Important Microsoft GH-600 Exam Questions

Answer: B

Explanation:

The Copilot setup workflow must be present on the repository's default branch to be used for new coding-agent sessions. Moving .github/workflows/copilot-setup-steps.yml there ensures the setup procedure is discoverable for every newly created agent environment.

The package-registry credential should be stored as an environment secret in the Copilot environment and exposed using the required variable name, NPM_TOKEN. This permits package installation without committing the token into workflow YAML, instructions, source code, or pull requests.

Disabling network controls does not resolve missing credentials and expands risk unnecessarily. Repository instructions can describe setup expectations but cannot safely substitute for an injected runtime secret. Adding the raw token to YAML permanently exposes it to repository history and anyone with repository access.

Study-guide topics: ephemeral environments, setup workflows, environment secrets, and secure dependency access.

===============

Answer: C

Explanation:

The filter action:artifact.destroy selects the audit event associated with manual deletion of a workflow artifact. It directly targets the activity described in the scenario, allowing the investigator to examine the recorded actor and associated event details.

A repository filter narrows the search to a particular repository but does not distinguish artifact deletion from other recorded operations. It can usefully accompany the action filter when investigating a specific project. A workflow-run action concerns workflow execution rather than the manual removal of its stored artifacts. The generic operation:remove option does not select the documented artifact deletion event.

The investigation should correlate the deletion event with its timestamp and repository information, then inspect the actor recorded for that event. This identifies the account associated with the action; additional context may be needed when an application or automated identity performed it.

Artifact retention and audit logging serve separate purposes. Retention controls how long outputs are normally preserved, while the audit log records relevant administrative and user activity. Searching the audit log does not restore deleted content.

Study-guide topics: accountability, evidence preservation, actor attribution, and audit trails. Reference: GitHub---Organization audit log events.

Answer: C

Explanation:

Unassigning and reassigning the issue is GitHub's documented retry action for an issue-driven agent session that remains stuck and times out. The troubleshooting guidance states that a persistently stuck session times out after an hour. At 70 minutes with no continuing activity, the scenario therefore calls for a fresh execution trigger rather than indefinite waiting.

Reassignment reissues the task through its original issue context. This makes C the appropriate selection among the available actions. The issue should contain current requirements so that the retry begins with the intended scope rather than repeating an outdated assignment.

Option B is incorrect because a draft pull request should not be merged simply to restart implementation, and Copilot does not respond to new mentions on merged or closed pull requests. Option D authorizes repository workflow execution rather than restarting the agent.

For operational precision, reassignment is a documented retry mechanism, not a universal guarantee that every retry reuses the same pull request. Where preserving a particular pull-request branch is essential, an authorized @copilot comment on that open pull request directly targets it.

Relevant curriculum topics are timeout recovery, task reinitialization, and preserving execution continuity.

===============

Answer: A

Explanation:

A is the intended answer among the supplied choices, because the required control is a Copilot-specific content exclusion mechanism rather than Git authorization or branch governance. The important technical concept is excluding the sensitive directory from Copilot's usable context and suggestions.

Current GitHub documentation implements this through Copilot Content exclusion settings at repository, organization, or enterprise scope. Administrators can specify exact files, directory paths, and patterns to exclude. For excluded content, GitHub states that inline suggestions are unavailable in the affected files, excluded file content does not inform suggestions elsewhere, and the files are excluded from supported Copilot responses and code review.

Neither CODEOWNERS nor branch protection prevents Copilot from reading or generating suggestions for a particular directory. CODEOWNERS establishes reviewers/ownership, while branch protections and rulesets govern repository operations such as pushes, merges, and review requirements. Those mechanisms operate too late in the lifecycle to satisfy a requirement concerning Copilot's access to sensitive file content.

For exam purposes, therefore, A maps to the content-exclusion concept. In current GitHub administration, implement the control through Settings Copilot Content exclusion and specify the sensitive directory path.

Study Guide Reference Topics: Implement Guardrails and Accountability; sensitive-context exclusion; least exposure; repository security boundaries.

Answer: A

Explanation:

A preToolUse hook is a possible cause because it evaluates a proposed tool invocation before execution. Such a hook can inspect the tool name and arguments, identify a prohibited operation, and deny permission. A shell command containing recursive, forced deletion of an infrastructure directory is an appropriate target for this type of preventive rule.

The decisive evidence is the statement that the command was blocked because a destructive operation was detected. This describes a decision about the proposed command rather than a failure to reach a network destination. Copilot firewall controls address network access; they do not ordinarily classify local filesystem deletion commands. A postToolUse hook runs after a tool operation and therefore does not provide the same pre-execution interception.

An application installation policy governs application access or installation rather than this command-level decision. The surrounding script can treat a denied operation as a task failure and escalate it for human review, producing the displayed exit status.

The answer identifies a plausible enforcement mechanism; the log does not establish its exact implementation.

Study-guide topics: preventive guardrails, tool authorization, destructive-action detection, and escalation. Reference: GitHub Copilot---Hooks reference.

===============