GH-600 sample exam questions

Workflow artifacts with configured retention stay downloadable after a run ends. The coding agent records progress in the pull request body and timeline, where reviewers can follow it. View session opens the live session logs, showing the agent's actions as they happen.

Plan mode in the Copilot CLI makes Copilot propose a step-by-step plan for you to review and approve before any changes are made. --allow-all removes approval prompts, which is the opposite of what is wanted. /compact only summarizes history, and --agent=Task is not a planning gate.

The coding agent works from the issue text as its prompt, so a one-line description gives too little scope and the pull request misses changes. Adding a clear problem description, expected behavior and acceptance criteria fixes it. Memory, MCP rate limits and setup-step resources do not address vague requirements.

The /usage command reports session usage metrics such as tokens and requests consumed. /context is a close alternative, since it shows context window token occupancy, which may be what the question intends. /compact summarizes history and /diff shows file changes, so neither reports token usage.

Using --allow-tool 'read,search' pre-approves only the low-risk read and search tools, while edit and execute stay available but still prompt for approval. --allow-all-tools approves everything, --deny-tool blocks tools outright instead of requiring approval, and the plain command prompts for every tool.

CodeQL workflows run the init action to prepare the database, then analyze to run queries and report results. The question names no language, so npm test is the likely intended command, though python -m unittest would suit a Python project.

View session shows the agent's session logs, confirming what it did and where it stopped. Mentioning @copilot in a pull request comment continues work on the same branch and pull request, keeping completed steps and the chosen approach instead of starting over.

Secrets added to the Copilot environment (with the COPILOT_MCP_ prefix for MCP use) are available to the coding agent but kept separate from Actions secrets and variables, and are not exposed in plaintext. Actions secrets are restricted here, and instruction or agent files are committed in plaintext.

Entries such as 'message 0 returned' with finish reason stop show responses, and panel/editAgent shows the edit-capable agent. The excerpt lists only model requests, with no file-reading tool calls, so it gives no evidence of file analysis. That last answer is an inference.

The artifact.destroy audit log event records the actor and timestamp when a workflow run artifact is manually deleted. checks.delete_logs concerns deleted logs, not artifacts. Pull request comments and merge commit history do not record artifact deletions.

The coding agent runs built-in scanning on its changes: secret scanning detects hardcoded keys and tokens, and CodeQL finds vulnerabilities in the generated code. Repository CI lint results, Copilot code review comments and the usage dashboard's merge time metric are separate signals, not built-in agent scanners.

Handoffs target an agent's name, so code-review resolves to review.agent.md, and implementer matches the name IMPLEMENTER because the lookup ignores case. Setting send to true submits the prompt automatically, and the model property selects GPT-5.2 for the handoff.

A coordinating agent declares which subagents it may call in the agents list of its own YAML frontmatter, so Summarizer must be added to Orchestrator's agents list. Handoffs are user-driven transitions between agents, adding it to Reviewer is the wrong agent, and tools lists tools, not agents.

Summarizer sets disable-model-invocation: true, which prevents other agents such as Orchestrator from invoking it as a subagent. The user-invocable false setting only hides it from the user picker and does not stop subagent calls. Handoffs are not required, and the fetch tool is fine for summarizing.

For a compliance-sensitive workflow touching production secrets, human-in-the-loop with required manual approvals, such as environment protection rules with required reviewers, lets the agent do the work while a person gates production. Read-only is too limited for updating workflows, and unapproved production autonomy breaks compliance.