The GitHub Actions certification (exam GH-200) checks that you can build and run CI/CD on GitHub: writing workflows, debugging runs, creating custom actions, running Actions across an organization or enterprise, and keeping automation secure and efficient. It's an intermediate-level exam for DevOps engineers, developers, and administrators.

This guide covers the exam as of its January 2026 skills update, then gives you 100 original practice questions weighted like the real exam. Each one hides its answer and an explanation until you open it. Limits, defaults, and file locations in these questions were checked against GitHub's documentation in October 2026. The questions are written for practice; they aren't taken from the real exam.

The exam at a glance

  • Exam code: GH-200, for the GitHub Actions certification. Level: intermediate.
  • Time: 100 minutes. If the exam isn't offered in your language, you can request 30 extra minutes.
  • Passing score: 700 or higher.
  • Delivery: proctored, scheduled through Pearson VUE from the Microsoft Learn certification page. Price depends on the country where you take it.
  • Languages: English, Spanish, Portuguese (Brazil), Korean, and Japanese.
  • Retakes: you can retake 24 hours after a first failed attempt; later retakes have longer waits.
  • Validity: 2 years. GitHub is moving its certifications to Microsoft's recertification process, and certifications that expire before that's in place are being extended by 6 months.
  • Free extras: an official practice assessment and an exam sandbox that shows the real question interface.

Microsoft doesn't publish a fixed number of questions. Check the official pages linked at the end before you book, since details change.

The five domains and their weights

Horizontal bar chart of GH-200 domain weights: authoring workflows and managing Actions for the enterprise 20 to 25 percent each; consuming and troubleshooting workflows and authoring actions 15 to 20 percent each; securing and optimizing automation 10 to 15 percent
Authoring workflows and enterprise management carry the most weight. The table below has the same numbers.
DomainExam weightPractice questions here
Author and manage workflows20–25%24
Consume and troubleshoot workflows15–20%19
Author and maintain actions15–20%19
Manage GitHub Actions for the enterprise20–25%24
Secure and optimize automation10–15%14

The January 2026 update rewrote every objective. New or expanded topics include YAML anchors and aliases in workflow files; runner image changes (Ubuntu 20.04 retired, windows-latest moving to Windows Server 2025); the differences between workflow templates, reusable workflows, and composite actions; immutable actions and version pinning; retention policies through the REST API; and artifact attestations.

How to use these questions

Answer each question before opening its answer, and tally your misses per domain. Questions marked Choose two need both correct options. Many questions are scenarios that ask for the best approach; think least privilege and the simplest built-in feature first, because that's usually the intended answer. If you get more than about 80% right, take the official practice assessment next.

Author and manage workflows (20–25%)

Questions 1–24.

  1. A workflow should run every weekday at 06:00 in New York. What must you remember when writing its schedule cron expression?

    1. Cron only accepts hourly intervals
    2. Cron uses the runner's local time zone
    3. Cron is evaluated in UTC, so convert from local time
    4. Cron uses the repository owner's time zone
    Show answer

    Answer: C. Scheduled workflows run in UTC by default. The shortest allowed interval is every 5 minutes.

  2. Which trigger adds a manual Run workflow button and lets you start the workflow from the API or gh workflow run?

    1. workflow_call
    2. workflow_dispatch
    3. repository_dispatch
    4. workflow_run
    Show answer

    Answer: B. workflow_dispatch supports typed inputs and manual runs.

  3. An external CI system needs to start a workflow by calling GitHub's REST API with a custom event type. Which trigger fits?

    1. push
    2. schedule
    3. check_run
    4. repository_dispatch
    Show answer

    Answer: D. repository_dispatch is the webhook-style trigger for events from outside GitHub, and it can carry a custom payload.

  4. Which is not a valid workflow_dispatch input type?

    1. choice
    2. environment
    3. file
    4. boolean
    Show answer

    Answer: C. Valid types are boolean, choice, number, environment, and string.

  5. Which trigger makes a workflow callable from other workflows?

    1. workflow_call
    2. repository_dispatch
    3. workflow_run
    4. workflow_dispatch
    Show answer

    Answer: A. Declare the inputs, secrets, and outputs it accepts under on: workflow_call.

  6. A caller workflow sets env: REGION: us-west-2 at the workflow level and calls a reusable workflow. Can the reusable workflow read REGION?

    1. Yes, workflow-level env variables always propagate
    2. Only if the reusable workflow is in the same repository
    3. Only on self-hosted runners
    4. No, workflow-level env variables aren't propagated to the called workflow; pass the value as an input
    Show answer

    Answer: D. Pass values explicitly with with: inputs, and secrets with secrets:.

  7. A caller wants to pass all of its secrets to a reusable workflow in the same organization without listing each one. What does it use?

