Free GH-600 Practice Questions & Study Guide: Developing in Agentic AI Systems

By /

Official Exam Details: (GH-600)

Exam Code:
GH-600
Passing Score:
70%
Total Question Bank:
76 Verified Questions
Exam Duration:
120 Minutes

Exam Format & Question Types

This certification exam features multiple-choice questions (single and multi-select), interactive Hotspots, Hot Areas, and Drag-and-Drop scenario configurations designed to test real-world technical competency.

GH-600: Global Hybrid Cloud Architect – Advanced AI/ML & Data Governance Study Guide

Welcome, aspiring Global Hybrid Cloud Architect! This comprehensive study guide and architectural blueprint is your essential resource for mastering the GH-600 certification. This exam validates your advanced expertise in designing, implementing, and securing sophisticated hybrid cloud solutions, with a strong emphasis on integrating AI/ML workloads and robust data governance across distributed environments. Success requires a deep understanding of architectural patterns, service interoperability, and strategic decision-making in complex, multi-vendor ecosystems.

Exam Overview & Profile

  • Target Audience: Experienced cloud architects, principal engineers, and technical leads with 5+ years in cloud and hybrid infrastructure, seeking to specialize in AI/ML integration and data compliance across federated systems.
  • Question Count: Approximately 55-65 multiple-choice, scenario-based, and drag-and-drop questions.
  • Duration: 150 minutes.
  • Passing Score Context: Typically, a score of 700 out of 1000 is required. Emphasis is placed on practical application of architectural principles over rote memorization.

Deep-Dive Domain Breakdown

Domain 1: Hybrid Cloud Foundation & Interoperability (25%)

  • Networking: Advanced VPNs, Direct Connect/ExpressRoute/Cloud Interconnect, service mesh for cross-environment communication, DNS resolution strategies (e.g., split-horizon DNS).
  • Identity & Access Management (IAM): Federation (e.g., SAML, OAuth 2.0), Directory synchronization (e.g., Azure AD Connect, LDAP integration), centralized IAM for multi-cloud/on-prem.
  • Compute: Kubernetes clusters (EKS Anywhere, Anthos, Azure Arc) spanning on-prem and public cloud, virtual machine orchestration, containerization strategies.
  • Management: Unified observability (logging, monitoring, tracing) across hybrid footprints, configuration management (Terraform, Ansible), policy enforcement.

Domain 2: Advanced AI/ML & Generative AI Architectures (35%)

  • Model Deployment & Operations (MLOps): CI/CD pipelines for ML models, model registries, online/batch inference strategies, drift detection and retraining.
  • Generative AI Patterns: Retrieval Augmented Generation (RAG) using vector databases (e.g., Pinecone, Weaviate, Milvus) for domain-specific context; fine-tuning pre-trained models for specialized tasks (e.g., custom enterprise data).
  • Data for AI: Data labeling pipelines, feature stores, data versioning for ML datasets.
  • GPU/Accelerator Strategy: Optimal placement and scaling of GPU resources for training and inference, considering cost and latency.

Domain 3: Data Management & Governance in Hybrid Environments (25%)

  • Data Residency & Sovereignty: Architecting solutions to meet strict regulatory requirements for data location.
  • Data Ingestion & Pipelines: Hybrid data lakes, real-time streaming architectures (Kafka, Pub/Sub, Event Hubs) spanning environments.
  • Data Security: Encryption at rest and in transit (customer-managed keys, HSMs), data masking, tokenization.
  • Data Governance: Data catalogs, lineage tracking, access control policies (attribute-based, role-based) for sensitive data across hybrid boundaries.

Domain 4: Security, Compliance & Optimization (15%)

  • Zero Trust Security: Implementing micro-segmentation, least privilege access, continuous verification.
  • Threat Detection & Response: Centralized SIEM/SOAR integration, anomaly detection, incident response playbooks for hybrid.
  • Compliance Frameworks: Designing solutions for GDPR, HIPAA, PCI DSS, and industry-specific regulations.
  • Cost Optimization: FinOps principles for hybrid cloud, resource rightsizing, utilization optimization, understanding licensing implications across environments.

