GH-600 Study Guide

GH-600 measures whether you can run AI coding agents safely inside real software delivery: fitting them into the software development lifecycle, giving them the right tools, MCP servers, and environment, managing their memory and state, evaluating and tuning their output, coordinating several agents at once, and governing what they may do, with GitHub as the system of record and control plane. Expect to decide which customization, tool, signal, or control meets a requirement, where it is configured (repository, organization, enterprise, agent profile, or workflow file), and what a built-in protection does and does not do.

The exam has six domains. Tool use and environment interaction carries the most weight at 20-25%. Architecture and SDLC processes, evaluation and tuning, and multi-agent coordination each carry 15-20%, while memory and state and guardrails each carry 10-15%. None of them is small enough to skip, so plan to cover every domain. Guardrails also appear outside their own domain, in architecture (planning the degree of agent autonomy, including guardrails) and tool use (traceability and accountability for agent actions), so do not let their smaller weight tempt you to skim them.

Prepare agent architecture and SDLC processes — 15-20%

Identifying which steps of the software development lifecycle agents should perform, recognizing and mitigating common agent anti-patterns, defining inputs, outputs, and success criteria, keeping planning distinct from execution, having an agent produce a structured plan and validating it, preventing action until the plan is checked and approved, planning the degree of autonomy and its guardrails, producing inspectable artifacts in standard development tooling, and adding human intervention without slowing delivery.

Implement tool use and environment interaction — 20-25%

Identifying, configuring, and permissioning agent tools, adding an MCP server as a tool, configuring the GitHub remote MCP server, MCP registries, and MCP allow lists, evaluating an agent's execution context, scoping an agent to a repository or to branches, invoking an agent in a CI workflow, letting it create branches and pull requests on its own, handling environment-specific constraints, and building safe execution paths with error handling, retries, rollbacks, escalation paths, and traceability and accountability for agent actions.

Manage memory, state, and execution — 10-15%

Choosing between short-term, long-term, and external memory, scoping memory to task-relevant information, setting expiration, pruning, and reset rules, capturing progress and decisions as durable artifacts, resuming work without repeating steps or diverging from earlier decisions, detecting and correcting drift during long runs, and sharing state across tools and environments while preventing conflicting or stale context.

Perform evaluation, error analysis, and tuning — 15-20%

Specifying expected outcomes and operational constraints, choosing qualitative and quantitative evaluation signals, aligning evaluation with development intent, generating signals with automated scanning tools, finding failures in logs, plans, traces, outputs, and workflow artifacts, classifying root causes (reasoning errors, tool misuse, and context or environment issues), and tuning by revising instructions, workflows, or constraints and refining memory, tool usage, and tool access.

Orchestrate multi-agent coordination — 15-20%

Applying an orchestration pattern, isolating agents for parallel execution, detecting and resolving conflicts such as overlapping code changes, duplicated effort, and contradictory outputs, producing artifacts for review and audit, documenting decisions, handoffs, and outcomes, post-hoc analysis of multi-agent behavior, spotting failed, partial, or stalled executions and degraded coordination, recovery patterns including rollback and human-in-the-loop, and adding, updating, replacing, and retiring agents without disrupting active workflows or losing auditability.

Implement guardrails and accountability — 10-15%

Classifying agent actions by operational, security, and compliance risk, assigning autonomy levels that keep delivery fast while meeting organizational security and Responsible AI standards, identifying the actions that need human judgment, blocking actions that violate security, compliance, or Responsible AI policies, scoping permissions and execution contexts for least privilege, requiring explicit authorization or controlled paths for irreversible or compliance-sensitive changes, and dropping approvals that do not materially reduce risk.

The full bullet-level list lives in the official study guide. Treat it as your checklist:

The Official GH-600 Study Guide

How This Maps to CertiAce Practice Modules

The CertiAce question bank is organized by the three modules of the official Developing in Agentic AI Systems Part 1 learning path on Microsoft Learn, so you can drill each area in isolation. CertiAce GH-600 practice questions are single-choice, multiple-select, build list (ordering), dropdown, and yes/no table items, plus two case studies of 28 questions each that also use true/false items. Three modules carry six skill areas, so each module is the home of some areas in full:

The three modules of the Part 2 learning path (Multi-Agent systems and orchestration; Memory, State, and Evaluation; Governance, guardrails, and operations) are covered within these three practice modules for now.

GH-600 has no prerequisite certification, and the other GitHub certifications above do not list one either. GH-300 is not required, but the GH-600 audience profile asks for experience with coding agents including GitHub Copilot, MCP servers, and agent customization such as custom instructions, custom agents, tools, and Copilot setup steps, so GH-300 is the natural predecessor if you have not worked with Copilot yet. GH-900 is a natural first step if you are new to GitHub. If you already run Copilot's agents in your repositories, go straight to GH-600. GH-200 and GH-500 cover the workflows, checks, and scanners that GH-600 uses as controls and evaluation signals.

The exam is written for people who already run coding agents in real repositories: its audience profile asks for experience with the software development lifecycle, workflows in GitHub and its controls, code quality, security, and review practices, and coding agents including GitHub Copilot. Check yourself against this table. Anything unfamiliar is where your preparation should start:

How long you need depends on where you start. Treat these estimates as planning guidance and adjust them to your starting knowledge and weekly study hours:

Step 1: Read the Official Study Guide

Skim the full skills-measured list once, and mark every bullet you could not explain to a colleague. That marked-up list is your personal syllabus: everything else in this plan exists to clear it. The list carries no version date (the page was last updated on 2026-05-13) and no change log, while the agent features it covers change every month, so check older material against the current documentation before relying on it. Most questions cover generally available features, but commonly used preview features may also appear.

