GitHub Administration Certification (GH-100): Exam Guide and 100 Practice Questions

The GitHub Administration certification (exam GH-100) is for the people who run GitHub for a company: identity and access, enterprise deployment and licensing, security policy and compliance, GitHub Actions at scale, and keeping usage and costs under control. It's an intermediate-level exam covering both GitHub Enterprise Cloud and GitHub Enterprise Server.

This guide covers the exam as of its July 2026 skills update, then gives you 100 original practice questions weighted like the real exam. Each one hides its answer and an explanation until you open it. Rate limits, retention periods, token policies, and deployment details were checked against GitHub's documentation in October 2026. The questions are written for practice; they aren't taken from the real exam.

The exam at a glance

Exam code: GH-100, for the GitHub Administration certification. Level: intermediate.
Time: 100 minutes. The exam is English only; if English isn't your first language, you can request 30 extra minutes.
Passing score: 700 or higher.
Delivery: proctored, scheduled through Pearson VUE from the Microsoft Learn certification page. Price depends on the country where you take it.
Language: English only, unlike the other GitHub exams, which are also offered in Spanish, Portuguese (Brazil), Korean, and Japanese.
Retakes: you can retake 24 hours after a first failed attempt; later retakes have longer waits.
Validity: 2 years. GitHub is moving its certifications to Microsoft's recertification process, and certifications that expire before that's in place are being extended by 6 months.
Free extras: an official practice assessment and an exam sandbox that shows the real question interface.

Microsoft doesn't publish a fixed number of questions. Check the official pages linked at the end before you book, since details change.

The five domains and their weights

Horizontal bar chart of GH-100 domain weights: identities and access 15 to 20 percent; enterprise environment 10 to 15 percent; secure development and compliance 25 to 30 percent; GitHub Actions 20 to 25 percent; monitoring and optimizing usage 10 to 15 percent — Secure development and compliance is the biggest domain, followed by GitHub Actions. The table below has the same numbers.

Domain	Exam weight	Practice questions here
Manage GitHub identities and access	15–20%	19
Administer GitHub Enterprise environment	10–15%	14
Implement secure software development and compliance	25–30%	28
Manage GitHub Actions	20–25%	24
Monitor and optimize GitHub usage	10–15%	15

The July 2026 update rewrote every objective. Topics to make sure you cover include the four named deployment scenarios (Enterprise Cloud with managed users, with data residency plus managed users, with personal accounts, and Enterprise Server); SCIM versus team synchronization; enterprise teams; rate limits for personal access tokens and GitHub Apps; Azure private networking for hosted runners; integrating third-party secret vaults; and interpreting usage reports for metered products.

How to use these questions

Answer each question before opening its answer, and tally your misses per domain. Questions marked Choose two need both correct options. Many questions are scenarios. Ask who owns the problem (an administrator or GitHub Support), then pick the least-privilege, most centralized option; that's usually the intended answer. If you get more than about 80% right, take the official practice assessment next.

Manage GitHub identities and access (15–20%)

Questions 1–19.

Comparison of SAML SSO, SCIM, and team synchronization: SAML SSO handles sign-in through the identity provider; SCIM provisions and deprovisions accounts and memberships, and is central to Enterprise Managed Users; team sync keeps an existing team matched to up to five identity provider groups, requires SAML SSO, and doesn't create accounts — Sign in, provision, or group: the verb in the question tells you which feature it's asking about.

What's the main difference between Enterprise Managed Users (EMU) and personal accounts?
1. EMU accounts are free
2. EMU accounts can only use GitHub Mobile
3. With EMU, your identity provider creates and controls the accounts, and managed users can't create public content or collaborate outside the enterprise
4. Personal accounts can't use SAML SSO
Show answer

Answer: C. Personal accounts belong to the individual; managed user accounts belong to the company.
Which are the partner identity providers for Enterprise Managed Users?
1. Any OpenID provider
2. Microsoft Entra ID, Okta, and PingFederate
3. LDAP, CAS, and Active Directory Federation Services only
4. Google Workspace, Auth0, and Keycloak
Show answer

Answer: B. GitHub recommends using one partner IdP for both authentication and provisioning.
An EMU enterprise wants to use OIDC instead of SAML for authentication. Which identity provider supports that?
1. Okta
2. None; EMU only supports SAML
3. PingFederate
4. Microsoft Entra ID
Show answer

