamentally a security concern first, even though compliance implications may also follow.

Correct answer: A — A lifecycle hook such as onPreToolUse that runs custom validation before tool execution

• A. This is correct because SDK lifecycle hooks such as onPreToolUse and onPostToolUse are designed exactly for inserting custom safety checks, audit logging, and approval workflows around tool execution.
• B. This is incorrect because a periodic scan of past commits only detects issues after the fact and does not intercept a tool call before it runs.
• C. This is incorrect because a separate reviewing agent adds complexity without using the built-in hook mechanism designed for pre-execution checks.
• D. This is incorrect because a static allowlist file cannot perform dynamic validation or audit logging at the moment each tool call happens.

Correct answer: A — write access to the repository

• A. This is correct because the default trigger guardrail limits who can assign tasks to the agent to users who already hold write access to the repository.
• B. This is incorrect because organization admin access is a broader privilege than what is required; write access at the repository level is the actual gating condition.
• C. This is incorrect because read access alone does not permit triggering the agent; write access is the required threshold.