The Official Study Guide

Step 2: Schedule Your Exam

Choose a realistic target date after reviewing the skills list and your available study time. A date on the calendar turns studying into a countdown, so pick one using the prep-time table above and plan backwards from it. You schedule through Pearson VUE and can take the exam online or at a test center.

The exam is offered in English only. If the exam is not available in your native language, check the English as a Second Language accommodation and arrange any approved extra time before booking.

Certification and Exam Details Page

Request Accommodations

Step 3: Work Through the Official Learning Paths

Complete both Developing in Agentic AI Systems learning paths on Microsoft Learn. Part 1 covers the foundations of agentic AI in GitHub, agent architecture and SDLC integration, and tooling, MCP, and execution environments; Part 2 covers multi-agent systems and orchestration, memory, state, and evaluation, and governance, guardrails, and operations. The CertiAce practice modules follow the three Part 1 modules. Take notes on concepts you cannot explain in simple terms, and try each control in your own repository as you go. GitHub's documentation changes faster than the training modules (the Tooling, MCP, and Agent Execution Environments module, for example, says Copilot cloud agent cannot access other repositories, while the documentation says the agent can only make changes in the repository you start it in and that the GitHub MCP server's default access to that repository's context can be widened in the repository's MCP settings), so when a unit and docs.github.com disagree, go with the documentation. If you prefer instructor-led training, course GH-600T00 is available on Microsoft Learn.

Developing in Agentic AI Systems Part 1 of 2

Developing in Agentic AI Systems Part 2 of 2

Step 4: Get Hands-On Practice

GH-600 rewards people who have run agents under real controls: the objectives ask which tool, setting, signal, or control fits a requirement and what a built-in protection does and does not do. Copilot cloud agent, the surface many objectives are written around, is available on all paid Copilot plans, while Copilot Free includes only limited access to a selection of features, so plan on a paid plan for these exercises. Aim for hands-on time with:

• Assigning an issue to Copilot cloud agent, following its session log, steering it with a pull request comment, and approving its workflow runs with Approve and run workflows
• Adding repository custom instructions and a path-specific instructions file, then comparing the agent's output with and without them
• Creating a custom agent profile with a restricted tools list, such as a read-only planner, and choosing it for a session
• Adding a copilot-setup-steps.yml file that preinstalls your dependencies, and finding its run in the session log
• Configuring an MCP server for the repository, allowing only the tools a task needs, and checking which tools the agent session can see
• Adding a branch ruleset with required checks and approvals, and watching how it gates the agent's pull request
• Reading the security validation the cloud agent records in its session log (CodeQL, dependency checks against the GitHub Advisory Database, and secret scanning)
• Splitting a larger task between a planning agent and an implementing agent, and keeping the plan and handoff notes in the repository
• Reading a GitHub Agentic Workflows example and identifying what its front matter (triggers, permissions, and safe outputs) allows

Some objectives need an organization or an enterprise. Custom agents can also be shared at organization and enterprise level, and organization and enterprise policies, such as the MCP servers in Copilot policy, apply only to members who get Copilot Business or Copilot Enterprise from that organization or enterprise. Learn those controls from the official documentation if you cannot try them yourself.

Configure the development environment

GitHub Skills offers free, interactive exercises that run inside GitHub repositories, including Copilot cloud agent, integrating MCP servers, customizing Copilot with instructions, agent skills, and custom agents, orchestrating custom agents from Copilot CLI, and GitHub Agentic Workflows. Check each exercise's prerequisites first: the cloud agent exercise, for example, needs a paid Copilot plan.

GitHub Skills

Step 5: Benchmark Your Knowledge

Use CertiAce to benchmark your readiness module by module. The practice modules map to the exam domains as shown above, so use the module mapping and the topics behind your missed questions to identify the skills-measured areas to revisit. The two case studies mix several domains in one scenario, so use them as a final check. The GH-600 certification page does not offer a free official practice assessment. Aim for consistent performance across every module, not one lucky high score.

CertiAce GH-600 Exam Practice

Step 6: Take the Exam

The day before, review only your weak topics: no brand-new material. On exam day, read each question for what it is truly asking: many GH-600 scenarios turn on where a control lives (repository, organization, enterprise, agent profile, or workflow file), which surface the agent runs on (Copilot cloud agent on GitHub, Copilot CLI, or an IDE), or what a built-in protection already does, so settle those first and eliminate the options that do not fit.

Worth knowing before you sit down:

• This is a closed-book exam: Microsoft Learn access is not available on GitHub exams.
• You can take unscheduled breaks, but the clock keeps running and you cannot return to questions you already saw.
• Labs may appear: GH-600's 120-minute allotment is the one Microsoft uses for role-based exams that may contain labs. The introduction screen tells you whether yours does; if it does, budget extra time for them.
• Watch the naming: older material, including a link in the training modules, calls Copilot cloud agent the coding agent, and the documentation has moved ahead of the skills list (Copilot automations, for example, which run the cloud agent on a schedule or on repository events, are not named in it). Learn the outline's features first and treat newer ones as background.
• Try the GitHub exam sandbox beforehand so the interface holds no surprises: GitHub Exam Sandbox