High-Yield Exam Tips & Scenario Traps

  • RAG vs. Fine-tuning: Understand the trade-offs. RAG is ideal for incorporating real-time, frequently updated, or highly specific external knowledge without model retraining. Fine-tuning is for adapting model behavior, style, or specific domain language when data changes are less frequent, or a deeper shift in model understanding is required. Cost and inference latency are key differentiators.
  • Security Boundaries: Always prioritize a defense-in-depth strategy. Consider identity as the new perimeter, and ensure robust network segmentation, strong encryption, and centralized logging are foundational in hybrid designs.
  • Data Gravity: Data often dictates architecture. Solutions that minimize data movement across environments due to volume, latency, or cost are often preferred.
  • Interoperability: Look for solutions that promote open standards (APIs, Kubernetes), common management planes, and federated identity to minimize vendor lock-in and operational complexity.
  • Cost-Efficiency: Evaluate proposed solutions for long-term cost implications, not just initial deployment. Factor in data transfer costs, licensing, and operational overhead.

Frequently Asked Questions (FAQ)

Q1: What is the most effective study strategy for the GH-600 exam?

A1: The GH-600 demands a blend of conceptual understanding and practical application. Begin by thoroughly reviewing the domain breakdowns, focusing on the “why” behind architectural choices. Supplement this with hands-on experience configuring hybrid environments, deploying AI/ML models, and implementing data governance controls. Utilize official documentation from various cloud providers (e.g., AWS Outposts, Azure Arc, Google Anthos) for specific service details, and work through complex architectural case studies. Practice questions that simulate scenario-based decision-making are crucial.

Q2: How should I approach the scenario-based questions that often appear on this exam?

A2: For scenario questions, adopt a structured approach. First, identify the core problem and key constraints (e.g., budget, compliance, latency, existing infrastructure). Second, list all explicit and implicit requirements. Third, evaluate each potential solution based on these constraints and requirements, considering trade-offs in performance, cost, security, and operational complexity. Pay close attention to keywords that indicate priorities, such as “most cost-effective,” “highest security,” or “minimal latency.” Eliminate distractors by identifying options that introduce unnecessary complexity or violate core requirements.

Q3: Is deep knowledge of specific cloud provider services required, or is it more about generic hybrid concepts?

A3: While the GH-600 emphasizes vendor-agnostic architectural principles for hybrid cloud and AI/ML, practical knowledge of how these concepts manifest in leading cloud platforms (e.g., AWS, Azure, GCP) is highly beneficial. You should understand the common services and patterns used for hybrid connectivity, identity federation, managed Kubernetes in hybrid setups, and AI/ML platform capabilities. The exam expects you to translate conceptual designs into actionable service selections, demonstrating your ability to choose appropriate tools and technologies for a given hybrid scenario, even if not explicitly tied to a single vendor.

Free GH-600 Sample Practice Questions

Test your knowledge with these sample scenario questions complete with verified explanations:

Case Study: Contoso Ltd.

Instructions

This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided.

To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study.

At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section.

To start the case study –

To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question.

Overview –

Contoso Ltd. is a software development company located in the United States.

Existing Environment –

GitHub Environment –

Contoso uses GitHub Enterprise and assigns GitHub Copilot Pro+ licenses to its developers. The developers use Microsoft Visual Studio Code as their IDE.

Contoso has a customer portal. The code for the portal is stored in a GitHub repository named repo1 that contains the following:

A custom agent named agent1 that includes instructions to review specs related to best practices

A custom instruction file named validate-instructions.md that is used to validate tone of voice and applies to all .md and .txt files

A custom instruction file named codereview.instructions.md that is used by the Copilot coding agent but is excluded for use by the Copilot code review repo1 has the following structure:

The front-end is stored in the /frontend folder.

The API logic is stored in the /api folder.

Contoso has a second repository named repo2 that contains a legacy .NET application named App1 built by using .NET 6. repo2 has a multi-agent workflow for modernization tasks.