    1. permissions: write-all
    2. secrets: inherit
    3. env: inherit
    4. secrets: all
    Show answer

    Answer: B. secrets: inherit passes every secret the caller can access. Otherwise, map secrets one by one.

  8. Job deploy must start only after jobs test and lint both succeed. What do you add to deploy?

    1. needs: [test, lint]
    2. if: test && lint
    3. after: [test, lint]
    4. depends-on: test, lint
    Show answer

    Answer: A. If any job in needs fails, dependent jobs are skipped unless their if says otherwise.

  9. A step should run only when an earlier step in the job has failed, for example to send an alert. Which condition does it need?

    1. if: always()
    2. if: success()
    3. if: failure()
    4. if: cancelled()
    Show answer

    Answer: C. failure() is true when any previous step failed. always() runs regardless of outcome.

  10. How does a step set an output that later steps can read as steps.<id>.outputs.version?

    1. echo "::set-output name=version::1.2.0"
    2. echo "version=1.2.0" >> "$GITHUB_OUTPUT"
    3. export version=1.2.0
    4. echo "version=1.2.0" >> "$GITHUB_STEP_SUMMARY"
    Show answer

    Answer: B. The old ::set-output command is deprecated. Write name=value lines to the $GITHUB_OUTPUT file, and give the step an id.

  11. A step needs to set an environment variable for every later step in the same job. How?

    1. Add it to GITHUB_OUTPUT
    2. Write it in a job summary
    3. export NAME=value
    4. Append NAME=value to the $GITHUB_ENV file
    Show answer

    Answer: D. export only lasts for the current step's shell. $GITHUB_ENV carries it to later steps.

  12. A test job needs a Postgres database. What's the recommended approach?

    1. Run tests against production
    2. Use a separate workflow for the database
    3. Add a service container under services: with ports and a health check
    4. Install Postgres with apt in every step
    Show answer

    Answer: C. Service containers start alongside the job, and health-check options make Actions wait until the service is ready.

  13. A matrix tests three operating systems and two Node versions. You want to skip only Windows with Node 22. Which key do you use?

    1. exclude
    2. fail-fast
    3. max-parallel
    4. include
    Show answer

    Answer: A. exclude removes combinations; include adds combinations or extra values.

  14. What's the default behavior when one job in a matrix fails?

    1. The whole repository's workflows are disabled
    2. The other matrix jobs keep running
    3. The failed job retries three times
    4. GitHub cancels the in-progress and queued jobs in that matrix, because fail-fast defaults to true
    Show answer

    Answer: D. Set fail-fast: false when you want every combination's result.

  15. What does strategy.max-parallel control?

    1. How many steps run in parallel
    2. The maximum number of matrix jobs that run at the same time
    3. The matrix size limit
    4. The number of retries
    Show answer

    Answer: B. It's useful for capping load on shared resources or limited runners. A matrix can generate up to 256 jobs per run.

  16. A workflow pinned to runs-on: ubuntu-20.04 stopped running. What's the most likely cause?

    1. The Ubuntu 20.04 runner image was retired; move to a supported image such as ubuntu-24.04
    2. A YAML syntax error
    3. The repository ran out of storage
    4. runs-on no longer accepts version labels
    Show answer

    Answer: A. Hosted images get retired over time, and -latest labels move too. windows-latest now points to Windows Server 2025.

  17. In a workflow file, what do YAML anchors (&) and aliases (*) let you do?

    1. Create matrix combinations
    2. Encrypt values
    3. Define a block once and reuse it elsewhere in the same file, reducing repetition
    4. Import other workflow files
    Show answer

    Answer: C. Workflows support YAML anchors and aliases, for example reusing an env block or a whole job configuration.

  18. A step should only run if a secret named DEPLOY_KEY is set. Why doesn't if: secrets.DEPLOY_KEY != '' work, and what's the usual fix?

    1. Secrets must be uppercase
    2. Secrets can't be referenced directly in if: conditionals; map the secret to a job-level environment variable and test that instead
    3. if only supports always()
    4. Secrets are always empty
    Show answer

    Answer: B. This is a documented limitation. Set the secret as an environment variable, then check the variable in the condition.

  19. Inside a matrix job, which context holds the current combination's values, such as os and node?

    1. runner
    2. job
    3. strategy
    4. matrix
    Show answer

    Answer: D. Use ${{ matrix.os }}. The strategy context holds things like fail-fast and the job index.

  20. Why can run: echo "${{ github.event.issue.title }}" be dangerous?

    1. Issue titles are always empty
    2. It leaks GITHUB_TOKEN
    3. The expression is substituted into the script before the shell runs it, so a crafted title can inject commands
    4. Expressions don't work in run
    Show answer

    Answer: C. Expressions are evaluated first and the result becomes part of the script. Pass untrusted values through env: instead.