Answer: D. Entra ID supports SAML or OIDC. Okta and PingFederate support SAML.
A company wants to use Okta for SSO and Microsoft Entra ID for SCIM provisioning with EMU. Is that supported?
1. Only with GitHub Enterprise Server
2. Only for enterprises under 500 users
3. No; mixing Okta and Entra ID for SSO and SCIM is explicitly unsupported
4. Yes, any mix works
Show answer

Answer: C. Use a single partner IdP for both.
What does SAML single sign-on do for an organization or enterprise?
1. Requires people to authenticate through your identity provider before they can access its resources
2. Encrypts repositories
3. Creates user accounts automatically
4. Replaces two-factor authentication on personal accounts
Show answer

Answer: A. SSO handles sign-in. Account lifecycle is SCIM's job.
Why configure SAML SSO at the enterprise level rather than separately on each organization?
1. Enterprise-level SSO disables 2FA
2. Organization-level SSO is more secure
3. It's the only option
4. One configuration then applies to every organization in the enterprise
Show answer

Answer: D. Centralizing identity at the enterprise avoids inconsistent per-organization setups.
An organization starts requiring two-factor authentication. What happens to members who don't have 2FA enabled?
1. Their repositories are deleted
2. They're removed from the organization until they enable 2FA and are reinstated
3. They're converted to managed users
4. Nothing until they next sign in
Show answer

Answer: B. Members and outside collaborators without 2FA lose access. Warn people before turning the requirement on.
What is SCIM used for?
1. Provisioning: the identity provider creates, updates, and deactivates accounts and memberships
2. Single sign-on
3. Encrypting traffic
4. Code scanning
Show answer

Answer: A. Deactivating someone in the IdP then removes their access on GitHub.
What does team synchronization require?
1. GitHub Enterprise Server
2. A GitHub App
3. SAML SSO, an existing GitHub team, and members who are already in the organization and have authenticated through SSO
4. A public organization
Show answer

Answer: C. Creating a group in the IdP doesn't create a team on GitHub.
How many identity provider groups can be connected to one team with team synchronization?
1. Unlimited
2. Up to five
3. One
4. Up to 50
Show answer

Answer: B. Group membership is refreshed at least once every hour.
An enterprise uses Enterprise Managed Users. How is team membership synchronized with the identity provider?
1. Through team synchronization
2. Through a GitHub Action
3. Manually only
4. Through the enterprise's SCIM configuration; team sync isn't needed
Show answer

Answer: D. Managed-user enterprises manage team membership through SCIM.
Which statement about team synchronization is correct?
1. It creates teams automatically from IdP groups
2. It works without SSO
3. It isn't a provisioning service; it only adds existing organization members to teams based on IdP groups
4. It provisions new user accounts
Show answer

Answer: C. That's the key difference from SCIM.
An organization enforces SAML SSO. A developer's personal access token suddenly can't reach the organization's repositories. What's the likely fix?
1. Authorize the token for SAML SSO with that organization
2. Disable 2FA
3. Make the repositories public
4. Create a new GitHub account
Show answer

Answer: A. Under SSO enforcement, personal access tokens and SSH keys must be authorized for the organization.
Which organization role can manage billing without access to repositories or other settings?
1. Moderator
2. Security manager
3. Owner
4. Billing manager
Show answer

Answer: D. Other organization roles include owner, member, moderator, and security manager.
What do an organization's base permissions control?
1. Billing limits
2. The default access every member has to all of the organization's repositories
3. Who can create teams
4. SSO settings
Show answer

Answer: B. Options are no permission, read, write, or admin. Least privilege usually means no permission or read.
On GitHub Enterprise Cloud, what is a custom repository role?
1. A role built from a base repository role plus specific extra permissions
2. A role for GitHub Apps only
3. A team with a custom name
4. A billing role
Show answer

Answer: A. Custom roles fill gaps between the five built-in repository roles.
What are enterprise teams for?
1. Billing only
2. Running Actions
3. Grouping people at the enterprise level so you can manage access and assignments across organizations
4. Replacing organizations
Show answer

Answer: C. They let administrators manage a group once at the enterprise level instead of in every organization.
You need to find out who changed a repository's access settings last week. Where do you look?
1. The repository's README
2. The organization or enterprise audit log
3. The Actions tab
4. The network graph
Show answer

Answer: B. The audit log records who did what, and when.
What advantage do rulesets have over classic branch protection rules?
1. They replace the audit log
2. They disable required reviews
3. They're only for public repositories
4. They can apply across many repositories at the organization or enterprise level, stack together, and define bypass lists
Show answer

Answer: D. Rulesets make consistent governance possible at scale.