Contoso enables the Model Context Protocol (MCP) registry and allows the Microsoft Learn MCP Server. Every developer must configure their own connection to the Learn MCP Server.

Problem Statements –

The developers working in repo1 report that the Microsoft Learn documentation is NOT being retrieved when they attempt to validate a design by using agent1.

The testing team at Contoso identifies that the customer portal uses inconsistent UI styles, which leads to customer confusion and branding issues. The UI inconsistencies stem from variations in the folder structure.

Agent Logs –

You have the following logs for the multi-agent workflow used in repo2.

Requirements –

Planned Changes –

Contoso plans to have all agents and developers in repo1 use the Microsoft Learn MCP to ensure that reviews are validated by using the appropriate documentation. This must be implemented centrally.

Contoso plans to leverage AI-powered coding agents to implement new portal features and pages.

Technical Requirements –

App1 must be upgraded to .NET 10. A previous upgrade attempt was started by using the Copilot modernization agent, but the attempt was never finalized.

You plan to retry the upgrade. You must first analyze App1 by using AI, and then generate a report that contains breaking changes and deprecated patterns before retrying the upgrade.

All AI-generated code for UI styling must adhere to a predefined folder structure.

The architects at Contoso need help building implementation plans for repo1. The company wants to implement a new agent named agent2 to analyze the code base and the code requirements, and then respond with a detailed plan. The agent must NOT be able to edit files or run local commands.

The developers must be able to delegate work to the Copilot coding agent by assigning issues to the agent.

QUESTION 1 [HOT_AREA]

Scenario: Contoso Ltd.

You need to implement agent2 to meet the technical requirements.

How should you complete the YAML configuration? To answer, drag the appropriate values to the correct targets. Each value may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.

 

✔ Correct Answer:

Hotspot Canvas

Click to View Verified Solution & Explanation
Explanation:

Rationale for Selections:

The technical requirements for agent2 state that it must be able to “analyze the code base and the code requirements” but “must NOT be able to edit files or run local commands.” To fulfill these requirements, the agent needs specific tools with read-only capabilities.

  1. First Box: ‘search’
    The search tool is required for the agent to effectively find relevant files and code snippets within the repository. This capability is essential for the analysis phase of its task.
  2. Second Box: ‘read’
    The read tool allows the agent to access and understand the content of files it locates via search or direct reference. This is fundamental to analyzing the existing code and requirements to formulate an implementation plan.

The tools edit and execute are explicitly forbidden by the requirements, making them incorrect choices.

QUESTION 2

Scenario: Contoso Ltd.

The developers must be able to delegate work to the Copilot coding agent by assigning issues to the agent.

Before App1 is upgraded, you need to verify each individual upgrade step and whether all tests have passed.

Which file should you use?

  • A. assessment.md
  • B. plan.md
  • C. agent.md
  • D. tasks.md
Click to View Verified Solution & Explanation

Correct Option: D

Explanation:

To verify each individual upgrade step and whether all tests have passed, the tasks.md file should be used. In agentic workflows, especially for complex operations like application upgrades, the tasks.md file provides a detailed breakdown of the work performed, individual steps taken, their status, and associated verification results, including test outcomes. This file allows for granular tracking and auditing of the agent’s progress.

General Practice Questions

QUESTION 3 [DRAG_DROP]

You have a GitHub repository that has a GitHub Actions workflow. The workflow runs an AI agent.

You need to ensure that the default GITHUB_TOKEN permissions are read-only, and write access is granted to only the job that performs repository write operations. The workflow must be able to create and approve pull requests only when explicitly enabled.

How should you complete the workflow? To answer, drag the appropriate values to the correct targets. Each value may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.

 

Question Interface:

Question Interface
✔ Correct Answer / Solution View:

Solution Canvas

Click to View Verified Solution & Explanation
Explanation:

Solution Walkthrough

This solution configures GitHub Actions permissions according to the principle of least privilege, meeting all specified requirements.

