GitHub Agentic AI Developer · 10% of the exam

Implement guardrails and accountability: free practice questions

5 sample questions from our 6-question bank for this domain — answers and explanations included. These are the same scenario-based style as the real GitHub exam.

1. An agentic workflow automatically responds to Dependabot alerts by opening pull requests, running tests, and—if all checks pass—merging dependency updates. A risk review identifies that 'critical' severity Dependabot alerts for direct production dependencies should follow a different path than 'low' or 'moderate' alerts. Which design pattern best balances risk management with delivery velocity for this scenario?

  • A. Route all Dependabot alerts through the same fully automated merge pipeline, but add a Slack notification for critical alerts so a human can manually revert if needed.
  • B. Require human approval exclusively for pull requests triggered by critical-severity alerts on direct production dependencies, while allowing the fully automated flow to continue for low and moderate alerts.✓ Correct
  • C. Pause the entire automated pipeline whenever any critical alert is detected in any repository until the security team performs a manual review of all pending alerts.
  • D. Disable automatic merging entirely and have the agent only open pull requests, leaving all merge decisions to human reviewers regardless of severity.
Explanation

Differentiating the approval path by risk classification—fully automated for low/moderate, human-gated for critical on direct production dependencies—is the canonical 'autonomy level' design pattern described in the domain. It preserves velocity for the majority of alerts while applying the human-in-the-loop control exactly where risk justifies it. Option A (post-merge Slack notification) provides no pre-merge control; a merged critical vulnerability is already in the codebase before a human can act. Option C (pausing the whole pipeline for any critical alert) is disproportionately disruptive and slows remediation of low-risk alerts unnecessarily. Option D (all PRs human-reviewed) eliminates the velocity benefit of automation and adds approvals that do not materially reduce risk for low-severity updates.

2. Your organization operates a Copilot agent that can autonomously provision GitHub repository resources (create repos, configure branch protection, add webhooks) via the GitHub REST API. During a red-team exercise, testers demonstrate that a specially crafted issue comment can cause the agent to invoke the webhook-creation endpoint with an attacker-controlled URL, potentially exfiltrating repository data. You must harden the agent against this class of attack without disabling webhook management entirely. Which THREE controls most directly mitigate this risk? (Choose THREE.)

  • A. Validate and allowlist webhook target URLs against an organization-approved domain list before any webhook creation API call is executed.✓ Correct
  • B. Require a human operator to approve all webhook creation and modification requests that originate from user-supplied input, classifying them as compliance-sensitive actions.✓ Correct
  • C. Restrict the agent's GitHub App installation permissions so that webhook administration is scoped only to the specific repositories that legitimately require it, not organization-wide.
  • D. Increase the agent's GITHUB_TOKEN expiry interval from the default to 24 hours so that compromised tokens have a longer useful lifespan for forensic analysis.
  • E. Implement an input sanitization and prompt-injection guard layer that detects and blocks attempts to override the agent's system instructions from issue comment content.✓ Correct
  • F. Archive all repositories where the agent detects suspicious issue comments to prevent further API calls until a human reviews the repository.
Explanation

Option A (URL allowlisting) is a direct output guardrail: even if the agent is tricked into calling the webhook API, only pre-approved domains can be registered, neutralizing data exfiltration. Option B (human approval for user-input-triggered webhook changes) applies the human-in-the-loop control precisely to the high-risk, compliance-sensitive action class, blocking the attack path before it reaches the API. Option E (prompt-injection guard) addresses the root cause—the attacker's ability to hijack the agent's decision-making via crafted input—by intercepting malicious instructions before the agent acts on them. Option C (narrowing installation scope) is a good least-privilege practice but does not prevent the attack within the permitted repositories; it only limits blast radius. Option D is wrong and counterproductive: a longer-lived token increases risk, not security, and is unrelated to the webhook injection vector. Option F (archiving repositories) is a disproportionate, disruptive response that harms legitimate users and does not systematically prevent the attack class.

