GitHub Certified: Agentic AI Developer (beta) — Practice Set 1

Question 1

A team is onboarding an AI coding agent into their GitHub-based SDLC. Before the agent is given permissions to act, the team wants to ensure clarity on what the agent is supposed to do. Which three elements should be explicitly defined for each agent task?

Accepted Answer

The GH-600 study guide explicitly lists 'Define inputs, outputs, and success criteria for agents' as a measured skill under 'Integrate agents into the SDLC'. These three elements form the behavioral contract for an agent, enabling evaluation and governance. Compute budget and region (B) are infrastructure concerns, not behavioral definition. Training dataset details (C) are model concerns, not agent task definition. GitHub profile settings (D) are unrelated to task specification.

Question 2

An engineering team has deployed a GitHub Copilot agent to autonomously implement feature requests from GitHub Issues. After several incidents where the agent began executing changes before a human could review its plan, the team wants to enforce a review gate. Which configuration best addresses this requirement?

Accepted Answer

The GH-600 study guide lists both 'Configure an agent to output a structured plan' and 'Prevent agent action until the agent checked and approved' as explicit skills. This pattern — plan before act, with human approval gate between them — is the canonical way to separate planning from execution for safe autonomous agents. Disabling GitHub Actions (B) removes the agent's execution capability entirely rather than gating it. Using a smaller model (C) does not add a review gate. Posting to Slack (D) may notify stakeholders but does not actually block the agent from proceeding.

Question 3

A platform team is deploying an autonomous GitHub agent that will run for long periods without human monitoring. They need the agent to produce outputs that can be reviewed after the fact using standard developer tools. Which observability approach should be configured?

Accepted Answer

The GH-600 study guide explicitly requires that agents 'produce inspectable artifacts within standard development tooling'. GitHub pull requests, issues, check runs, and workflow logs are the standard artifacts that allow any team member to review agent behavior using existing developer tools without special tooling. Writing to a private database (A) removes human visibility. Email summaries (C) are delayed and lack the granularity of in-tool artifacts. Read-only mode (D) prevents the agent from doing useful work and does not address observability.

Question 4

A developer notices that a GitHub agent is performing reasoning and code modification within the same execution step, making it difficult to audit what the agent decided vs. what it did. Which anti-pattern does this represent, and how should it be fixed?

Accepted Answer

The GH-600 study guide lists 'Define boundaries between planning, reasoning, and action' and 'Configure agent planning to be distinct from agent execution' as explicit skills. Conflating reasoning and execution in a single step is an anti-pattern because it removes the ability to validate the plan before actions are taken. Combining the steps is not more efficient from a safety standpoint (A). Reducing the tool list (C) addresses permissions, not the separation-of-concerns anti-pattern. Persistent memory (D) addresses context retention, not the planning-execution boundary.

Question 5

A developer is configuring an agent that needs to read files from a GitHub repository and create pull requests. When setting up the agent's tool permissions, what principle should guide the permission configuration?

Accepted Answer

The GH-600 study guide lists 'Configure agent tool permissions' as a skill and elsewhere requires scoping 'permissions and execution contexts to enforce least-privilege access'. Granting only the permissions required for the specific task limits the blast radius of mistakes or misuse. Granting org-wide access (A) is an over-privileged configuration that violates least-privilege. Waiting for runtime requests (B) is not a secure or predictable approach. Matching senior developer permissions (D) likely grants far more access than the agent needs.

Question 6

A developer wants to connect an agent to an external data source — specifically a company internal documentation system — using Model Context Protocol (MCP). What is the correct first step?

Accepted Answer

The GH-600 study guide explicitly lists 'Add an MCP server as a tool to an agent' and 'Configure MCP allow lists' as skills under 'Configure MCP servers'. MCP is the protocol designed to connect agents to external data and tool sources. The allow list restricts which MCP servers the agent is permitted to contact, enforcing least-privilege at the tool-connectivity level. Rebuilding the documentation system (B) is unnecessary and impractical. Downloading all documentation into a prompt (C) does not scale and may exceed context limits. Fine-tuning a new model (D) is expensive, slow, and not how real-time tool access works.

Question 7

A GitHub Copilot agent is configured to run in a GitHub Actions CI workflow. During a test run, the agent attempts to push directly to the main branch, which violates the team's branch protection policy. How should the agent be reconfigured to work correctly within these constraints?