✅ **Step 1: `permissions: read-all`** matches with -> **Workflow-level `permissions` block**

Reasoning: The primary requirement is to set the default permissions for the workflow’s `GITHUB_TOKEN` to be read-only. Placing `permissions: read-all` at the top level of the workflow establishes a secure baseline. All jobs, including the `analyze` job, will inherit these read-only permissions, preventing any unintended write operations.

✅ **Step 2: `contents: write`** matches with -> **`permissions` block in the `update_artifacts` job**

Reasoning: The `update_artifacts` job needs to perform write operations. Specifically, the “Update generated artifacts” step implies modifying and pushing files to the repository. This action requires overriding the workflow’s read-only default by explicitly granting `contents: write` permission at the job level.

✅ **Step 3: `pull-requests: write`** matches with -> **Empty box in the `Create pull request` step**

Reasoning: In addition to updating files, the `update_artifacts` job must create a pull request. This requires the `pull-requests: write` permission. Although the box’s placement within the step is syntactically incorrect in standard YAML, it logically represents the permission needed for that specific action. Permissions are scoped to the job, so this permission is granted to the `update_artifacts` job’s `GITHUB_TOKEN`.

QUESTION 4 [DRAG_DROP]

You have a GitHub repository that uses the GitHub Copilot coding agent to resolve issues and create draft pull requests. The repository uses GitHub Actions for CI, and reviewers rely on pull request timelines and workflow artifacts to understand what the agent did.

During long-running agent tasks, the reviewers lose track of decisions and validation steps, which causes repeated questions and reworks when context drifts between iterations.

You need to persist task progress and decisions as durable artifacts and ensure that the reviewers can verify what the agent did during and after execution by using GitHub as the system of record.

What should you do for each requirement? To answer, drag the appropriate actions to the correct requirements. Each action may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.

 

Question Interface:

Question Interface
✔ Correct Answer / Solution View:

Solution Canvas

Click to View Verified Solution & Explanation
Explanation:

✅ Step 1: ‘Use the upload-artifact action and configure artifact retention in the CI workflow.’ matches with -> ‘Create durable run outputs that are downloadable after completion:’ Reasoning: The actions/upload-artifact is the standard GitHub Actions mechanism to persist files generated during a workflow. These artifacts are stored for a configured duration and can be downloaded from the workflow summary, directly fulfilling the need for durable, downloadable outputs.

✅ Step 2: ‘Watch for pull request body updates and pull request timeline events.’ matches with -> ‘Provide ongoing, human-reviewable task progress signals inside the pull request:’ Reasoning: An agent can use the GitHub API to update the pull request’s description or post comments. This creates an auditable trail of its actions and progress directly within the UI that reviewers use, providing ongoing, human-reviewable signals.

✅ Step 3: ‘Select View session to stream live agent logs.’ matches with -> ‘Provide a real-time view of agent actions for audit and troubleshooting:’ Reasoning: Streaming live logs is the definition of a real-time view. This capability allows developers to monitor the agent’s operations as they happen, which is essential for immediate debugging, troubleshooting, and auditing its behavior during execution.

QUESTION 5 [DRAG_DROP]

You have a GitHub Enterprise Cloud Organization that uses the GitHub Copilot coding agent to resolve issues asynchronously.

When an issue is assigned to GitHub Copilot, the agent creates a draft pull request, but your team cannot always tell whether the agent is actively working, has completed its session, or is awaiting workflow approval.

Which execution context does each signal indicate? To answer, drag the appropriate context to the correct signals. Each signal may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.

Question Interface:

Question Interface
✔ Correct Answer / Solution View:

Solution Canvas

Click to View Verified Solution & Explanation
Explanation:

This question requires matching GitHub Copilot for Pull Requests signals to their corresponding execution contexts.

✅ Step 1: “The agent acknowledges the assignment and will create the draft pull request.” matches with -> “The eyes emoji (👀) reaction appears on the issue:” Reasoning: When GitHub Copilot is assigned an issue (e.g., via /copilot fix), it adds an eyes emoji (👀) reaction. This is the standard, documented signal that the agent has acknowledged the task and is about to begin its work.