  21. How do you add a Markdown report, such as test results, to a run's summary page?

    1. Append Markdown to the file at $GITHUB_STEP_SUMMARY
    2. Write it to README.md
    3. Upload it as an artifact named summary
    4. Print it to standard output
    Show answer

    Answer: A. Each step's summary content is collected and shown on the run's summary page.

  22. Which URL pattern shows a workflow status badge in a README?

    1. https://img.github.com/ci.svg
    2. https://actions.github.com/OWNER/REPO.svg
    3. https://github.com/OWNER/REPO/badge.svg
    4. https://github.com/OWNER/REPO/actions/workflows/ci.yml/badge.svg
    Show answer

    Answer: D. You can add ?branch=main to show a specific branch's status.

  23. A deployment job must wait for a person to approve it. Where do you configure that?

    1. In the runner group
    2. As a required-reviewers protection rule on the environment the job uses
    3. In the job's timeout-minutes
    4. In CODEOWNERS
    Show answer

    Answer: B. The job pauses at the environment gate until an allowed reviewer approves.

  24. Which editor tooling helps catch workflow mistakes as you type, such as unknown keys or wrong input names?

    1. The GitHub Actions extension for VS Code, with schema validation and IntelliSense for workflow files
    2. A spell checker
    3. Git hooks only
    4. No tooling exists for workflow files
    Show answer

    Answer: A. Validating in the editor catches errors before you push and wait for a failed run.

Consume and troubleshoot workflows (15–20%)

Questions 25–43.

Comparison of three ways to reuse automation: a workflow template is a scaffold copied from the organization's .github repository workflow-templates folder and is independent after creation; a reusable workflow is called with on workflow_call as a job and stays linked to a central versioned definition; a composite action packages steps that run inside the caller's job
Template, reusable workflow, or composite action: the exam expects you to know which one fits.

  1. Where can you quickly see what event triggered each recent run of a workflow?

    1. Only in the YAML file
    2. In the repository's README
    3. The run list in the Actions tab, or the EVENT column of gh run list
    4. In the audit log only
    Show answer

    Answer: C. Each run records its triggering event, such as push, pull_request, or schedule.

  2. A run failed in one step out of forty. What's the fastest way to see only the relevant logs from the terminal?

    1. gh run view RUN_ID --log
    2. gh run view RUN_ID --log-failed
    3. gh run list --all
    4. gh workflow view --yaml
    Show answer

    Answer: B. --log-failed prints just the failed steps' logs.

  3. You need much more detail from the runner and steps to debug a failure. What do you do?

    1. Add debug: true to every step
    2. Increase timeout-minutes
    3. Switch to a larger runner
    4. Re-run with debug logging, or set ACTIONS_STEP_DEBUG to true as a secret or variable
    Show answer

    Answer: D. Debug logging can be enabled for a single re-run, or for every run while the setting is present.

  4. One job in a 12-job matrix failed because of a flaky network call. How do you retry just that job?

    1. Re-run the entire workflow
    2. Push an empty commit
    3. Use Re-run job on that job in the UI, or gh run rerun --job JOB_ID
    4. Delete the run
    Show answer

    Answer: C. Re-running a single job also re-runs any jobs that depend on it.

  5. In the run view, a matrix job is shown as test (macos-latest, 22). What do the values in parentheses tell you?

    1. The matrix values for that job, so you can tell which combination failed
    2. The runner's IP address
    3. The retry count
    4. The job's priority
    Show answer

    Answer: A. Matrix job names include their axis values, which makes failures easy to locate.

  6. A workflow defines defaults: &defaults containing LOG: info and REGION: us, and a job's env uses <<: *defaults plus LOG: debug. What values does the job get?

    1. Only LOG: debug
    2. It's a YAML error
    3. LOG: info, REGION: us
    4. LOG: debug, REGION: us
    Show answer

    Answer: D. The merge key brings in the anchored mapping, and keys written locally override the merged ones.

  7. How do you download a run's artifact named dist from the terminal?

    1. gh artifact get dist
    2. gh run download RUN_ID -n dist
    3. git pull dist
    4. gh release download dist
    Show answer

    Answer: B. -n (--name) picks artifacts by name; -p matches a glob pattern.

  8. Which REST API endpoint lists a repository's workflow artifacts?

    1. GET /repos/{owner}/{repo}/actions/artifacts
    2. GET /repos/{owner}/{repo}/artifacts
    3. GET /actions/artifacts
    4. GET /repos/{owner}/{repo}/releases/assets
    Show answer

    Answer: A. Artifacts can also be downloaded and deleted through the Actions API.

  9. You delete a workflow artifact by mistake. Can it be restored?

    1. Yes, by re-running the API call
    2. Yes, from the trash within 30 days
    3. No, deleted artifacts can't be restored
    4. Only by an enterprise owner
    Show answer

    Answer: C. Re-running the job that produced the artifact is the only way to get it back.