Administer GitHub Enterprise environment (10–15%)

Questions 20–33.

Comparison of four GitHub Enterprise deployments: Enterprise Cloud with personal accounts on github.com; Enterprise Cloud with Enterprise Managed Users on github.com; Enterprise Cloud with data residency on a GHE.com subdomain, always using managed users, in the EU, Australia, US, or Japan; and GitHub Enterprise Server, self-hosted, where you run upgrades, backups, and support bundles — Two questions sort almost every deployment scenario: who owns the accounts, and where the data lives.

Which issue should an administrator resolve, rather than escalate to GitHub Support?
1. A suspected bug in the GitHub Enterprise Server appliance
2. Corruption of GitHub's hosted infrastructure
3. Adding a user to a team and adjusting their repository access
4. A GitHub.com outage
Show answer

Answer: C. Access, settings, and policies are the administrator's job. Platform bugs and outages go to GitHub Support.
What's the difference between a GHES diagnostic file and a support bundle?
1. A diagnostic file holds settings and environment details only; a support bundle adds sanitized recent logs
2. A support bundle has no logs
3. Diagnostics files include source code
4. They're identical
Show answer

Answer: A. Generate them with ghe-diagnostics and ghe-support-bundle.
GitHub Support asks for an extended support bundle from your GHES instance. Which command creates one?
1. ghe-backup
2. ghe-diagnostics -x
3. gh support bundle
4. ghe-support-bundle -o -x
Show answer

Answer: D. A standard bundle covers the past two days of logs; an extended bundle covers eight days and requires SSH.
How can you send a support bundle from a GHES instance straight to GitHub Support?
1. Post it in GitHub Discussions
2. Run ghe-support-bundle -u over SSH
3. Email it as an attachment
4. Commit it to a repository
Show answer

Answer: B. Direct upload needs outbound HTTPS access to GitHub's upload endpoints.
Where is an Enterprise Managed Users enterprise hosted when it uses GitHub Enterprise Cloud with data residency?
1. A dedicated subdomain of GHE.com
2. Your own data center
3. github.com
4. Any domain you choose
Show answer

Answer: A. Data residency enterprises always use Enterprise Managed Users.
Which regions are available for GitHub Enterprise Cloud with data residency?
1. Every Azure region
2. Only the US
3. EU, Australia, US, and Japan
4. Only the EU
Show answer

Answer: C. GitHub plans to add more regions.
Which deployment requires your team to handle upgrades, backups, and high availability?
1. GHEC with data residency
2. GitHub Enterprise Server
3. GHEC with personal accounts
4. GHEC with Enterprise Managed Users
Show answer

Answer: B. GHES runs in your data center or your cloud account, so you operate it.
A company wants employees to keep contributing to public open source projects with the same account they use at work. Which deployment fits?
1. GHEC with data residency
2. An air-gapped GHES
3. GHEC with Enterprise Managed Users
4. GHEC with personal accounts
Show answer

Answer: D. Managed users can't create public content or collaborate outside the enterprise.
Which is a sensible organization-wide standard for branching?
1. Everyone commits directly to main
2. No branch naming at all
3. Short-lived feature branches merged through reviewed pull requests, with main protected
4. One long-lived branch per developer
Show answer

Answer: C. Pair it with rulesets that require reviews and passing checks.
Which practice best standardizes code review across many repositories?
1. Use CODEOWNERS files plus rulesets requiring approving reviews
2. Disable reviews for speed
3. Email diffs to reviewers
4. Rely on each team's habits
Show answer

Answer: A. Code owners route reviews to the right people; rulesets enforce them.
How is GitHub Enterprise primarily licensed?
1. Per commit
2. Per organization only
3. Per repository
4. Per user (seat), with usage-based billing for metered products such as Actions minutes and storage
Show answer

