Pass the Microsoft GitHub Administrator GH-600 Questions and answers with CertsForce

Target 1 → C. http

Target 2 → A. Bearer

The completed configuration is:

{

" servers " : {

" github " : {

" type " : " http " ,

" url " : " https://api.githubcopilot.com/mcp/ " ,

" requestInit " : {

" headers " : {

" Authorization " : " Bearer ${env:GITHUB_PAT} "

}

}

}

}

}

The first target must be http because the GitHub MCP endpoint is a remotely hosted MCP server accessed through an HTTPS URL. GitHub ' s MCP configuration supports remote HTTP servers using the http transport type, whereas stdio and local are intended for MCP servers launched as local processes. GitHub documentation identifies http as a valid MCP server type for remote endpoints.

The second target must be Bearer . GitHub ' s documented PAT authentication pattern places the token in the HTTP Authorization header in the form Bearer < PAT > . Therefore, the expression combining Bearer with ${env:GITHUB_PAT} supplies the credential in the expected authentication scheme without embedding the token directly in the committed workspace configuration. GitHub ' s MCP setup documentation explicitly demonstrates an Authorization header using Bearer YOUR_GITHUB_PAT for the hosted GitHub MCP endpoint.

Digest, Token, and x-api-key do not match GitHub ' s prescribed PAT authentication syntax. Likewise, local and stdio would describe a locally executed MCP server rather than the specified remote endpoint.

Study Guide Reference Topics: Implement Tool Use and Environment Interaction; configure MCP servers; remote MCP transports; secure credential handling; tool authentication.

Target

Correct selection

apply_auto.if

${{ needs.plan.outputs.risk == ' low ' }}

The automatic execution job must explicitly require the low-risk classification. The expression ${{ needs.plan.outputs.risk == ' low ' }} reads the risk value published by the prerequisite plan job and permits automatic application only when that value matches low. Medium-risk and high-risk plans therefore cannot enter this automatic execution path.

The complementary reviewed path should handle non-low classifications and reference an environment configured with required reviewers. The condition routes work according to risk; the environment protection rule supplies the actual approval barrier. Merely naming a job “manual” or displaying an approval message does not require human authorization.

The alternatives always(), success(), and failure() describe execution status rather than the plan’s risk classification. Checking only for medium would also fail to cover high-risk changes. The plan-producing job must publish the risk as an output, and each execution job must obtain the corresponding plan artifact before applying it.

This design applies human intervention where the task’s operational impact warrants it while allowing routine low-risk work to proceed automatically.

Relevant curriculum topics are risk-based autonomy, explicit authorization, and controlled execution paths.

The first statement is Yes . When an MCP server is configured for a repository, GitHub Copilot cloud agents can use the enabled MCP tools autonomously during assigned tasks. GitHub specifically notes that Copilot does not request interactive approval before invoking configured MCP tools, making careful tool allowlisting and credential protection important.

The second statement is No . For repository-level MCP integration, Copilot cloud agent currently supports MCP tools , but it does not support MCP resources or MCP prompts exposed by the server. Resources and prompts are available in other MCP-capable Copilot experiences, such as IDE chat, but they are not consumed by the cloud coding agent in this configuration.

The third statement is Yes under the planned configuration. Litware requires agent1 to access all available tools . GitHub custom-agent configuration supports this by omitting the tools property or specifying tools: [ " * " ]. Likewise, an MCP server can use " * " to expose all of its tools. Consequently, newly introduced MCP1 tools fall within that wildcard authorization and become available without individually adding each tool name.

Study Guide Reference Topics: MCP tool integration, custom-agent tool configuration, autonomous tool invocation, MCP capability boundaries, and least-privilege agent execution.

The mcp-servers property connects a custom agent to the Model Context Protocol servers required for its planned work. MCP configuration makes defined external tools and services available to the agent in a controlled, declarative manner.

Adding a broad natural-language instruction such as “Use all available tools” does not configure a server connection, authenticate a tool, or define which external capabilities are available. It is also poor least-privilege design because it encourages unrestricted tool use without establishing a technical permission boundary.

Setting tools: [] removes all configured tools and would prevent the agent from using required capabilities. Deleting the tools line could cause the agent to inherit or expose a broader default tool set than intended. Repository-wide instructions can guide behavior, but they do not replace the agent-specific configuration needed to associate MCP servers with that agent.

A well-designed configuration identifies only the MCP servers necessary for the role, supplies secrets through approved environment mechanisms, and limits the resulting tools to the agent’s defined task.

Study-guide topics: MCP integration, agent tool configuration, and least-privilege environment access.

===============

A fine-grained PAT restricted to product-api provides an enforceable repository-level authorization boundary for agent1. GitHub fine-grained personal access tokens can be limited to selected repositories and assigned only the repository permissions required by the workload. Consequently, even if agent1 attempts to access billing-service or infra-terraform, the credential does not authorize access to those repositories. GitHub specifically recommends fine-grained PATs when repository access must be restricted to particular repositories.

This directly aligns with the GH-600 objective to configure an agent ' s scope to a specific repository and define execution boundaries through repository context and permissions. Microsoft Learn defines execution context as including the repository an agent can access and emphasizes that repository scope is the first boundary limiting agent behavior.

