GH-600 Exam Flashcards

Q: What score is required to pass GH-600?

The official GH-600 study guide states that a scaled score of 700 or greater is required to pass. A scaled score is not the same as a raw percentage of questions answered correctly.

Q: How many questions are on the GH-600 exam?

GitHub does not publish a fixed GH-600 question count. Microsoft notes that certification exam question counts can change, so prepare from the official skills measured rather than assuming a specific item total.

Q: How long is the GH-600 exam?

The official certification page gives candidates 120 minutes to complete the proctored assessment and notes that it may include interactive components.

Q: What are the six GH-600 exam domains?

The domains are agent architecture and SDLC processes (15–20%), tool use and environment interaction (20–25%), memory/state/execution (10–15%), evaluation/error analysis/tuning (15–20%), multi-agent coordination (15–20%), and guardrails/accountability (10–15%).

Q: What happens after a failed GH-600 attempt?

Microsoft's certification retake policy requires a 24-hour wait after the first failed attempt and 14 days between later attempts, with no more than five attempts within 12 months from the first attempt.

Q: Can I open Microsoft Learn during the GH-600 exam?

No. Microsoft's current exam-experience policy explicitly says in-exam Microsoft Learn access is not available on GitHub exams.

Question 1

What makes an SDLC step a good candidate for agent execution?

Accepted Answer

It is bounded, has clear inputs and outputs, and can be checked against explicit success criteria. Ambiguous ownership or an unverifiable result signals that the step needs further decomposition or human control.

Question 2

Which design signals a common agent anti-pattern: a broad goal with no checkpoints, or a bounded task with reviewable artifacts?

Accepted Answer

The broad goal with no checkpoints. It hides intermediate decisions and makes drift, unsafe action, and failure diagnosis harder; bounded stages with reviewable artifacts make control possible.

Question 3

Before an agent enters an SDLC workflow, what three contract elements should be explicit?

Accepted Answer

Inputs, outputs, and success criteria. Together they define what the agent may rely on, what it must produce, and how a reviewer or automated check decides whether the work succeeded.

Question 4

Why separate an agent's planning phase from its action phase?

Accepted Answer

Separation creates a control point: the proposed approach can be inspected and validated before tools change code, infrastructure, or workflow state.

Question 5

What should a structured agent plan expose so it can be validated?

Accepted Answer

The intended steps, dependencies, affected scope, expected outputs, and validation points. A plan that cannot be inspected cannot support a meaningful pre-execution gate.

Question 6

What is the purpose of validating an agent plan before execution?

Accepted Answer

To catch scope errors, unsafe assumptions, missing dependencies, and policy conflicts before they become actions. Validation asks whether the plan can achieve the stated criteria within its boundaries.

Question 7

How can a workflow prevent an agent from acting before its plan is approved?

Accepted Answer

Place a hard approval gate between planning and execution, with action-capable tools unavailable until the plan passes automated checks or receives the required human authorization.

Question 8

How should the degree of agent autonomy change as action risk increases?

Accepted Answer

Autonomy should narrow as operational, security, compliance, or irreversibility risk rises. Higher-risk actions need stronger guardrails, controlled paths, or human approval.

Question 9

What lets humans supervise autonomous work without reviewing every internal thought?

Accepted Answer

Inspectable artifacts in normal development tools—such as plans, branches, pull requests, logs, checks, and decision records—paired with intervention points for material risk or failure.

Question 10

What is the safest starting rule when selecting tools for an agent?

Accepted Answer

Give it only the tools required for the defined task. Adding capabilities that do not serve the success criteria expands the failure and security surface without improving the workflow.

Question 11

Why is naming a tool not enough to configure it safely for an agent?

Accepted Answer

The workflow must also define how the tool is invoked, what inputs and outputs are allowed, which environment it reaches, and how failures or invalid responses are handled.

Question 12

How should agent tool permissions relate to the task scope?

Accepted Answer

They should be least-privilege and task-specific: read, write, network, repository, and environment access should be no broader or longer-lived than the task requires.

Question 13

What role does an MCP server play when added as an agent tool?

Accepted Answer

It exposes defined external capabilities or context through the Model Context Protocol. The agent still needs deliberate configuration and permission boundaries; adding the server does not automatically make every capability appropriate.

Question 14

How do MCP registries and MCP allow lists serve different control purposes?

Accepted Answer

A registry supports discovery and approved distribution of MCP servers; an allow list limits which servers may actually be used. Discovery does not itself grant execution permission.

Question 15

What should you evaluate before choosing an agent's execution context?