Answer: D. Seats cover people; metered products are billed for what you use beyond what's included.
A company runs both GitHub Enterprise Cloud and GitHub Enterprise Server. How should one person who uses both be counted?
1. Not at all
2. As one license, once license usage is synchronized between the deployments
3. As half a license each
4. As two licenses, always
Show answer

Answer: B. Syncing license usage deduplicates people who have accounts in both.
Where should an enterprise administrator check how many seats are consumed?
1. The enterprise account's licensing and billing settings, which can also be exported
2. A repository's Insights tab
3. The audit log only
4. GitHub Status
Show answer

Answer: A. Review it regularly to spot unused seats.
Which is a good standard for releases across an organization?
1. Release only from personal forks
2. Email binaries
3. Tag versions consistently, for example with semantic versioning, and publish GitHub releases with notes
4. Ship whatever is on main with no tags
Show answer

Answer: C. Consistent tagging makes rollbacks and audits easier.

Implement secure software development and compliance (25–30%)

Questions 34–61.

An enterprise owner sets a policy restricting repository creation. Can an organization owner set a looser policy for their organization?
1. Only for private repositories
2. No; enterprise policies take precedence and limit organization choices
3. Yes, organization settings always win
4. Only during business hours
Show answer

Answer: B. Policies cascade from enterprise to organization to repository.
Which organization rule applies the same branch requirements to many repositories at once?
1. A CODEOWNERS file
2. A webhook
3. A team
4. An organization ruleset that targets repositories by name or property
Show answer

Answer: D. Rulesets scale governance in a way per-repository branch protection can't.
An organization wants to stop members from creating public repositories. Where is that controlled?
1. The audit log
2. In each repository's settings
3. The organization's repository creation policy
4. The billing settings
Show answer

Answer: C. Enterprises can enforce this policy for all their organizations.
Which organization setting best supports least privilege for new members?
1. Base permission: No permission or Read, with access granted through teams
2. Base permission: Admin
3. Base permission: Write
4. Make all members owners
Show answer

Answer: A. Grant extra access through teams and roles, not defaults.
What does an IP allow list do?
1. Encrypts repositories
2. Blocks spam issues
3. Speeds up Git operations
4. Allows access to the organization's or enterprise's resources only from listed IP addresses
Show answer

Answer: D. Remember to include addresses for runners and apps that need access.
How far back does the enterprise audit log keep events?
1. 30 days
2. The last 180 days, with Git events kept for 7 days
3. Forever
4. 7 days for everything
Show answer

Answer: B. Stream the audit log to keep events for longer.
Which destinations does GitHub audit log streaming support? (Choose two.)
1. A Git repository
2. Azure Event Hubs
3. Splunk
4. An email inbox
Show answer

Answer: B and C. Supported destinations include Amazon S3, Azure Blob Storage, Azure Event Hubs, Datadog, Google Cloud Storage, and Splunk.
How can you query the enterprise audit log programmatically?
1. Only by exporting a CSV by hand
2. It isn't possible
3. Through the audit log REST API
4. Through the Git protocol
Show answer

Answer: C. You can also search and export it in the web interface.
Which feature notifies you when a dependency in a repository has a known vulnerability?
1. Code scanning
2. Dependabot alerts
3. Branch protection
4. Secret scanning
Show answer

Answer: B. Dependabot alerts rely on the dependency graph and the GitHub Advisory Database.
What's the difference between Dependabot security updates and version updates?
1. They're the same
2. Version updates only fix vulnerabilities
3. Security updates require GitHub Enterprise Server
4. Security updates open pull requests to fix vulnerable dependencies; version updates keep dependencies current on a schedule set in dependabot.yml
Show answer

Answer: D. Many teams turn on both.
What does secret scanning push protection do?
1. Rotates leaked credentials
2. Encrypts secrets
3. Blocks pushes that contain supported secrets before they reach the repository
4. Scans old commits only
Show answer

Answer: C. Users can bypass it with a reason, which creates an alert and an audit log entry.
Which reasons can a user give when bypassing push protection?
1. It's used in tests; it's a false positive; I'll fix it later
2. Only "false positive"
3. No reason is needed
4. It's urgent; my manager approved
Show answer