Accepted Answer

The GH-600 study guide includes 'Configure an agent to use branch-based scope' and 'Enable an agent to perform autonomous actions, including creating branches and pull requests' as explicit skills. Agents should work within repository constraints by creating branches and opening pull requests for review, not by pushing to protected branches. Disabling branch protection (A) removes a critical governance control. Granting admin token (C) violates least-privilege and exposes the repository to unreviewed changes. Off-hours scheduling (D) does not solve the permission issue.

Question 8

A developer is building an agent that calls external services as part of a long-running CI workflow. The external service sometimes returns transient 503 errors. To make the agent reliable, which two error handling mechanisms should be implemented? Choose 2.

Accepted Answer

The GH-600 study guide lists 'Implement retries' and 'Implement escalation paths' as explicit skills under 'Operate agents with safe execution paths and robust error handling'. Retries handle transient failures automatically; escalation paths ensure that persistent failures are surfaced to a human for resolution rather than silently failing. Disabling internet access (C) removes the agent's ability to use external tools. Replacing with a mock (D) only works in testing environments and does not address production reliability. Increasing context window (E) does not resolve HTTP call failures.

Question 9

A developer needs to configure a GitHub remote MCP server to extend a GitHub Copilot agent's capabilities within the GitHub ecosystem. What distinguishes a GitHub remote MCP server from a local MCP server configuration?

Accepted Answer

The GH-600 study guide lists 'Configure a GitHub remote MCP server' as a specific skill distinct from generic MCP server configuration, indicating that GitHub hosts MCP servers that agents can connect to over HTTPS without requiring local installation or network tunneling. This is the key distinguishing characteristic: remote accessibility for cloud-hosted agents. GitHub remote MCP servers do not store memory in GitHub Packages (B). They extend capabilities alongside GitHub Actions, not replace it (C). They do not require self-hosted runners (D) — that would contradict the benefit of remote hosting.

Question 10

An agent successfully completes a refactoring task but introduces a breaking change. The team needs to ensure that future agent executions can be rolled back to a known-good state. What should be implemented?

Accepted Answer

The GH-600 study guide explicitly lists 'Implement rollbacks' as a skill under 'Operate agents with safe execution paths and robust error handling'. Rollback capability allows an agent-introduced change to be reverted when downstream checks (CI failures, test failures) detect a problem, without manual developer intervention. Deleting and recreating the repository (B) is destructive and impractical for production workflows. Rewriting test suites (C) is unnecessary and counterproductive. Limiting to read-only (D) prevents the agent from doing useful work rather than making it safely recoverable.

Question 11

A GitHub Copilot agent is assigned a multi-day feature implementation task. At the start of each new session, the agent loses context of what it completed previously and restarts from scratch. Which memory type should be implemented to address this?

Accepted Answer

The GH-600 study guide lists 'Choose between short-term, long-term, and external memory' as a skill. Long-term memory persists across agent sessions, enabling the agent to resume from where it left off without starting over. Short-term memory (A) is limited to the current context window and does not survive session boundaries. External memory scoped to Slack (C) is not a standard agent memory pattern and does not integrate with the agent's task state. Re-analyzing the full repository each time (D) is expensive and does not preserve decisions or progress.

Question 12

An agent is midway through a complex database migration task spanning 50 files. It crashes due to a network interruption. When it restarts, the team needs the agent to continue from step 32 rather than repeating steps 1–31. What technique enables this?

Accepted Answer

The GH-600 study guide explicitly lists 'Capture task progress and decisions as durable artifacts' and 'Resume agent work without repeating steps or diverging from prior decisions' as skills under 'Persist agent state and manage context drift'. Durable artifacts (such as checkpoint files, GitHub issue comments, or state stored in a repository) allow the agent to pick up from a known checkpoint. Re-running from scratch (B) wastes work and risks side effects from repeated steps. Reducing to 10 steps (C) is not always possible. Faster VM restart (D) does not preserve state across the interruption.

Question 13

Two agents are working in parallel on the same codebase. Agent A has built up a context about the current state of the authentication module. Agent B then makes significant changes to that module. When Agent A resumes work, it operates on stale assumptions about the module's structure. What problem is occurring and how should it be addressed?

Accepted Answer

The GH-600 study guide identifies 'Detect and correct drift during extended agent execution' and skills around 'Prevent stale context' and 'Share agent state' under memory management. When an agent's context no longer reflects the true current state of the environment due to changes by another agent, this is context drift. The solution is state sharing (so agents know what others have changed) and drift detection (so an agent recognizes when its assumptions are outdated). Force-pushing (B) destroys Agent B's valid work. Switching models (C) does not address the state synchronization problem. Clearing memory (D) would reset both agents, discarding all progress.

