Exam tips & caveats

flowchart TD
  Q["What do you need Copilot to do?"]
  Q --> A1["Follow conventions on every task"] --> R1["Custom instructions<br/>copilot-instructions.md · *.instructions.md · AGENTS.md"]
  Q --> A2["Act as a specialist with its own tools"] --> R2["Custom agent<br/>.github/agents/*.agent.md"]
  Q --> A3["Follow a procedure with scripts, only when relevant"] --> R3["Agent skill<br/>.github/skills/NAME/SKILL.md"]
  Q --> A4["Reach an external system"] --> R4["MCP server<br/>with a tools allowlist"]
  Q --> A5["Guarantee a check runs or a call is blocked"] --> R5["Hook<br/>preToolUse · postToolUse"]
  Q --> A6["Have dependencies ready before it starts"] --> R6["copilot-setup-steps.yml"]
  Q --> A7["Never merge without review or checks"] --> R7["Ruleset · CODEOWNERS · required checks"]

flowchart TD
  Q["Where should this control live?"]
  Q --> C1["What the agent may attempt"] --> T1["Tool allowlists<br/>profile tools · MCP tools · --allow-tool"]
  Q --> C2["What it may reach on the network"] --> T2["Agent firewall<br/>Internet access settings"]
  Q --> C3["Which secrets it may read"] --> T3["Agents secrets<br/>environment-scoped secrets"]
  Q --> C4["Which tool calls are refused"] --> T4["preToolUse hook<br/>--deny-tool · managed settings"]
  Q --> C5["What may merge"] --> T5["Ruleset · required checks<br/>CODEOWNERS review"]
  Q --> C6["What may deploy"] --> T6["Environment<br/>required reviewers"]

flowchart TD
  Q["Recurring or event-driven agent work"] --> V{"Must the automation be<br/>versioned and reviewed as code?"}
  V -->|"yes"| GHAW["GitHub Agentic Workflows<br/>markdown + lock file · any engine"]
  V -->|"no"| R{"Private or internal repository,<br/>and cloud agent is enough?"}
  R -->|"yes"| AUTO["Copilot automations<br/>schedule or event triggers"]
  R -->|"no — one step inside existing CI"| CLI["Copilot CLI in a workflow step<br/>-p with minimal --allow-tool"]