Answer: A. "I'll fix it later" leaves an open alert; the other two create closed alerts.
What's the quickest way to start CodeQL code scanning on a supported repository?
1. Install an IDE plugin
2. Email GitHub Support
3. Write a custom workflow from scratch
4. Enable default setup, which configures CodeQL automatically
Show answer

Answer: D. Use advanced setup when you need custom queries or build steps.
What does a repository security advisory let maintainers do?
1. Block all forks
2. Privately discuss and fix a vulnerability, then publish an advisory and optionally request a CVE
3. Disable Dependabot
4. Delete vulnerabilities automatically
Show answer

Answer: B. Private collaboration keeps details out of public view until a fix is ready.
How can outside researchers report a vulnerability to you privately on GitHub?
1. Through private vulnerability reporting, if it's enabled on the repository
2. Open a public issue
3. Post in Discussions
4. Comment on a pull request
Show answer

Answer: A. It routes reports to maintainers without public disclosure.
Which file tells people how to report security problems in a repository?
1. README.md
2. .gitignore
3. SECURITY.md
4. CONTRIBUTING.md
Show answer

Answer: C. It's shown as the security policy in the repository's Security tab.
A valid production API key was committed to a repository. What's the first step?
1. Make the repository private
2. Revoke and rotate the key, then clean up the history and investigate
3. Delete the commit
4. Dismiss the alert
Show answer

Answer: B. Removing the commit doesn't help if the key was already copied. Rotation does.
Which step belongs in a security response plan?
1. Ignore low-severity alerts forever
2. Let each developer decide alone
3. Disable all security features during incidents
4. Define who triages alerts, timelines by severity, how secrets get rotated, and how advisories are published
Show answer

Answer: D. A written plan makes response consistent and fast.
What's the main advantage of fine-grained personal access tokens over classic ones?
1. They have no rate limits
2. They work without 2FA
3. They can be limited to specific resources and permissions
4. They never expire
Show answer

Answer: C. Classic tokens use broad scopes that apply to everything the user can access.
By default, what happens when a fine-grained personal access token tries to access an organization's resources?
1. It needs approval from an organization administrator; owners' own tokens skip approval
2. It's blocked permanently
3. It's converted to a classic token
4. Access is granted immediately
Show answer

Answer: A. Owners can change this requirement in the organization's settings.
What is the default maximum lifetime organizations allow for fine-grained personal access tokens?
1. 30 days
2. Unlimited
3. 90 days
4. 366 days
Show answer

Answer: D. Owners can set a shorter maximum lifetime.
How can an organization stop classic personal access tokens from accessing its resources?
1. Disable 2FA
2. Turn on the setting that restricts classic personal access tokens from accessing the organization
3. Require OIDC
4. Delete every user's tokens
Show answer

Answer: B. Both token types are allowed by default.
A member's token violates a new maximum-lifetime policy. What happens to it?
1. It's blocked from accessing the organization but isn't revoked
2. Nothing
3. It's extended automatically
4. It's revoked
Show answer

Answer: A. Users find out when their API calls are rejected.
What's the primary REST API rate limit for requests authenticated with a personal access token?
1. Unlimited
2. 60 requests per hour
3. 5,000 requests per hour
4. 1,000 requests per hour
Show answer

Answer: C. Unauthenticated requests get 60 per hour.
How does the rate limit for a GitHub App installation on an Enterprise Cloud organization compare to the standard one?
1. It's identical
2. It's 15,000 requests per hour, versus a standard limit that starts at 5,000 and scales up to 12,500
3. There's no limit
4. It's lower
Show answer

Answer: B. Standard installation limits grow with the number of repositories and organization users.
Why does GitHub recommend GitHub Apps over OAuth apps for most integrations?
1. They don't need installation
2. They're older
3. They share the user's rate limit
4. They use fine-grained permissions, can act on their own, and use installation tokens that expire after an hour
Show answer

Answer: D. OAuth apps use broad scopes and, by default, long-lived tokens. They're still needed for some enterprise-level resources.
How can an organization control which OAuth apps can access its data?
1. It can't
2. Disable all integrations
3. Enable OAuth app access restrictions so apps need owner approval
4. Require apps to be public
Show answer

Answer: C. Approvals keep unvetted apps from reaching organization resources.
An organization wants an integration that keeps working after the employee who installed it leaves. What should they use?
1. A GitHub App
2. A deploy key from a personal account
3. A personal access token
4. An OAuth app authorized by that employee
Show answer

Answer: A. GitHub Apps act independently of a user; tokens tied to a person stop working when the person leaves.