✅ Step 2: “The agent session is actively running and generating live logs.” matches with -> “The pull request timeline shows Copilot started work:” Reasoning: Once Copilot creates the draft pull request, the PR timeline will show an event indicating that it has started work. This signifies the active phase where the agent is analyzing the issue, generating code, and pushing commits. This is the main working state of the agent.

✅ Step 3: “A human must manually approve and run the workflows.” matches with -> “A draft pull request exists, but GitHub Actions checks are not running:” Reasoning: A common security configuration in GitHub requires that workflows triggered by first-time contributors or bots like Copilot be manually approved by a maintainer before running. This prevents potentially malicious code from accessing repository secrets. A created PR with pending checks is the classic indicator of this state.

QUESTION 6

You have a repository that uses the GitHub Copilot coding agent and supports hooks stored under .github/hooks.

You need a Shell command to run automatically whenever an agent execution fails.

Which type of hook should you use?

  • A. postToolUse
  • B. sessionEnd
  • C. errorOccurred
  • D. agentStop
Click to View Verified Solution & Explanation

Correct Option: C

Explanation:

✅ Option C (Correct)

Reasoning: The errorOccurred hook is specifically designed to trigger whenever an error or failure happens during the agent’s execution. This directly matches the requirement to run a command automatically when an agent execution fails.

❌ Why the other choices are incorrect:

  • Option A is incorrect: postToolUse triggers after a tool completes its execution, not necessarily when the overall agent execution fails.
  • Option B is incorrect: sessionEnd fires at the conclusion of an agent session, whether it succeeded, failed, or was terminated, making it too broad.
  • Option D is incorrect: agentStop is also a general termination event, not exclusively tied to failures, similar to sessionEnd.

QUESTION 7

You are about to start a complex refactoring task in the GitHub Copilot CLI.

Before Copilot makes any changes, you need to review and agree on the approach.

What should you do first?

  • A. Start the Copilot CLI and specify the –agent=Task parameter.
  • B. Start the Copilot CLI and specify the –allow-all parameter.
  • C. From the Copilot CLI, switch to plan mode.
  • D. From the Copilot CLI, run the /compact command.
Click to View Verified Solution & Explanation

Correct Option: C

Explanation:

To review and agree on the approach before Copilot makes changes, you should first switch to plan mode. Copilot CLI’s plan mode is specifically designed for iterating on a task’s approach, allowing you to discuss and refine the strategy with Copilot before any commands are executed or code is modified. This ensures alignment and understanding of the planned refactoring. The other options either bypass this review or serve different purposes.

QUESTION 8

A team assigns an issue to the GitHub Copilot coding agent by using the following one-line description: Fix the login bug.

Copilot creates a pull request, but the pull request is missing changes and has an incorrect scope.

How should you resolve the issue?

  • A. Enable Copilot memory.
  • B. Update the Model Context Protocol (MCP) server rate limits.
  • C. Add a clear description of the problem to the issue.
  • D. Allocate more resources to copilot-setup-steps.yml.
Click to View Verified Solution & Explanation

Correct Option: C

Explanation:

✅ Option C (Correct)Reasoning: A vague one-line description like "Fix the login bug" lacks the necessary context for an AI agent to accurately determine the problem’s scope and required changes. Providing a clear, detailed problem description is crucial for GitHub Copilot to understand the issue thoroughly and generate an accurate, complete pull request.
❌ Why the other choices are incorrect:

  • Option A is incorrect: Copilot memory assists in retaining context across interactions, but it doesn’t compensate for an initially vague or incomplete task description. The fundamental problem is the input quality.
  • Option B is incorrect: Model Context Protocol (MCP) server rate limits concern the frequency of requests, not the quality or accuracy of the code generated based on the input description.
  • Option D is incorrect: Allocating resources to a setup file (copilot-setup-steps.yml) is unrelated to the agent’s ability to interpret an issue description and generate correct, scoped code changes.

Case Study: Litware Inc.