  10. By default, how long does GitHub keep build logs and artifacts?

    1. Forever
    2. 90 days
    3. 7 days
    4. 30 days
    Show answer

    Answer: B. The default is 90 days, and it can be changed at the repository, organization, and enterprise level.

  11. Where does an organization store its own workflow templates?

    1. In GitHub Marketplace
    2. In the organization's wiki
    3. In every repository's .github/workflows folder
    4. In the workflow-templates folder of the organization's .github repository
    Show answer

    Answer: D. They then appear when members create a new workflow from the Actions tab.

  12. What file must accompany each organization workflow template?

    1. A README.md
    2. An action.yml
    3. A .properties.json metadata file with the same name as the workflow file
    4. A CODEOWNERS file
    Show answer

    Answer: C. It holds the required name and description, plus optional iconName, categories, and filePatterns.

  13. In a workflow template, what does the $default-branch placeholder do?

    1. Is replaced with the repository's default branch name when someone creates a workflow from the template
    2. Locks the template to main
    3. Lists all branches
    4. Creates a new branch
    Show answer

    Answer: A. It lets one template work across repositories that use different default branch names.

  14. A team creates a workflow from an organization template, and later the template is updated. What happens to the team's workflow?

    1. It's disabled until updated
    2. It updates automatically
    3. It's deleted
    4. Nothing; a workflow created from a template is an independent copy
    Show answer

    Answer: D. Use a reusable workflow instead when you want changes to reach every caller.

  15. What's the key difference between a reusable workflow and a composite action?

    1. Composite actions can't take inputs
    2. A reusable workflow provides whole jobs; a composite action bundles steps that run inside the caller's job
    3. Reusable workflows can't use secrets
    4. There is none
    Show answer

    Answer: B. Use a reusable workflow to share a pipeline, and a composite action to share setup steps.

  16. What's the difference between disabling a workflow and deleting its file?

    1. Disabling stops the workflow from being triggered but keeps the file, so you can re-enable it later
    2. They're the same
    3. Deleting keeps it running on schedules
    4. Disabling deletes its run history
    Show answer

    Answer: A. Disable from the Actions tab, or with gh workflow disable.

  17. A public repository's scheduled workflow stopped running after a long quiet period. Why?

    1. Schedules expire after a year
    2. Cron syntax changed
    3. In public repositories, scheduled workflows are disabled automatically after 60 days with no repository activity
    4. The runner image was deleted
    Show answer

    Answer: C. Re-enable it from the Actions tab. Scheduled workflows in a fork of a public repository are also disabled by default.

  18. How does a job call a reusable workflow that lives in another repository?

    1. run: ./call workflow
    2. uses: OWNER/REPO/.github/workflows/build.yml@v1 at the job level
    3. include: build.yml
    4. needs: OWNER/REPO
    Show answer

    Answer: B. Pin the reference to a tag, branch, or commit SHA. The workflow is called as a job, not a step.

  19. A reusable workflow in a private repository can't be called from other repositories in the organization. What's the likely fix?

    1. Make the caller public
    2. Add the caller to CODEOWNERS
    3. Rename the workflow file
    4. In the private repository's Actions settings, allow access from other repositories in the organization
    Show answer

    Answer: D. Private and internal repositories must explicitly share their workflows and actions.

Author and maintain actions (15–20%)

Questions 44–62.

  1. Which three types of custom actions can you build?

    1. Bash, PowerShell, and YAML
    2. Python, Ruby, and Go
    3. JavaScript, Docker container, and composite
    4. Public, private, and internal
    Show answer

    Answer: C. Each type is declared in action.yml under runs.using.

  2. Which custom action type can only run on Linux runners?

    1. Docker container
    2. JavaScript
    3. Composite
    4. All of them run everywhere
    Show answer

    Answer: A. Docker container actions only execute on runners with a Linux operating system. JavaScript and composite actions run on Linux, macOS, and Windows.

  3. What must an action's metadata file be named?

    1. package.json
    2. action.json
    3. workflow.yml
    4. action.yml or action.yaml
    Show answer

    Answer: D. action.yml is preferred.

  4. Which three top-level keys are required in an action's metadata file?

    1. inputs, outputs, branding
    2. name, description, runs
    3. name, version, author
    4. on, jobs, steps
    Show answer

    Answer: B. inputs, outputs, and branding are optional.

  5. Which runs.using values are valid for a JavaScript action?

    1. node20 and node24
    2. npm
    3. javascript
    4. node and deno
    Show answer

    Answer: A. Docker container actions use docker, and composite actions use composite.

