GH-900 Microsoft GitHub Foundations Free Practice Exam Questions (2026 Updated)

The primary purpose of creating a security policy in a GitHub repository is to guide users and contributors on how to report security vulnerabilities in a responsible and secure manner. This policy outlines the preferred method of communication, timelines, and any other pertinent information related to handling security issues.

Security Policy:

Option C is correct because a security policy provides guidelines for responsibly disclosing security vulnerabilities. This helps maintainers respond to and address security concerns promptly and securely, thereby protecting the project and its users.

Incorrect Options:

Option A is incorrect because ensuring peer code review is a best practice for code quality, but it is not the primary purpose of a security policy.

Option B is incorrect because push protection for secrets is managed through repository settings, not the security policy.

Option D is incorrect because customizing Dependabot configuration is related to dependency management, not directly to security policies.

GitHub Actions are automated workflows that can be triggered by various events on GitHub. Some common events that trigger workflows include pushes to a repository, creation of issues, and comments on discussion posts.

Triggering GitHub Actions:

Option D (Pushing to a GitHub repository) is correct because this is one of the most common triggers for CI/CD workflows.

Option F (Creating an Issue) is correct because issues are commonly used as triggers for workflows, such as automatically assigning a label or notifying a team.

Option A (Adding a comment to a discussion post) is correct because actions can be triggered by activity on discussion posts, including comments.

Incorrect Options:

Option B (Creating a new repository) is incorrect because this action typically does not trigger workflows within a specific repository.

Option C (Committing a change to a local git repository) is incorrect because GitHub Actions are triggered by events on the GitHub platform, not by local commits.

Option E (Disabling a GitHub runner) is incorrect because it is related to the environment where actions are executed, not a trigger for workflows.

The primary benefits of using GitHub issues templates include:

A. To automatically label or assign newly created issues : Issue templates can be configured to automatically apply labels or assign users when the issue is created, helping to streamline triage and management processes.

B. To provide an easy-to-fill-out form for creating new issues : Templates provide a standardized format for submitting issues, ensuring that all necessary information is captured and reducing the need for follow-up questions.

Coercing existing issues into a standard format or automatically creating new branches when issues are created are not functions provided by GitHub issues templates.

=================

Two recommended ways to improve the discoverability of a repository on GitHub are:

B. Create a README file describing the repository : A well-written README file provides essential information about the project, such as what it does, how to use it, and how to contribute. This is often the first thing potential users or contributors will see, making it critical for discoverability.

D. Add topics to classify the repository : Adding topics to your repository helps classify it under specific categories, making it easier for others to find it through GitHub’s search and exploration features. Topics act like tags, helping to connect your project with users interested in similar subjects.

Registering a repository with GitHub search and adding labels are not applicable actions for improving discoverability in the broader sense.

=================

Pull requests (PRs) on GitHub can have several statuses that indicate their current state in the development and review process:

Draft:

Option A is correct. A pull request can be in a " Draft " status, indicating that it is a work in progress and not yet ready for review.

Closed:

Option B is correct. A pull request can be " Closed " without being merged, which might happen if the proposed changes are not needed or are incorporated differently.

Merged:

Option D is correct. A pull request that has been reviewed and approved can be " Merged " into the target branch, indicating that the changes have been successfully incorporated.

Open:

Option F is correct. An " Open " pull request is one that is active and awaiting review or further action.

Incorrect Options:

Option C (Rebasing) is incorrect because " Rebasing " is not a status; it ' s an operation that can be performed on branches.

Option E (Modified) is incorrect because there is no " Modified " status for pull requests.

The Codespaces lifecycle on GitHub includes several key steps:

Create : This is the step where a new Codespace is initiated.

Rebuild : A Codespace can be rebuilt to ensure that the environment is up-to-date with the latest code or configurations.

Delete : Once a Codespace is no longer needed, it can be deleted to free up resources.

Committing, cloning, or installing are typical Git operations but are not considered part of the specific lifecycle steps for a GitHub Codespace.

=================

GitHub focuses on several key areas that align with its mission to support developers and foster collaboration:

Nurturing a Community That Supports Open Source Principles:

Option A is correct. GitHub is a major advocate for open-source software development, providing tools and platforms that enable open collaboration. GitHub hosts millions of open-source projects and supports a community-driven approach to software development.

Providing Access and Opportunities for Developers:

Option B is correct. GitHub provides a wide range of resources, such as GitHub Education, GitHub Actions, and GitHub Marketplace, to empower developers. These tools and opportunities help developers of all levels to learn, contribute, and improve their skills.

Building a Technology Platform for Secure Code Sharing and Collaboration:

Option D is correct. GitHub’s core function is to provide a platform where developers can securely share code and collaborate. Features like private repositories, branch protections, and GitHub Actions for CI/CD (Continuous Integration/Continuous Deployment) workflows highlight this focus.

Incorrect Options:

Option C is incorrect because GitHub is not a social media platform for project managers; it is a code hosting platform with social features primarily aimed at developers.

Option E is incorrect because GitHub does not focus on hosting video calls. While some integrations might allow for video conferencing, it is not a core focus of GitHub.

The GitHub Marketplace is the place where users can discover, browse, and install various tools and integrations that extend the functionality of GitHub. These tools can include CI/CD services, security checks, and other development utilities that enhance workflow automation and project management.

=================

Cloning a repository in GitHub refers to creating a copy of the repository on your local machine . This allows you to work on the project offline, make changes, and later push those changes back to the remote repository. It does not involve creating a copy on GitHub.com (which would be forking), retrieving updates (which would be pulling), or importing source code into a new repository (which is done differently).

=================

To highlight a post at the top of the Discussions page on GitHub, you can Pin the discussion . Pinning a discussion ensures it remains prominently visible at the top of the list, making it easier for others to find and participate in that discussion. This is particularly useful for important announcements or frequently referenced topics.

=================

Forking a gist is the most efficient way to create a public gist based on another user ' s gist while maintaining the history of the original gist. When you fork a gist, you create a new gist in your own account that retains a link to the original, allowing you to track changes and contribute back if desired.

Forking a Gist:

Option A is correct because forking is a straightforward way to create your own copy of another user ' s gist while preserving the history and making it easy to track updates.

Incorrect Options:

Option B is incorrect because creating a new gist and copying the content would not preserve the history or link back to the original gist.

Option C is incorrect because cloning is typically associated with repositories, not gists, and is more complex than forking for this purpose.

Option D is incorrect because requesting to be added to the existing gist is not a standard GitHub feature.

Secret gists on GitHub are " unlisted " gists, meaning they are not publicly discoverable but can be viewed by anyone who has the URL.

Visibility of Secret Gists:

Option A is correct because secret gists can be viewed by anyone who has the direct URL, making them accessible yet unlisted.

Incorrect Options:

Option B is incorrect because secret gists do not require GitHub Enterprise; they are available on all GitHub accounts.

Option C is incorrect because secret gists do not appear on the gist Discover page.

Option D is incorrect because secret gists do not have an " assigned access " feature; access is determined by sharing the URL.