Instructions

This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided.

To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study.

At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section.

To start the case study –

To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question.

Existing Environment –

GitHub Environment –

The GitHub environment contains the following:

Three repositories named product-api, billing-service, and infra-terraform.

Branch protection on the main branch in all repositories that requires at least one pull request review before merging

GitHub Actions runners used across all workflows

A GitHub team named SG_Dev that contains developers

A GitHub team named SG_Review that contains senior engineers and a security team

A .github/copilot-instructions.md file that includes general coding conventions for all features

Agent environment –

The product-api repository uses a GitHub Copilot coding agent named agent1 that has the following configurations:

No custom agent profile is defined.

A Model Context Protocol (MCP) server named MCP1 is deployed to https://mcp.litwareinc.internal and provides access to internal ticketing and deployment APIs. MCP1 requires an API key for authentication.

A second Copilot coding agent named agent2 handles changes in infra-terraform and runs in parallel with agent1 when both agents have open assigned issues.

Copilot memory is NOT enabled for the organization.

Problem Statements –

Litware identifies the following issues:

During two recent sessions, agent1 accessed files in billing-service, which is outside the agent’s intended scope. agent1 makes code changes immediately after receiving a task.

A developer named Ben, who is on the SG_Dev team, reports that agent1 completed a session with a successful status and opened a pull request, but the pull request contains no file changes. Other developers report this intermittently as well.

Both agent1 and agent2 modified shared/config.yaml in a parallel test run, generating conflicting outputs. agent1 consistently uses raw try-catch blocks for error handling, which violates the defined implementation guidelines of SG_Dev.

Requirements –

Planned Changes –

Litware plans to make the following changes:

Ensure that agent1 can access all the tools in the environment.

Provide product-api with specific instructions to agent1 without affecting Copilot Chat or Copilot code review.

Configure MCP1 as a tool for agent1 by modifying the product-api repository MCP configuration.

Ensure that Copilot retains details that it has learned and uses that knowledge for future work. This must be applied to all licensed members of the organization.

Implementation guidelines –

The development team at Litware identifies the following implementation guidelines:

Agent workflows must be able to run in parallel.

Application error handling must use the repository ErrorHandler class. agent1 and agent2 must run on isolated branches during parallel execution. File-level conflicts must be detected before merges, and both agents must be able to run concurrently.

Security requirements –

Litware identifies the following security requirements:

Only the members of SG_Review must be able to approve agent1 plan outputs.

All API keys must be stored and accessed securely.

The developers must NOT be able to self-approve.

Agent configuration –

QUESTION 9

Scenario: Litware Inc.

You need to configure agent1 to support the planned changes.

What should you do?

  • A. Delete line 05 from the agent configuration.
  • B. Add Use all available tools to the .github/copilot-instructions.md file.
  • C. Add Use all available tools to the instructions in the agent configuration.
  • D. Add the mcp-servers property to the agent configuration.
  • E. In the agent configuration, replace line 05 with the following.05 tools: [].
Click to View Verified Solution & Explanation

Correct Option: D

Explanation:

✅ Option D (Add the mcp-servers property to the agent configuration) is correct.The planned changes explicitly state: "Configure MCP1 as a tool for agent1 by modifying the product-api repository MCP configuration." The mcp-servers property is the dedicated configuration section for defining Model Context Protocol (MCP) servers as tools for the Copilot agent. Adding this property with the details of MCP1 directly fulfills this requirement. While the agent also needs to access "all the tools in the environment," configuring the custom MCP1 server is a specific and necessary step for a unique internal API tool, and mcp-servers is the correct mechanism for this.