Manage GitHub Actions (20–25%)

Questions 62–85.

Which is a valid organization policy for GitHub Actions?
1. Allow actions only from verified creators on weekends
2. Allow only Docker actions
3. Allow actions only in public repositories
4. Allow all actions, allow only actions created in the enterprise, or allow those plus selected actions
Show answer

Answer: D. Selected actions can include GitHub-created actions, verified creators, and specific patterns.
An enterprise restricts actions to enterprise-created ones. Can an organization allow all actions?
1. Only with approval from GitHub
2. No; the enterprise policy limits what organizations can allow
3. Only for private repositories
4. Yes
Show answer

Answer: B. Enterprise policies set the outer boundary.
How do other repositories in the organization get to use an action stored in a private repository?
1. In the private repository's Actions settings, allow access from repositories in the organization
2. Copy the code everywhere
3. Publish it to Marketplace
4. Make the repository public
Show answer

Answer: A. Internal and private repositories must opt in to sharing actions and workflows.
Where does an organization keep its workflow templates?
1. In each repository
2. In a wiki
3. In the workflow-templates folder of the organization's .github repository
4. In the audit log
Show answer

Answer: C. Each template needs a matching .properties.json metadata file.
What's the best way to make one CI pipeline the standard across the enterprise?
1. Email the workflow
2. Publish a reusable workflow in a shared repository and have repositories call it
3. Use a gist
4. Paste the YAML into every repository
Show answer

Answer: B. Updating the central workflow updates every caller that follows that version.
What are runner groups used for?
1. Billing reports
2. Storing secrets
3. Naming jobs
4. Controlling which organizations, repositories, and workflows can use a set of runners
Show answer

Answer: D. They're the access-control layer for shared runners.
Where do new self-hosted runners go if you don't choose a group?
1. A random group
2. The enterprise owners' group
3. The Default runner group
4. Nowhere
Show answer

Answer: C. Restrict the Default group or create dedicated groups.
What's a key operational difference between GitHub-hosted and self-hosted runners?
1. GitHub maintains hosted runners and gives each job a fresh machine; you maintain self-hosted runners
2. Self-hosted runners are always free and maintenance-free
3. Self-hosted runners can't use labels
4. Hosted runners can't run Docker
Show answer

Answer: A. Self-hosted runners mean you own patching, tooling, and cleanup.
Which hosted runners can you place in your own Azure Virtual Network with Azure private networking?
1. Standard hosted runners
2. Self-hosted runners only
3. All runners, including macOS
4. Larger runners
Show answer

Answer: D. Azure private networking works with larger Ubuntu and Windows runners, not standard runners.
What does Azure private networking for hosted runners make possible?
1. Skipping authentication
2. Reaching private resources in your VNET and applying your network policies, without opening internet ports
3. Free minutes
4. Running on-premises without Azure
Show answer

Answer: B. GitHub still manages the runners; you control the networking.
Your organization's IP allow list blocks GitHub-hosted runners. What's a supported approach?
1. Use larger runners with static IP addresses and add them to the allow list
2. Turn off the allow list
3. Use runs-on: any
4. Make repositories public
Show answer

Answer: A. Standard hosted runners use shared, changing IP ranges.
What network access does a self-hosted runner need?
1. Inbound ports open to the internet
2. SSH access from GitHub
3. Outbound HTTPS to GitHub; no inbound ports
4. A VPN to GitHub
Show answer

Answer: C. The runner polls GitHub for jobs.
Which labels does a self-hosted runner get automatically?
1. Only its hostname
2. self-hosted, plus labels for its operating system and architecture
3. None
4. gpu
Show answer

Answer: B. Add custom labels for special hardware.
What do ephemeral self-hosted runners do?
1. Run faster
2. Run without a network
3. Avoid billing
4. Take a single job and then unregister, so no state carries over between jobs
Show answer