Option A provides behavioral guidance but is not a security authorization boundary. Option B controls the permissions available to the workflow token but does not, by itself, establish the required cross-repository credential restriction. Option D only prevents certain push operations; it does not stop agent1 from reading or otherwise accessing the other repositories.

Study Guide Reference Topics: Implement Tool Use and Environment Interaction → execution context and boundaries; repository-specific agent scope; tool permissions; least-privilege authentication.

The API key should be stored as a secret in the Copilot environment and referenced by name from the MCP configuration. This keeps the secret value out of repository files, agent prompts, pull requests, and ordinary workflow output while allowing the MCP server to receive the required credential at runtime.

A plaintext key in a configuration file is unacceptable because repository history, forks, logs, and code review systems can expose it. A Codespaces user secret is scoped to a user development environment and does not provide the intended runtime secret for the Copilot agent environment. A GitHub Actions secret is useful for workflow expressions, but the scenario requires the key to be available to the MCP server configuration itself.

The prefixed environment-secret approach creates a clear boundary: the configuration references an identifier, while the secret value is resolved only in the authorized execution environment. This supports rotation without changing tracked configuration content.

Study-guide topics: MCP authentication, secrets management, secure environment configuration, and credential isolation.

Separate branches isolate each agent’s proposed changes and allow the team to inspect them independently. Adding a required status check for file-level overlap detects conflicting modifications before either pull request is merged, preventing one agent’s work from silently overwriting another’s changes.

A read-only tool configuration prevents both agents from making required changes, so it avoids conflict by eliminating implementation capability rather than controlling it. CODEOWNERS approval adds review accountability for a specific file but does not automatically detect overlap between independent agent outputs. A single concurrency group serializes entire workflows and reduces throughput even where the agents work on unrelated files.

The selected solution maintains parallel development while creating a merge-time control for the actual risk: overlapping file changes. It also produces reviewable evidence of the overlap check in pull request status results.

Branch isolation does not eliminate semantic conflicts, such as incompatible API assumptions. Teams should therefore combine overlap detection with normal pull request review and integration testing.

Study-guide topics: parallel agent coordination, branch isolation, merge controls, and conflict detection.

Target

Selection

Dropdown 1

' search '

Dropdown 2

' read '

The visible configuration describes an implementation planner. Providing search and read supports the information-gathering work needed to produce a technically grounded plan: locating relevant code and inspecting its contents. The listed documentation tools supplement repository context with external technical reference material.

This tool selection also establishes a practical boundary between planning and implementation. A planner can explain proposed changes and produce Markdown in its response without needing permission to modify repository files. Granting editing or command-execution capabilities would expand its authority beyond the visible planning role.

The distinction between generating Markdown and saving a Markdown file is important. The selected tools support producing a plan in conversation. If the requirements instead demanded that the planner write that plan directly into the repository, an appropriate file-writing capability or a separate persistence step would be necessary.

Tool names must also resolve to capabilities available in the configured environment. Merely listing a documentation tool does not install or authenticate its MCP server.

Study-guide topics: tool selection, least-privilege planning, and environment capabilities. Reference: VS Code—Use tools with agents .

The selected location is appropriate when the planned developer changes concern repository-defined custom agents. Files under .github/agents/ define reusable agent roles that can be stored and reviewed alongside the application code. Their .agent.md format combines YAML configuration with Markdown instructions describing the agent’s responsibilities and expected behavior.

This arrangement allows the team to maintain specialized planning, implementation, and review roles consistently. Changes to an agent’s instructions or configuration can pass through the repository’s normal pull request process, providing a record of how the development workflow evolves.

The alternative locations serve different configuration purposes. .vscode/mcp.json configures MCP server connections for the workspace. .vscode/settings.json contains editor settings. Neither is the primary location for defining a repository’s custom agent profile.

The question’s planned changes are not reproduced in its supplied statement. Therefore, B is the source-selected answer under the custom-agent interpretation; a requirement specifically about MCP connectivity would require different configuration.

Study-guide topics: custom agent architecture, repository-scoped configuration, and version-controlled development workflows. Reference: VS Code—Custom agent file locations and structure .

===============

The intended distinction is between delegating analytical work and allowing the agent to provide the final approval of its own work. Approving all Git commits would remove independent review of changes that include security-sensitive remediation and compatibility modifications across multiple projects.

Human validation of assessment.md is similarly important because the assessment determines the scope and direction of the upgrade. Incorrectly classified dependencies, missed projects, or an incomplete vulnerability analysis can propagate into the implementation plan. Microsoft’s guidance explicitly recommends reviewing the assessment for missing projects, problematic dependencies, and application-specific concerns before proceeding.

Generating the assessment and checking whether a task file exists are appropriate automated activities. An agent can also inspect the plan’s dependency relationships and flag potential ordering problems. Such assistance does not transfer final accountability for accepting the plan.

The wording should not be interpreted as prohibiting automated assessment validation. Agents can run valuable consistency checks; the unsafe delegation is treating those checks as sufficient independent approval of their own conclusions.

Study-guide topics: human oversight, independent validation, and approval boundaries. Reference: Microsoft Learn—Best practices for GitHub Copilot upgrade .

===============