Accepted Answer

The task's data, tools, credentials, network access, repository state, isolation needs, and environment constraints. The context must enable the task without exposing unrelated resources.

Question 16

Why scope an agent to a specific repository?

Accepted Answer

Repository scope limits the code, instructions, secrets, and change surface available to the agent, reducing accidental cross-repository access and making ownership and review clearer.

Question 17

What must be defined when an agent is invoked from a CI workflow?

Accepted Answer

Its trigger, permissions, inputs, execution environment, produced artifacts, success or failure conditions, and escalation path. CI invocation should be reproducible and auditable rather than an unbounded background action.

Question 18

How does branch-based scope make autonomous code changes safer?

Accepted Answer

It isolates agent changes from the protected branch and routes them through normal checks and pull-request review. Creating a branch or PR is a review boundary, not permission to merge.

Question 19

How should an agent handle environment-specific constraints?

Accepted Answer

Detect and honor the target environment's policies, available tools, credentials, resource limits, and deployment boundaries instead of assuming development, test, and production contexts are interchangeable.

Question 20

When should a failed agent action be retried rather than escalated?

Accepted Answer

Retry only when the failure is plausibly transient, the operation is safe to repeat, and a bounded retry policy exists. Deterministic, policy, or unknown failures should stop or escalate instead of looping.

Question 21

What four controls support a safe execution path after a tool failure?

Accepted Answer

Error handling, bounded retries, rollback or recovery, and escalation. Preserve traces and action records throughout so responsibility and the resulting state can be reconstructed.

Question 22

When should an agent use short-term, long-term, or external memory?

Accepted Answer

Use short-term memory for the current interaction, long-term memory for durable reusable facts or preferences, and external memory when state needs independent storage, retrieval, governance, or sharing across sessions and tools.

Question 23

What is the rule for placing information into an agent's memory?

Accepted Answer

Store only task-relevant information with a defined purpose and scope. More memory is not automatically better: irrelevant or excessive context increases drift, conflict, privacy risk, and retrieval noise.

Question 24

Why do agent memories need expiration, pruning, and reset rules?

Accepted Answer

They prevent stale or no-longer-relevant context from silently steering future work. Current GitHub Docs describe Copilot Memory as public preview: it validates repository facts against cited code and automatically deletes unused entries after 28 days.

Question 25

What durable state is needed for an agent to resume work safely?

Accepted Answer

Recorded progress, completed checks, pending steps, decisions and rationale, relevant artifacts, and the last validated environment state. A transcript alone may not express authoritative task state.

Question 26

How can an agent detect context drift during extended execution?

Accepted Answer

Compare current goals, constraints, decisions, repository state, and outputs with the last validated plan and durable artifacts. On divergence, refresh context or stop for review rather than continuing from stale assumptions.

Question 27

What is required before sharing agent state across tools or environments?

Accepted Answer

Establish an authoritative state source, compatible representations, freshness checks, access controls, and conflict resolution. Shared state without version or freshness checks can spread stale or contradictory context.

Question 28

What two categories belong in success criteria for an agent task?

Accepted Answer

Expected outcomes and operational constraints. A result can be functionally correct yet still fail if it violates security, scope, cost, timing, or workflow constraints.

Question 29

How do qualitative and quantitative evaluation signals differ?

Accepted Answer

Quantitative signals are measurable values such as check results, counts, or latency; qualitative signals judge qualities such as clarity, maintainability, or appropriateness. Robust evaluation often needs both.

Question 30

An agent passes its technical checks but delivers the wrong feature behavior. What evaluation defect does this expose?

Accepted Answer

The criteria were not aligned with development intent. An agent can optimize the metric it is given while missing the real product or engineering goal, so passing must represent the intended outcome—not just proxy checks.

Question 31

A scanner emits repeatable findings, but a reviewer still decides whether the result is acceptable in context. What distinct role does each play?

Accepted Answer

The scanner generates consistent evaluation signals for properties such as test status, code quality, dependency risk, or security findings; the reviewer supplies contextual judgment that automated evidence cannot replace.

Question 32

Which artifacts should you correlate when diagnosing an agent failure?

Accepted Answer

Logs, the plan, tool traces, outputs, checks, and workflow artifacts. Correlation helps locate where observed behavior first diverged from intent instead of blaming only the final output.

Question 33

What three root-cause classes does the GH-600 blueprint explicitly distinguish?

Accepted Answer

Reasoning errors, tool misuse, and context or environment issues. The corrective action should target the demonstrated class rather than applying a generic prompt change to every failure.

Question 34

When evaluation reveals a planning or behavior problem, what can be tuned before changing tools?