Answer: D. They're a common hardening pattern, often combined with autoscaling.
Which GitHub-maintained project autoscales self-hosted runners on Kubernetes?
1. CodeQL
2. GitHub Connect
3. Actions Runner Controller (ARC)
4. Dependabot
Show answer

Answer: C. ARC scales runner pods with demand.
A self-hosted runner shows as offline. What should you check?
1. The runner service status, network access to GitHub, and the runner's _diag logs
2. Team membership
3. Billing settings
4. The organization's README
Show answer

Answer: A. Most problems are a stopped service, the network, or an expired registration.
Jobs wait a long time in the queue for self-hosted runners. What's the most direct fix?
1. Delete the queue
2. Increase timeout-minutes
3. Switch to manual runs
4. Add capacity, for example more runners or autoscaling, and check that labels match
Show answer

Answer: D. Queue time is a capacity or label-matching problem.
Why shouldn't you attach self-hosted runners to public repositories?
1. Public repos can't use labels
2. Anyone who opens a pull request may get code running on your machines
3. It's not technically possible
4. It doubles costs
Show answer

Answer: B. Keep self-hosted runners on private repositories, or isolate them carefully.
A secret named TOKEN exists at the organization, repository, and environment levels. Which value does a job using that environment get?
1. The environment's
2. An error
3. The repository's
4. The organization's
Show answer

Answer: A. The most specific level wins.
Which repository access options does an organization secret offer?
1. All repositories only
2. None
3. All repositories, private repositories, or selected repositories
4. Public repositories only
Show answer

Answer: C. Selected repositories is the least-privilege option.
How can workflows use secrets stored in a third-party vault such as HashiCorp Vault without storing long-lived credentials in GitHub?
1. Email them to the runner
2. Authenticate to the vault with the job's OIDC token and fetch secrets at runtime
3. Use a public gist
4. Paste them into the workflow
Show answer

Answer: B. OIDC lets the vault trust a short-lived token issued for the job.
Are repository secrets available to workflows triggered by pull requests from forks?
1. Yes, always
2. Only for admins
3. Only on weekends
4. No; secrets aren't passed to them, and GITHUB_TOKEN is read-only
Show answer

Answer: D. This stops untrusted code from exfiltrating secrets.
Which command sets an organization secret that only two repositories can use?
1. gh secret set KEY --all
2. gh secret add KEY org
3. gh secret set KEY --org ORG --repos app1,app2
4. gh variable set KEY --private
Show answer

Answer: C. --org targets the organization; --repos limits which repositories can use it.
What's the GITHUB_TOKEN API rate limit in GitHub Actions?
1. 1,000 requests per hour per repository, or 15,000 for resources in a GitHub Enterprise Cloud account
2. Unlimited
3. 5,000 per job
4. 60 per hour
Show answer

Answer: A. Heavy API automation may need a GitHub App instead.

Monitor and optimize GitHub usage (10–15%)

Questions 86–100.

A repository was deleted yesterday and leadership wants to know who did it. Where's the fastest place to look?
1. GitHub Status
2. The repository's issues
3. The Actions tab
4. The organization or enterprise audit log
Show answer

Answer: D. Filter the audit log by action and repository.
Your compliance team needs audit events kept for longer than 180 days. What should you do?
1. Take screenshots
2. Stream the audit log to an external system such as a SIEM or cloud storage
3. Raise the retention in repository settings
4. Nothing; GitHub keeps them forever
Show answer

Answer: B. Streaming sends events to destinations such as Splunk, Datadog, Azure Event Hubs, or Amazon S3.
An integration keeps getting rate-limited. How can it check its remaining API budget?
1. Read the x-ratelimit-remaining and related response headers, or call the rate limit endpoint
2. Guess
3. Restart the server
4. Check the audit log
Show answer

Answer: A. Well-behaved integrations back off before they hit the limit.
GitHub.com is down for everyone. Who resolves it?
1. Repository owners
2. Your identity provider
3. GitHub; check GitHub Status and contact Support if needed
4. Your enterprise administrators
Show answer

Answer: C. Platform incidents are GitHub's responsibility.
Before opening a GHES support ticket about slow performance, what should you gather?
1. Screenshots of the login page
2. A support bundle, which includes diagnostics and recent logs
3. The organization's README
4. Nothing
Show answer