  6. A run step inside a composite action fails validation. What's a likely cause?

    1. It must use uses instead
    2. Composite actions only allow one step
    3. It's missing shell, which is required for run steps in a composite action
    4. Composite actions can't use run
    Show answer

    Answer: C. Unlike workflow steps, composite action run steps must declare their shell explicitly.

  7. A JavaScript action must remove a temporary credential file after the main code finishes. Which metadata key handles this?

    1. finally
    2. post
    3. pre
    4. cleanup
    Show answer

    Answer: B. post runs at the end of the job after main; pre runs at the start.

  8. How does a JavaScript action typically read an input named api-url?

    1. process.argv[1]
    2. From a file named inputs.json
    3. From the repository secrets
    4. With core.getInput('api-url') from @actions/core, which reads the INPUT_API-URL environment variable
    Show answer

    Answer: D. Inputs are passed as INPUT_ environment variables; the toolkit handles the details.

  9. How does an action make an output available to the workflow that uses it?

    1. Save it as an artifact
    2. Return it from the Dockerfile
    3. Declare it under outputs in action.yml and set it, for example with core.setOutput or by writing to $GITHUB_OUTPUT
    4. Print it to the log
    Show answer

    Answer: C. The workflow then reads it as steps.<id>.outputs.<name>.

  10. Which workflow command, used inside an action, hides a dynamically generated value from all later logs?

    1. ::add-mask::
    2. ::debug::
    3. ::group::
    4. ::warning::
    Show answer

    Answer: A. Secrets from the secrets context are masked automatically; values you generate at runtime need add-mask.

  11. What does the @actions/core npm package provide?

    1. A Docker base image
    2. Runner installation scripts
    3. A test runner
    4. Toolkit functions for JavaScript actions: reading inputs, setting outputs, logging, and failing the step
    Show answer

    Answer: D. Companion packages such as @actions/github add an authenticated API client.

  12. Why must a JavaScript action commit its dependencies (such as node_modules), or bundle them into a single file?

    1. GitHub charges for npm install
    2. The runner doesn't install the action's dependencies before running it
    3. It's required for Docker actions
    4. It makes the action public
    Show answer

    Answer: B. Bundling with a tool like @vercel/ncc keeps the repository small.

  13. What is the branding section of action.yml for?

    1. Choosing an icon and color for the action's badge in GitHub Marketplace
    2. Signing releases
    3. Setting the action's license
    4. Defining outputs
    Show answer

    Answer: A. It's optional, but it makes the action recognizable in listings.

  14. Which is a requirement for publishing an action to GitHub Marketplace?

    1. A private repository
    2. At least 100 stars
    3. A public repository with a single action metadata file at its root
    4. A paid GitHub plan
    Show answer

    Answer: C. The action's name must also be unique, and the owner must accept the Marketplace Developer Agreement.

  15. What security requirement applies to the account publishing an action to GitHub Marketplace?

    1. A GPG key
    2. Two-factor authentication
    3. A verified domain
    4. An enterprise account
    Show answer

    Answer: B. Publishing to Marketplace requires 2FA.

  16. Which versioning practice do GitHub's guidelines recommend for actions?

    1. Use dates as versions
    2. Only ever use the main branch
    3. Never tag releases
    4. Publish semantic version releases (v1.2.0), and move a major tag (v1) to the latest compatible release
    Show answer

    Answer: D. Users can pin @v1 for compatible updates, a full release tag, or a commit SHA for maximum safety.

  17. You want an action to be usable only inside your enterprise, not publicly. Which option fits?

    1. Publish it to Marketplace
    2. Email the code to each team
    3. Keep it in a private or internal repository and allow access from other repositories in its Actions settings
    4. Store it in a gist
    Show answer

    Answer: C. Actions can be public (optionally on Marketplace), shared privately within an organization or enterprise, or local to one repository.

  18. A workflow fails with an error saying it can't find or resolve an action. Which is a likely cause?

    1. A typo in the action reference or version, or the action is in a private repository the workflow can't access
    2. The runner is out of memory
    3. Too many steps
    4. The job has no name
    Show answer

    Answer: A. Check the OWNER/REPO@ref spelling, that the ref exists, and repository access settings.

  19. What does making action releases immutable protect against?

    1. Actions using too many minutes
    2. Slow downloads
    3. Typos in action.yml
    4. A published version being changed after release, as a movable Git tag could be
    Show answer

    Answer: D. If a version can't change, pinning to it gives you exactly the code you reviewed. The exam ties this to version-pinning practice.

Manage GitHub Actions for the enterprise (20–25%)

Questions 63–86.

Nested diagram of secret and variable scopes: organization contains repository contains environment, where the most specific level wins; plus a panel contrasting encrypted, masked secrets with plain-text variables, noting that secrets aren't passed to pull requests from forks
Organization, repository, environment: the most specific level wins.