Accepted Answer

Revise the agent's instructions, workflow structure, or constraints. Then rerun the same relevant evaluation so the effect of the change is attributable and reviewable.

Question 35

What memory changes can correct failures caused by missing or stale context?

Accepted Answer

Refine what is stored and retrieved, narrow scope, improve freshness validation, and adjust expiration, pruning, or reset behavior. Do not use memory tuning to mask a tool or reasoning defect.

Question 36

How should tool access be tuned after evidence of tool misuse?

Accepted Answer

Narrow the available tools or permissions, clarify invocation constraints, improve validation and error handling, and require approval for higher-risk operations. Retest against the failure case and normal cases.

Question 37

What should determine the orchestration pattern for a multi-agent workflow?

Accepted Answer

Task dependencies, opportunities for safe parallelism, specialization needs, shared-resource conflicts, and how results will be combined and reviewed—not simply the desire to use more agents.

Question 38

Why isolate agents that execute in parallel?

Accepted Answer

Isolation prevents unintended sharing of context, credentials, files, and partial changes. It also makes each agent's inputs, outputs, failures, and resource use attributable.

Question 39

How should a workflow handle two agents that modify overlapping code?

Accepted Answer

Detect the overlap before integration, compare intent and dependencies, serialize or re-scope the work, and reconcile through validation and review. Silently accepting whichever output arrives last loses work and evidence.

Question 40

After several agents finish, a reviewer cannot tell who acted, why, or in what order. What evidence was the workflow missing?

Accepted Answer

Reviewable audit artifacts identifying each producing agent, task and inputs, relevant decisions, actions, outputs, checks, ordering, and handoff status. That evidence lets reviewers reconstruct responsibility and outcome.

Question 41

What must be documented at a handoff between agents?

Accepted Answer

The completed work, authoritative artifacts, decisions and rationale, unresolved risks, assumptions, remaining task, expected output, and acceptance criteria. A vague handoff invites duplicated effort and context loss.

Question 42

What question does post-hoc analysis answer that live monitoring may not?

Accepted Answer

It reconstructs how combined agent decisions and interactions produced the final outcome, including delayed effects, repeated patterns, and coordination failures visible only across the full workflow history.

Question 43

How do failed, partial, and stalled agent executions differ?

Accepted Answer

A failed execution terminates unsuccessfully; a partial execution produces only part of the required result; a stalled execution stops making progress without clean completion. Each needs different detection and recovery criteria.

Question 44

What are three recovery patterns for a degraded multi-agent workflow?

Accepted Answer

Rollback to a known state, reassign or restart bounded work, and introduce a human-in-the-loop decision. Recovery should preserve evidence and avoid repeating unsafe or conflicting actions.

Question 45

How can an agent be updated, replaced, or retired without breaking an active workflow?

Accepted Answer

Version its role and interfaces, complete or transfer in-flight work, preserve state and audit records, validate the replacement, and keep workflow continuity. Retirement should remove execution access without erasing accountability.

Question 46

What dimensions should be used to classify the risk of an agent action?

Accepted Answer

Operational impact, security exposure, compliance obligations, reversibility, affected scope, and the need for human judgment. Risk classification determines proportionate autonomy and controls.

Question 47

What is the goal when assigning an autonomy level to an agent action?

Accepted Answer

Maximize safe delivery speed while meeting organizational security and Responsible AI standards. Too much autonomy creates unmanaged risk; unnecessary approval for low-risk work creates delay without material protection.

Question 48

Which actions should remain human-in-the-loop?

Accepted Answer

Actions requiring contextual judgment or carrying material operational, security, compliance, Responsible AI, or irreversible consequences. The approval point should occur before the consequential action.

Question 49

What should happen when an agent proposes an action that violates policy?

Accepted Answer

A guardrail must block the action, record the attempted path and applicable policy, and route it to an approved alternative or escalation. A warning alone is insufficient when the policy requires prevention.

Question 50

How do least privilege and controlled paths work together for sensitive changes?

Accepted Answer

Least privilege limits what the agent can reach; controlled paths require explicit authorization, protected workflows, and auditable checks for irreversible or compliance-sensitive changes. Together they reduce both opportunity and impact.

Free GH-600 Exam Flashcards

Filter by Topic

Jump to Card

About These GH-600 Flashcards

Topics Covered

Frequently Asked Questions

GitHub Certified: Agentic AI Developer (GH-600)

Explore More GitHub Certifications

GitHub Foundations

GitHub Actions Certification

GitHub Administration (GH-100)

GitHub Advanced Security (GHAS) Certification

GitHub Copilot Certification

More From This Family