❌ Why the other choices are incorrect:

  • Option A is incorrect: Deleting line 05 (tools:) would remove the explicit list of allowed tools. This might enable default tools, but it would not configure the custom MCP1 server as a tool, which requires the mcp-servers property.
  • Option B is incorrect: Adding instructions to the general .github/copilot-instructions.md file would affect Copilot Chat and Copilot code review, violating the requirement to provide specific instructions without affecting these features. More importantly, it’s an instruction, not a configuration mechanism for tools.
  • Option C is incorrect: Adding instructions to the agent’s configuration is an instruction, not a declarative configuration for tool access. The agent requires explicit configuration for tool enablement, especially for custom MCP servers.
  • Option E is incorrect: Replacing line 05 with tools: [] would explicitly configure the agent to have no tools, directly contradicting the requirement to ensure it can access all tools in the environment, and specifically MCP1.

QUESTION 10

Scenario: Litware Inc.

You need to provide access to the API key of MCP1. The solution must meet the security requirements.

What should you do?

  • A. Store the API key as a GitHub Codespaces user secret scoped to product-api.
  • B. Store the API key as a secret in the Copilot environment of product-api by using a name prefix of COPILOT_MCP_, and then reference the variable name in the mcp.json configuration.
  • C. In the product-api repository settings, add the API key directly to the .mcp/server.json file by using a plaintext apiKey field.
  • D. In product-api, add the API key as a GitHub Actions encrypted secret and reference the secret by using ${{ secrets.KEY }} in the workflow YAML of agent1.
Click to View Verified Solution & Explanation

Correct Option: B

Explanation:

✅ Option B (Correct)

Reasoning: Storing the API key as a secret in the Copilot environment, using a specific prefix like COPILOT_MCP_, and referencing it in the mcp.json configuration is the secure and intended method for Copilot agents to access tool credentials. This aligns with secure practices for GitHub and ensures the agent can securely authenticate to MCP1.

❌ Why the other choices are incorrect:

  • Option A is incorrect: GitHub Codespaces user secrets are designed for individual user environments, not for automated agents or shared repository configurations, making them unsuitable for agent1.
  • Option C is incorrect: Adding the API key directly in plaintext to a file (.mcp/server.json) is a critical security vulnerability and violates the requirement that API keys must be stored and accessed securely.
  • Option D is incorrect: While GitHub Actions encrypted secrets are secure, the method of referencing them via ${{ secrets.KEY }} is specific to GitHub Actions workflow YAML files. For a Copilot coding agent configuring an MCP tool via mcp.json, the approach described in option B is typically the more integrated and direct mechanism for the agent’s environment to consume such secrets.

QUESTION 11 [HOT_AREA]

Scenario: Litware Inc.

You are evaluating how agent1 will behave after you implement the planned changes.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

✔ Correct Answer:

Hotspot Canvas

Click to View Verified Solution & Explanation
Explanation:

Statement 1: Once MCP1 is configured, agent1 can invoke MCP1 tools autonomously.

Answer: Yes

Once the Model Context Protocol (MCP) server is configured as a tool source, the Copilot agent is designed to autonomously determine when and how to use the exposed tools to accomplish its assigned tasks. It will incorporate calls to these tools into its execution plan. Although a new security requirement mandates human approval of the plan, the agent’s process of creating the plan and executing the approved tool calls remains an autonomous function.

Statement 2: agent1 can use the MCP resources and MCP prompts exposed by MCP1.

Answer: Yes

The Model Context Protocol (MCP) is a comprehensive framework for providing context to AI agents. It is not limited to just callable tools (APIs). An MCP server can also expose static resources (like documentation) and specific prompts to guide the agent’s behavior. By configuring agent1 to connect to the MCP1 server, it gains access to the full spectrum of context provided by that server, including tools, resources, and prompts.

Statement 3: If new tools are added to MCP1, they will be available automatically to agent1.

Answer: Yes

The agent’s configuration in the repository simply points to the MCP server’s URI. The agent uses this URI to dynamically query the server and discover the available tools at the beginning of a session. This means the MCP server acts as the single source of truth for its capabilities. Consequently, if new tools are added to the MCP1 server, they will be discovered and made available to agent1 automatically in subsequent sessions, without any need to modify the agent’s configuration in the repository.

Need the Full Exam Simulator?

Practice the complete question bank in a realistic, timed environment with advanced tracking.

Access Full CertoMetrics Engine →

Related Posts

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top