  1. A platform team wants every repository in the organization to share one CI pipeline whose updates reach all callers. What should they publish?

    1. A gist
    2. A reusable workflow in a central repository, called with uses: at the job level
    3. A workflow template
    4. A wiki page
    Show answer

    Answer: B. Callers pin a version of the central workflow; updating it updates everyone who follows that version.

  2. Which is a valid organization policy for which actions workflows may use?

    1. Allow only actions created within the enterprise, or allow those plus selected others such as GitHub-created actions and verified creators
    2. Allow only Docker actions
    3. Allow actions only from users with more than 100 followers
    4. Allow actions only on weekends
    Show answer

    Answer: A. Options range from allowing all actions to tightly limiting them, with patterns for specific approved actions.

  3. An enterprise sets an Actions policy, and an organization owner tries to set a less restrictive one. What happens?

    1. The organization's setting wins
    2. Both apply at random
    3. The enterprise policy takes precedence and limits what the organization can choose
    4. The repository decides
    Show answer

    Answer: C. Policies cascade downward: enterprise, then organization, then repository.

  4. What's a key difference between GitHub-hosted and self-hosted runners?

    1. Self-hosted runners always cost more minutes
    2. GitHub-hosted runners are fresh virtual machines managed by GitHub; self-hosted runners are machines you provide and maintain
    3. GitHub-hosted runners can't run Docker
    4. Self-hosted runners can't use secrets
    Show answer

    Answer: B. With self-hosted runners you're responsible for the operating system, tools, updates, and cleanup between jobs.

  5. Which network access does a self-hosted runner need to work?

    1. An inbound port open to the internet
    2. SSH access from GitHub
    3. A VPN to GitHub's data center
    4. Outbound HTTPS connections to GitHub; no inbound ports are required
    Show answer

    Answer: D. The runner application polls GitHub for jobs over outbound HTTPS.

  6. Which labels are applied automatically to a self-hosted runner?

    1. Only the machine's hostname
    2. No labels; you must add them all
    3. self-hosted, plus labels for its operating system and architecture, such as linux and x64
    4. gpu and fast
    Show answer

    Answer: C. Add custom labels for capabilities, and target them with runs-on: [self-hosted, linux, gpu].

  7. What are runner groups for?

    1. Controlling which organizations, repositories, and workflows can use a set of runners
    2. Naming runners
    3. Billing reports
    4. Grouping jobs in a workflow
    Show answer

    Answer: A. Runner groups are the access-control layer for shared runners.

  8. A new self-hosted runner is registered at the organization level without choosing a group. Where does it go?

    1. Nowhere, so it can't be used
    2. Into a group named after the repository
    3. Into the enterprise's group
    4. Into the Default runner group
    Show answer

    Answer: D. Restrict the Default group's access, or create dedicated groups, to keep runners from being used too widely.

  9. Why is attaching self-hosted runners to a public repository risky?

    1. Self-hosted runners don't support public repositories
    2. Anyone who opens a pull request may get code running on your machine and network
    3. Public repositories can't use labels
    4. It doubles billing
    Show answer

    Answer: B. GitHub recommends self-hosted runners only for private repositories, or very careful isolation.

  10. What does registering a self-hosted runner as ephemeral do?

    1. The runner takes exactly one job and then unregisters, so state from one job can't leak into the next
    2. Makes it run faster
    3. Makes it free
    4. Lets it run without a network
    Show answer

    Answer: A. Ephemeral runners are a common hardening and autoscaling pattern.

  11. Which GitHub-maintained project autoscales self-hosted runners on Kubernetes?

    1. CodeQL
    2. Dependabot
    3. Actions Runner Controller (ARC)
    4. GitHub Codespaces
    Show answer

    Answer: C. ARC scales runner pods up and down based on demand.

  12. An organization's IP allow list blocks GitHub-hosted runners from reaching its resources. What's a supported way to make that work?

    1. Use runs-on: any
    2. Use larger runners with static IP addresses and add those IPs to the allow list
    3. Disable the allow list
    4. Switch every repository to public
    Show answer

    Answer: B. Standard hosted runners use shared, changing IP ranges; larger runners can have static IPs.

  13. A self-hosted runner shows as offline. What should you check?

    1. The workflow's matrix
    2. The repository's README
    3. The organization's billing email
    4. Whether the runner service is running, whether the machine can reach GitHub, and the runner's _diag log files
    Show answer

    Answer: D. Most offline runners come down to a stopped service, the network, or expired registration.

  14. Where can you find which tools and versions come preinstalled on GitHub-hosted runners?

    1. The Marketplace
    2. The audit log
    3. The runner image documentation and release notes, which list installed software
    4. Nowhere; it's secret
    Show answer

    Answer: C. Check the image's software list before adding install steps; you may not need them.