Question 14

A team wants to evaluate whether their GitHub Copilot agent is succeeding at assigned tasks. They need both a quantitative measure (e.g., test pass rate) and a qualitative measure (e.g., code readability). What are these called in the context of agent evaluation?

Accepted Answer

The GH-600 study guide explicitly lists 'Identify qualitative and quantitative evaluation signals to evaluate agents' as a skill under 'Define success criteria and evaluation signals for agent tasks'. Quantitative signals are measurable numeric outcomes (test pass rate, build success rate); qualitative signals reflect human judgment about quality (code readability, correctness of approach). Token counts (B) measure LLM consumption, not task success. PR size and comment count (C) are activity metrics, not defined evaluation signals for agent tasks. Temperature and top-p (D) are model sampling parameters, not evaluation signals.

Question 15

An agent is producing incorrect code changes. A developer needs to diagnose the root cause. Which two artifact types should be examined to identify whether the failure is due to a reasoning error, tool misuse, or an environment issue? Choose 2.

Accepted Answer

The GH-600 study guide lists 'Identify failures by using logs, plans, traces, outputs, and workflow artifacts' and 'Classify root causes, including reasoning errors, tool misuse, and context or environment issues' as explicit skills. Logs and workflow artifacts (A) reveal what happened at the execution level (tool calls made, errors returned). Plan and decision traces (B) reveal whether the agent's reasoning was flawed before execution began. Follower count (C) is unrelated to debugging. Billing data (D) shows consumption but not failure root cause. Model training checkpoints (E) are not accessible or relevant to production debugging.

Question 16

After reviewing agent failure logs, a developer finds that the agent frequently uses the wrong tool for a task — it calls a file-read tool when it should be calling a search tool. What tuning action should be taken?

Accepted Answer

The GH-600 study guide lists 'Refine tool usage and tool access' and 'Revise instructions, workflows, or constraints' as tuning skills based on evaluation results. Tool misuse is typically a reasoning or instruction issue — the agent's instructions don't adequately describe when each tool is appropriate. Refining instructions and tool descriptions resolves this. Removing all tools (B) eliminates the agent's ability to act. Increasing memory (C) does not address incorrect tool selection logic. Retraining from scratch (D) is disproportionate and does not address the instruction clarity issue.

Question 17

A team uses automated scanning tools as part of their agent evaluation pipeline. What is the primary purpose of using automated scanning in the context of agent evaluation?

Accepted Answer

The GH-600 study guide includes 'Generate evaluation signals by using automated scanning tools' as a skill under 'Define success criteria and evaluation signals for agent tasks'. Automated scanning tools analyze agent outputs (code diffs, pull request content, workflow logs) and produce structured signals — such as code quality scores, security findings, or test results — that can be used to evaluate agent performance at scale without requiring manual human review of every output. Scanning training data (B) is a model preparation concern. Repository file scanning (C) is a storage optimization concern. MCP dependency scanning (D) is a maintenance concern unrelated to agent task evaluation.

Question 18

A development team wants to have three specialized agents work in parallel: one for writing tests, one for writing implementation code, and one for updating documentation. Which orchestration consideration is most critical to prevent conflicts?

Accepted Answer

The GH-600 study guide lists 'Configure agent isolation for parallel execution' as an explicit orchestration skill. When agents run in parallel, isolation (e.g., separate branches, scoped file access, or partitioned work areas) prevents overlapping writes and conflicting outputs. Running sequentially (B) eliminates parallelism and defeats the purpose of having multiple agents. Sharing a single token (C) creates an audit and accountability problem and does not prevent conflicts. Committing directly to main (D) bypasses review controls and would cause conflicts immediately.

Question 19

A multi-agent workflow has been running for 6 hours. A downstream review shows that two agents independently refactored the same utility class in incompatible ways. Both pull requests are now open and cannot both be merged. What type of failure is this and how should it be handled?

Accepted Answer

The GH-600 study guide lists 'Detect and resolve agent conflicts, including overlapping code changes, duplicated effort, and contradictory outputs' as an explicit orchestration skill. Two agents independently modifying the same file is a classic overlapping code change conflict in multi-agent systems. The resolution involves detecting the overlap early (via scope pre-registration or file locking) and having an orchestrator arbitrate which change takes precedence or merging the changes. Clearing memory and restarting (A) loses all work. Granting cross-branch write access (C) is a permissions change that does not resolve the logical conflict. Memory leak (D) is a process-level issue unrelated to code conflicts.

Question 20

A team needs to perform a post-incident analysis of a multi-agent pipeline that produced incorrect outputs. Which two types of data should the team configure the pipeline to produce in order to support this analysis? Choose 2.