3. A GitHub Copilot agent autonomously generates and merges infrastructure-as-code pull requests for a cloud environment. A compliance officer requires a full audit trail for every change. Which TWO platform capabilities should you implement to satisfy this requirement while preserving as much agent autonomy as possible? (Choose TWO.)

  • A. Enable required status checks and branch protection rules so every merge is recorded in the repository's protected branch log.✓ Correct
  • B. Configure the agent to write a structured YAML manifest of every action it takes to a dedicated append-only audit log repository using a separate write token.
  • C. Disable the agent's ability to merge pull requests and require a human reviewer to approve and merge every PR before it is processed.
  • D. Set the agent workflow to run only on a fixed schedule (e.g., once per day) to reduce the volume of changes requiring audit.
  • E. Use GitHub's audit log streaming to capture all API events made under the agent's token to an external SIEM or storage target.✓ Correct
Explanation

Branch protection rules with required status checks create a tamper-evident record of every merge event in GitHub's native logs (Option A), and audit log streaming (Option E) captures every API call the agent makes to an immutable external destination—together these satisfy an auditor's need for a comprehensive, trustworthy trail without removing any agent autonomy. Option B (custom YAML manifest) is a plausible but fragile pattern: if the agent or its token is compromised the manifest can be tampered with, and it duplicates what GitHub's built-in audit log already provides. Option C eliminates agent autonomy entirely, which violates the goal of preserving delivery velocity. Option D (scheduling) reduces throughput and does not itself produce an audit trail—it is an operational constraint, not an accountability mechanism.

4. A GitHub Copilot agent is configured to autonomously triage incoming issues, apply labels, and post clarifying comments. A new capability is proposed: the agent will also close issues it classifies as duplicates. A security reviewer flags this change. Which characteristic of the 'close issue' action most justifies requiring human approval before the agent performs it?

  • A. Closing an issue consumes additional GitHub Actions minutes, increasing operational cost.
  • B. The action is irreversible by default and may suppress valid user-reported defects if the model misclassifies the issue.✓ Correct
  • C. Label application and commenting already require elevated permissions, so adding closure creates a permission conflict.
  • D. The GitHub API rate limit for issue closure is lower than for other issue operations, creating a bottleneck risk.
Explanation

Closing an issue is a consequential, difficult-to-reverse action: a misclassified closure silences a legitimate bug report and erodes user trust, making it compliance-sensitive and a candidate for human-in-the-loop review. This directly maps to the guardrail principle of requiring explicit authorization for irreversible or high-impact changes. Option A is wrong—API cost and Actions minutes are not the basis for authorization requirements in Responsible AI guardrail design. Option C is wrong—closing issues uses the same 'issues: write' permission scope as commenting and labeling; there is no inherent permission conflict. Option D is wrong—rate limits are an operational concern, not a risk classification or compliance justification for human approval.

5. Your team is building a multi-agent system on GitHub that automates parts of a SOC 2-audited software delivery pipeline. You are assigning autonomy levels to the following four agent actions. Which action should be assigned the LOWEST autonomy level (i.e., must always require explicit human authorization)?

  • A. Automatically updating dependency versions in a non-production branch after all CI checks pass.
  • B. Posting a summary comment on a pull request with AI-generated code review feedback.
  • C. Merging a pull request into the main branch of a repository that gates production deployments.✓ Correct
  • D. Creating a new feature branch from the default branch when a linked issue is assigned.
Explanation

Merging into the main branch of a production-gating repository is the highest-risk action among the four: it directly affects what ships to production, is subject to SOC 2 change-management controls, and is difficult to reverse quickly if a bad merge causes an incident. It therefore requires the lowest autonomy (most human oversight). Option A is low-risk because it targets a non-production branch and CI validation has already passed—high autonomy is appropriate. Option B is purely informational and non-destructive; it can safely be fully automated. Option D is a lightweight, reversible repository operation with no direct compliance impact, suitable for full automation.

1 more questions in this domain

Practice the full bank with instant grading, flashcards, and a timed mock exam.

Start practicing free