Answer: B. Bundles let Support investigate without back-and-forth.
How can a GHES administrator find users who haven't been active recently?
1. Guess from commit history
2. Check the billing page only
3. Look at stars
4. Use the dormant users report
Show answer

Answer: D. Suspending or removing dormant users frees licenses.
Which metric best shows whether a newly rolled-out feature, such as Codespaces, is being adopted?
1. The number of stars
2. The number of organization owners
3. Usage data over time, such as active users and usage hours, compared with licenses or seats
4. The repository count
Show answer

Answer: C. Compare actual usage with what you pay for.
Where do you find detailed usage for metered products such as Actions minutes and storage?
1. The enterprise's billing and usage reports, which can be downloaded
2. GitHub Marketplace
3. The audit log
4. A repository's Insights
Show answer

Answer: A. Usage reports break costs down by organization and repository.
Which change reduces GitHub Actions spend without slowing teams down?
1. Run every job on the largest runner
2. Delete all workflows
3. Disable caching
4. Cache dependencies, cancel outdated runs with concurrency, and use paths filters
Show answer

Answer: D. Most waste comes from repeated work and runs nobody needs.
Artifact storage costs keep growing. What helps most?
1. Upload more artifacts
2. Shorten artifact and log retention in settings, and set retention-days on uploads
3. Make the repositories public
4. Increase the retention period
Show answer

Answer: B. Retention can be set at the repository, organization, and enterprise level.
How can you cut wasted Copilot spending in a large organization?
1. Review seat activity and remove seats from inactive users, for example through the Copilot seat management API
2. Disable the audit log
3. Buy more seats
4. Share seats between users
Show answer

Answer: A. GET /orgs/{org}/copilot/billing/seats lists seats and their activity.
Which settings help control Codespaces costs?
1. Unlimited machine types for everyone
2. Larger default machines
3. Spending limits, idle timeouts, and limits on machine types
4. Turning off prebuilds and timeouts entirely
Show answer

Answer: C. Idle codespaces and oversized machines are the usual drivers.
How can an enterprise avoid surprise bills from metered products?
1. Pay annually only
2. Set budgets and spending limits, with alerts, for metered products
3. Disable billing emails
4. It can't
Show answer

Answer: B. Budgets make overspending visible before the invoice arrives.
Package storage keeps growing with old container images. What's the best fix?
1. Stop using packages
2. Buy more storage
3. Make packages public
4. Delete old or unused package versions, ideally automatically
Show answer

Answer: D. Cleanup policies keep storage proportional to what's actually used.
Several organizations have seats assigned to people who left the company months ago. What would have prevented it?
1. More organization owners
2. Stronger passwords
3. SCIM provisioning or regular license reviews, so access is removed when people leave
4. Public repositories
Show answer

Answer: C. Automated deprovisioning keeps license counts honest.

Final tips for exam day

Security and compliance is the biggest domain, at 25–30%. Know policy inheritance, rulesets, audit logging, token policies, and GitHub Apps versus OAuth apps.
Learn the numbers: API rate limits of 60 per hour unauthenticated, 5,000 with a token, and 5,000 to 12,500 for GitHub App installations (15,000 on Enterprise Cloud); GITHUB_TOKEN at 1,000 per hour per repository (15,000 on Enterprise Cloud); 180 days of audit log, but only 7 days of Git events; and a 366-day default maximum lifetime for fine-grained tokens.
Keep the identity trio straight: SAML SSO signs people in, SCIM provisions accounts, and team sync maps groups to teams. Managed-user enterprises use SCIM rather than team sync.
Know who fixes what. Access, settings, and policies are the administrator's job; platform bugs and outages are GitHub Support's, ideally with a support bundle attached.
Remember the networking rules: Azure private networking and static IP addresses come with larger runners, not standard ones.

Official resources

GitHub Administration certification page (Microsoft Learn): scheduling, the free practice assessment, and exam policies.
Exam GH-100 study guide: the official skills list and change log.
GitHub Administration learning path, part 1: free self-paced training, with a part 2 linked from the study guide.
GitHub Enterprise administration documentation: the source of truth for every feature in these questions.

Preparing for more GitHub certifications? See the practice guides for GitHub Foundations (GH-900), GitHub Actions (GH-200), and GitHub Copilot (GH-300).