  15. A workflow needs a tool version that isn't on the hosted image. What's the recommended approach?

    1. Use a setup-* action or package manager in the workflow, ideally with caching, or a container or custom image
    2. Ask GitHub Support to install it
    3. Hard-code a download in every repository
    4. Switch to a different repository
    Show answer

    Answer: A. setup-* actions use the runner's tool cache when the version is already there.

  16. Which repository access options does an organization-level secret offer?

    1. Only all repositories
    2. Only public repositories
    3. Only repositories created after the secret
    4. All repositories, private repositories, or selected repositories
    Show answer

    Answer: D. Selected-repository access is the least-privilege choice for sensitive organization secrets.

  17. A secret named API_KEY exists at the organization, repository, and environment levels. A job using that environment reads secrets.API_KEY. Which value does it get?

    1. The repository's
    2. The environment's
    3. The job fails because of the conflict
    4. The organization's
    Show answer

    Answer: B. The most specific level wins: environment, then repository, then organization.

  18. When are environment secrets available to a job?

    1. Only to jobs that reference that environment, after its protection rules pass
    2. Only in reusable workflows
    3. Only on self-hosted runners
    4. To every job in the repository
    Show answer

    Answer: A. This keeps production credentials out of jobs that don't deploy.

  19. What does setting a secret through the REST API require that gh secret set handles for you?

    1. A Git commit
    2. Base64-encoding the secret's name
    3. Encrypting the value with the repository's or organization's public key before sending it
    4. Admin approval
    Show answer

    Answer: C. The API only accepts sealed values; gh fetches the public key and encrypts for you.

  20. When should you use a configuration variable instead of a secret?

    1. For API tokens
    2. For non-sensitive settings such as regions or feature flags, read with vars.NAME
    3. For passwords
    4. Never; variables are deprecated
    Show answer

    Answer: B. Variables are plain text and appear in logs; secrets are encrypted and masked.

  21. Which command sets an organization secret that only two named repositories can use?

    1. gh variable set TOKEN --private
    2. gh secret set TOKEN --all
    3. gh secret set TOKEN --env org
    4. gh secret set TOKEN --org ORG --repos repo1,repo2
    Show answer

    Answer: D. --org targets the organization and --repos limits access to specific repositories.

  22. A workflow triggered by a pull request from a fork tries to read a repository secret. What happens?

    1. The workflow is deleted
    2. The secret is printed in plain text
    3. Secrets aren't passed to workflows triggered by pull requests from forks; GITHUB_TOKEN is read-only
    4. It reads the secret normally
    Show answer

    Answer: C. This stops untrusted code from exfiltrating secrets.

  23. Which two kinds of runs don't consume billed GitHub Actions minutes? (Choose two.)

    1. Jobs on standard GitHub-hosted runners in a private repository beyond the included quota
    2. Jobs on larger runners
    3. Jobs on self-hosted runners
    4. Jobs on standard GitHub-hosted runners in a public repository
    Show answer

    Answer: C and D. Standard hosted runners are free in public repositories, and self-hosted runners aren't billed for minutes. Larger runners are always billed.

  24. An organization wants to reuse one runner pool across many repositories but keep production deploy jobs on separate machines. What's the cleanest setup?

    1. Use one runner for everything
    2. Run deploys on GitHub-hosted runners only
    3. Put every runner in the Default group
    4. Use separate runner groups with different repository and workflow access, plus labels to target them
    Show answer

    Answer: D. Runner groups control access; labels let jobs target specific machines.

Secure and optimize automation (10–15%)

Questions 87–100.

  1. Which feature adds a human approval step before a job can use production credentials?

    1. A timeout-minutes value
    2. An environment with required reviewers
    3. A larger runner
    4. A matrix strategy
    Show answer

    Answer: B. Environment protection rules, such as required reviewers, wait timers, and branch restrictions, gate the job.

  2. Which signals help you judge whether a Marketplace action is trustworthy? (Choose two.)

    1. A verified creator badge, or being created by GitHub
    2. A long action name
    3. An actively maintained, readable source repository
    4. A recent date in the README title
    Show answer

    Answer: A and C. Read the source, check maintenance, and still pin to a full commit SHA.

  3. What's the safest way to use a pull request title in a run step?

    1. Insert it with ${{ github.event.pull_request.title }} directly in the script
    2. Base64-encode it in the YAML
    3. Pass it through an env: variable and reference the variable in the script, with proper quoting
    4. It can never be used
    Show answer

    Answer: C. Values in environment variables are treated as data by the shell, not as code.

  4. Which of these values can an attacker control in a workflow triggered by a pull request?

    1. github.run_id
    2. github.event.pull_request.title and github.head_ref
    3. runner.os
    4. github.repository_owner
    Show answer

    Answer: B. Titles, bodies, branch names, and commit messages are all user-supplied input.

