GH-200 Microsoft GitHub Actions Exam Free Practice Exam Questions (2026 Updated)

Actions stored in private repositories within the organization can be reused across all repositories by referencing them in workflows. This ensures a centralized way of maintaining custom actions.

Encrypted secrets can be accessed across repositories in the same organization, making it easy to store sensitive data (like API keys or tokens) securely while allowing multiple workflows to access them.

Workflow templates allow you to create reusable templates for workflows that can be shared across repositories within the organization. This makes it easier to standardize processes and automate them across multiple projects.

The run keyword is used to execute command-line programs and scripts on a GitHub Actions runner. When several commands must execute within the same workflow step, YAML ' s literal block indicator (|) can be placed after run: and the commands written on separate indented lines. GitHub ' s workflow syntax explicitly demonstrates this pattern with npm ci followed by npm run build. The shell keyword does not contain commands; it specifies which shell should interpret the commands supplied through run. Therefore, options B and C misuse the shell property. Option D also lacks the YAML literal block notation required to represent the multiple command lines as the value of run. Option A correctly executes both commands sequentially within the same shell process and is the documented syntax.

================

Creating a separate repository for each custom action allows you to manage the versioning independently for each action. This approach provides flexibility, as each action can be updated, tested, and versioned separately, avoiding potential conflicts or dependencies between different actions.

GitHub recommends versioning actions with stable references so consumers can deliberately select the code they want to execute. A full commit SHA is the most reliable and secure reference because it identifies one immutable Git commit; GitHub specifically identifies a full SHA as the safest option for stability and security. Tags are also a standard action-release mechanism. Action authors commonly create semantic-version tags such as v1.0.1 and maintain a major-version tag such as v1 so consumers can receive compatible fixes. By contrast, consuming an action directly from its default branch can introduce unexpected changes whenever that branch moves. An organization or repository name identifies where the action lives but does not by itself provide version stability. Therefore, commit SHA and tag are the two appropriate choices.

================

GitHub ' s current documentation states that when an organization uses an IP allow list with GitHub Actions, the appropriate choices are self-hosted runners or GitHub-hosted larger runners configured with static IP address ranges. A self-hosted runner has an address controlled by the organization, so its IP address or range can be explicitly added to the allow list. Larger GitHub-hosted runners can likewise be configured with predictable static IP ranges. Standard GitHub-hosted runners normally use dynamically assigned addresses from large shared ranges, and GitHub specifically recommends against relying on those ranges for this scenario. Marketplace action availability itself is not controlled by adding generic Actions IP ranges as option A suggests. Therefore, the solutions consistent with current GitHub Enterprise Cloud guidance are larger runners with static addresses and self-hosted runners with known addresses.

================

The best design is to use environment-scoped secrets with the same secret name, such as DEPLOY_KEY, in separate environments such as DevCloud and TestCloud. This lets the same reusable deployment logic reference one consistent secret name while the selected environment supplies the correct value. Option A is invalid because GitHub secret names should not be designed around dotted property access, and reusable workflows should not parse secret names dynamically. Option C introduces unnecessary marketplace dependency and weak secret handling. Option D is also wrong because GitHub secrets are opaque strings; ${{ secrets.DEPLOY_KEY.DevCloud }} is not valid secret property access. Reusable workflows can define and receive named secrets through the secrets mapping.

GitHub allows an organization to restrict workflows so that they use only actions and reusable workflows available within that organization. When such a policy is enforced, external third-party actions and Marketplace actions can be prevented from running. Custom actions intended for internal reuse should therefore be stored in repositories owned by the organization. GitHub also allows private or internal repositories containing actions to be made accessible to other repositories in the same organization or enterprise. The .github repository has special organization-wide uses, such as workflow templates, but it is not the mandatory distribution location for all custom actions. A third-party repository or the public Marketplace would conflict with an organization-only policy. Therefore, distributing the actions through organization-owned repositories is the appropriate approach.

================

A composite action is identified by its action metadata file. In action.yml or action.yaml, the runs section must define using: " composite " . This tells GitHub Actions that the action is a composite action made from one or more reusable workflow steps. Option A is incorrect because Dockerfile and package.json files do not identify a composite action; they are usually associated with Docker or JavaScript-based projects. Option C is wrong because repository naming has no technical meaning in action classification. Option D is also wrong because an init.sh file is merely a script and does not define the action type. GitHub’s metadata syntax states that composite actions require runs.using to be set to composite.