Accepted Answer

The GH-600 study guide lists 'Document key decisions, handoffs, and outcomes across agents' (A) and 'Configure multi-agent workflows to produce artifacts suitable for review and audit' alongside 'Perform post-hoc analysis of multi-agent behavior' requiring 'logs, artifacts, and operational signals' (B) as explicit skills. Decision and handoff documentation allows analysts to trace which agent made which decision; logs and operational signals reveal what each agent did at the execution level. Billing reports (C) show cost, not behavior. SSH keys (D) are authentication artifacts unrelated to behavioral analysis. Model release notes (E) describe model changes, not the specific execution that produced the incorrect output.

Question 21

A production multi-agent pipeline has a failing agent that is causing the entire workflow to stall. What is the correct multi-agent recovery pattern to apply?

Accepted Answer

The GH-600 study guide lists 'Implement multi-agent recovery patterns, including rollback and human-in-the-loop' as an explicit skill under 'Detect and respond to multi-agent failures and degraded behavior'. Recovery patterns allow the failing agent's partial work to be rolled back while other agents continue or are paused gracefully, and human-in-the-loop intervention provides a decision point for how to proceed. Shutting down all agents (A) causes broader disruption and loses work. Increasing token limits (C) does not resolve a failed external call or logic error. Manual developer completion (D) is a last resort and not a systematic recovery pattern.

Question 22

An organization wants to decommission an agent that was responsible for generating release notes in a multi-agent pipeline. The agent has accumulated 18 months of audit logs and decision records. What must be preserved when retiring this agent?

Accepted Answer

The GH-600 study guide lists 'Retire agents while preserving auditability and workflow continuity' as an explicit lifecycle management skill. An agent's historical records — logs, decisions, generated artifacts — must remain accessible after the agent is decommissioned to support future audits, compliance reviews, or retrospectives. Rotating SSH keys (A) is a security hygiene step, not the primary retirement concern. Exporting the context window (C) is not a meaningful or standard operation. Reverting all PRs (D) would undo months of valid work and break the codebase.

Question 23

A developer is classifying an agent's actions by risk level to determine which require human approval. The agent can perform three actions: (1) read a file, (2) open a pull request, (3) deploy to a production database. How should these actions be classified for the purpose of assigning autonomy levels?

Accepted Answer

The GH-600 study guide lists 'Classify agent actions by operational, security, and compliance risk to right-size human interventions' as a guardrails skill, and 'Require explicit authorization or controlled paths for irreversible or compliance-sensitive changes'. Reading a file is reversible and low risk; opening a PR creates a change proposal that requires human review before merge; deploying to a production database is irreversible and compliance-sensitive, requiring explicit authorization. Treating all actions equally (A) creates unnecessary friction on low-risk actions. Reversing the risk classification (C) contradicts the principle that irreversible, production-impacting actions carry the highest risk. Blocking all actions (D) makes the agent useless.

Question 24

A security engineer reviews an agent's configuration and finds that the agent has permission to push to any branch in any repository in the organization, delete GitHub Actions workflow runs, and modify organization-level settings. The engineer wants to reduce risk without disabling the agent. What is the correct remediation?

Accepted Answer

The GH-600 study guide explicitly lists 'Scope permissions and execution contexts to enforce least-privilege access' as a guardrails skill. An agent with organization-wide write permissions, workflow deletion rights, and org-settings access far exceeds what any specific task requires. Scoping permissions to the minimum necessary for defined tasks dramatically reduces the blast radius of a compromised or misbehaving agent. Adding to owners group (B) increases exposure, the opposite of what is needed. Encrypting repositories (C) does not reduce the agent's permissions. Recreating the agent with the same permissions (D) does not change the over-privilege problem.

Question 25

An organization's AI governance team requires that agents comply with Responsible AI standards and that delivery velocity is not unnecessarily slowed by excessive approval overhead. Which two practices balance these requirements? Choose 2.

Accepted Answer

The GH-600 study guide lists both 'Block actions that violate defined security, compliance, or Responsible AI policies' (A) and 'Preserve execution velocity by minimizing approvals that do not materially reduce risk' (B) as explicit guardrails skills. Together these implement risk-proportionate governance: high-risk policy violations are automatically blocked, while low-risk routine actions proceed autonomously, preserving delivery speed. Requiring human approval for every action (C) creates untenable overhead that negates the value of automation. Disabling all automation (D) eliminates AI-driven productivity gains. Granting admin rights (E) removes all governance controls and violates Responsible AI principles.

GH-600 — GitHub Certified: Agentic AI Developer