  5. When is GITHUB_TOKEN created, and when does it expire?

    1. When an admin rotates it
    2. Once per repository; it never expires
    3. Once per day
    4. At the start of each job; it expires when the job finishes (at most 6 hours on GitHub-hosted runners)
    Show answer

    Answer: D. It's ephemeral and scoped to the repository that contains the workflow.

  6. How does GITHUB_TOKEN differ from a personal access token?

    1. There's no difference
    2. It has access to all of the user's repositories
    3. It's created automatically per job, scoped to one repository, and expires on its own; a PAT is tied to a user and lives until it's revoked or expires
    4. PATs are always safer
    Show answer

    Answer: C. Prefer GITHUB_TOKEN with minimal permissions, and reach for a PAT or GitHub App token only when you need more.

  7. How do you restrict GITHUB_TOKEN to read-only repository contents for a whole workflow?

    1. permissions: contents: read at the top of the workflow
    2. Use a self-hosted runner
    3. Delete the token
    4. token: readonly
    Show answer

    Answer: A. Widen permissions only on the specific jobs that need write access.

  8. A workflow pushes a commit using GITHUB_TOKEN. Will that push trigger the repository's on: push workflows?

    1. Only on Sundays
    2. Yes, always
    3. Only for tags
    4. No; events created with GITHUB_TOKEN don't start new workflow runs, except workflow_dispatch and repository_dispatch
    Show answer

    Answer: D. This prevents accidental infinite loops of workflows triggering each other.

  9. Which permission must a job have to request an OIDC token for cloud federation?

    1. contents: write
    2. id-token: write
    3. packages: read
    4. actions: write
    Show answer

    Answer: B. With OIDC, the cloud provider trusts a short-lived token instead of a stored long-lived secret.

  10. What's the most secure way to reference a third-party action?

    1. A full-length commit SHA, with the version in a comment
    2. @main
    3. A major version tag such as @v2
    4. @latest
    Show answer

    Answer: A. A SHA can't be moved to different code, unlike branches and tags.

  11. What do artifact attestations give you?

    1. Faster downloads
    2. Free storage
    3. Signed provenance showing which workflow, repository, and commit produced a build, which consumers can check with gh attestation verify
    4. Automatic version tags
    Show answer

    Answer: C. Generate them with actions/attest-build-provenance, which needs id-token: write and attestations: write.

  12. Which statement about the dependency cache is correct?

    1. Each job gets 100 GB
    2. The default limit is 10 GB per repository, and entries not accessed for 7 days are removed
    3. Caches never expire
    4. Caches are shared across all GitHub users
    Show answer

    Answer: B. Design keys with hashFiles and use restore-keys for prefix fallbacks.

  13. Build artifacts are filling storage, but they're only needed for a day. What's the best fix?

    1. Delete the workflow
    2. Stop uploading artifacts
    3. Make the repository public
    4. Set a short retention-days on the upload step, and lower the default retention in settings or through the REST API
    Show answer

    Answer: D. Retention can be tuned per artifact and at the repository, organization, and enterprise level.

  14. Which two changes reduce wasted runner time on busy pull requests? (Choose two.)

    1. paths filters, so only relevant changes trigger the workflow
    2. Increasing timeout-minutes to 360
    3. Removing all caching
    4. A concurrency group with cancel-in-progress: true
    Show answer

    Answer: A and D. Cancel superseded runs and skip runs that can't be affected by the change.

Final tips for exam day

  • Workflow authoring and enterprise management are nearly half the exam. Know triggers, contexts, GITHUB_OUTPUT and GITHUB_ENV, runner groups, policies, and secret scopes cold.
  • Learn the limits and defaults: a 360-minute job timeout, up to 256 matrix jobs, a 5-minute minimum schedule in UTC, a 10 GB cache with 7-day eviction, 90-day log and artifact retention, 10 levels of reusable-workflow nesting, and up to 50 unique reusable workflows per workflow file.
  • Know the exceptions: secrets can't be used directly in if:, the caller's workflow-level env doesn't reach a reusable workflow, Docker actions only run on Linux, and events created with GITHUB_TOKEN don't start new runs (except workflow_dispatch and repository_dispatch).
  • On security questions, pick least privilege: pin by SHA, minimal permissions, OIDC instead of stored cloud keys, environments with reviewers, and untrusted input passed through env.
  • Build one of each: a reusable workflow, a composite action, a JavaScript action, and an organization workflow template. An afternoon of hands-on practice covers a lot of the exam.

Official resources

For hands-on practice, work through GitHub Actions: 100 Quick Lessons in CI/CD. Preparing for more GitHub certifications? See the GitHub Foundations (GH-900) and GitHub Copilot (GH-300) practice guides.