The best way for an enterprise to control which GitHub Actions run is by creating a list of approved actions as an enterprise policy. This approach restricts workflows to only use the actions that are explicitly allowed, ensuring security and compliance within the organization.

GitHub Actions uses the special GITHUB_OUTPUT environment file to define output parameters for a workflow step. The required format is name=value, appended to the file. Therefore, writing action_color=purple to $GITHUB_OUTPUT correctly creates an output named action_color. The step should also have an id if another step needs to reference the value through the steps. < id > .outputs context. GITHUB_ENV serves a different purpose: it creates environment variables for subsequent steps in the same job. The add-mask workflow command masks sensitive values in logs, while debug writes diagnostic information. Neither defines an output parameter. GitHub ' s current workflow-command documentation explicitly identifies GITHUB_OUTPUT as the supported environment file for setting step outputs.

================

First, the dataset should be encrypted before being stored. This ensures that the data is protected when stored in a repository.

The encrypted dataset can be stored in a GitHub secret, ensuring it is securely kept and not exposed publicly.

The encryption key needed to decrypt the dataset should also be stored in a GitHub secret to maintain security during the workflow, allowing access only when needed.

GitHub Enterprise Cloud can share actions and reusable workflows stored in an internal repository with workflows in other internal or private repositories. Access can be configured for repositories within the same organization or, where enterprise access is selected, repositories in organizations owned by the enterprise. Public repositories are deliberately excluded from this internal-action sharing model. GitHub explicitly states that actions and reusable workflows stored in internal repositories cannot be used by public repositories. The repository containing the action must also have its Actions Access setting configured appropriately; internal visibility alone does not automatically override that access control. Therefore, internal repositories and private repositories within the permitted organization or enterprise are the valid consumers, while both public-repository choices are incorrect.

================

If a workflow depends on an external service that is down, disabling the workflow temporarily will prevent it from running and sending requests to the service, thus avoiding failed requests or unnecessary retries.

If a workflow is causing a negative impact on external services by generating too many requests or incorrect data due to a bug, temporarily disabling the workflow will stop this behavior while the issue is fixed.

The ::debug:: syntax is used to output debug messages in GitHub Actions workflows. This command will print the message " action successfully debugged " in the debug logs when the workflow runs.

The repository_dispatch event allows you to trigger a workflow in response to external activity. It is commonly used when you need to trigger a workflow from outside GitHub, such as from another system or service, by sending a request to the GitHub API. This event provides flexibility to integrate with various external systems and trigger workflows in a GitHub repository.

The pull_request event supports activity-type filtering, including the labeled activity, so a workflow can respond when a label is added to a pull request. The branches filter limits execution according to the pull request ' s target or base branch, while the paths filter limits execution according to changed files. GitHub also states that when branch and path filters are both configured, both conditions must be satisfied . Therefore, a pull request targeting releases, containing a change beneath apps/**, and receiving a label matches option C. pull_request_review concerns review activity rather than labeling, and pull_request_label is not a GitHub Actions workflow event. Option B also uses filters that do not accurately represent the stated exact branch and folder requirement.

================

A non-zero exit code is used to set the status of an action to " failed " in GitHub Actions. When the action ' s script or code exits with a non-zero status, it indicates failure, and GitHub will mark the action as failed.

The Actions tab on the main page of the repository is where you can find detailed information about the workflow runs, including step failures and build logs. You can review the status of each job and step within the workflow, see the failure messages, and access logs for debugging.

A TypeScript-based GitHub Action is implemented as a JavaScript action because TypeScript is compiled or bundled into JavaScript before execution by the GitHub Actions runner. JavaScript actions use an action.yml metadata file whose runs.using value specifies a supported Node.js runtime and whose runs.main property identifies the generated JavaScript entry point, commonly a file under dist. This approach allows the action to run directly on supported Linux, Windows, and macOS runners without requiring a separate Docker container. A composite action is intended primarily to combine reusable workflow steps, while a Bash script action is not a distinct metadata action type. Docker container actions are appropriate when a packaged container environment is specifically required. Therefore, a custom action authored in TypeScript should be packaged and distributed as a JavaScript action.

================