Microsoft GH-200 GitHub Actions Exam Exam Practice Test

The best approach is to use a service container for Redis. Service containers provide temporary supporting services for a workflow job, such as databases, caches, and message brokers, without permanently changing the runner. This is exactly what is needed when Redis is required only during workflow execution and should not affect future jobs on the self-hosted Linux runner. Option A installs Redis directly during the job and can introduce dependency, cleanup, and configuration risk. Option C requires separate infrastructure, which is unnecessary. Option D is incorrect because installing Redis into the runner image makes the runner stateful and harder to maintain. GitHub Actions workflow syntax supports jobs. < job_id > .services for service containers.

Creating a separate repository for each custom action allows you to manage the versioning independently for each action. This approach provides flexibility, as each action can be updated, tested, and versioned separately, avoiding potential conflicts or dependencies between different actions.

The best design is to use environment-scoped secrets with the same secret name, such as DEPLOY_KEY, in separate environments such as DevCloud and TestCloud. This lets the same reusable deployment logic reference one consistent secret name while the selected environment supplies the correct value. Option A is invalid because GitHub secret names should not be designed around dotted property access, and reusable workflows should not parse secret names dynamically. Option C introduces unnecessary marketplace dependency and weak secret handling. Option D is also wrong because GitHub secrets are opaque strings; ${{ secrets.DEPLOY_KEY.DevCloud }} is not valid secret property access. Reusable workflows can define and receive named secrets through the secrets mapping.

The GITHUB_REF environment variable specifies the branch or tag that triggered the workflow. It contains the full reference to the branch or tag, such as refs/heads/main for a branch or refs/tags/v1.0 for a tag.

GitHub workflow commands use the syntax ::command parameter=value::{message}. For an error annotation without file-location metadata, echo " ::error::There was an error " is valid because error is the workflow command and the text following the second :: is the message. GitHub also supports parameters such as file, line, and col, making option C valid for associating the error annotation with a specific source-code position. Option A incorrectly places the actual text in a message= parameter while leaving no message after the command separator. Option D also uses invalid workflow-command syntax because error=... is not the command format GitHub defines. Therefore, according to the current GitHub Actions workflow-command specification, the two valid commands are B and C.

================

Organization starter workflow templates must be stored in a special workflow template directory so that they appear in the GitHub Actions “New workflow” interface. The correct location is .github/workflow-templates, typically in the organization’s .github repository. Therefore, option C is correct. Option A, .github/workflows, is where active workflow files are stored inside a repository so they can be triggered by events. It is not the correct location for organization-level starter templates. Option B is not a valid GitHub Actions workflow template directory. Option D is incorrect because storing the file in each repository’s root does not publish it as a reusable starter workflow template. This checks workflow template reuse and organization automation standardization.

================

GitHub Enterprise Cloud can share actions and reusable workflows stored in an internal repository with workflows in other internal or private repositories. Access can be configured for repositories within the same organization or, where enterprise access is selected, repositories in organizations owned by the enterprise. Public repositories are deliberately excluded from this internal-action sharing model. GitHub explicitly states that actions and reusable workflows stored in internal repositories cannot be used by public repositories. The repository containing the action must also have its Actions Access setting configured appropriately; internal visibility alone does not automatically override that access control. Therefore, internal repositories and private repositories within the permitted organization or enterprise are the valid consumers, while both public-repository choices are incorrect.

================

The simplest official GitHub Actions action type for running shell commands or shell scripts is a composite action. Composite actions allow an action author to combine one or more run steps and reusable workflow commands in an action.yml file without needing to package a Docker image or write a JavaScript action. Option B is correct because it directly supports shell-based automation. Option A is heavier because Docker container actions require a container image or Dockerfile. Option D is used when the action logic is written in JavaScript and executed with Node.js. Option C is incorrect because “Bash script action” is not an official GitHub Actions action type. This topic checks custom action types and reuse patterns.

GitHub Actions routes jobs to self-hosted runners by using runner labels. Custom labels representing required capabilities, such as the operating-system version and Xcode version, can be created and assigned to the appropriate runner. The workflow then specifies those labels in runs-on. When multiple labels are supplied, GitHub requires an eligible runner to match all specified labels, so runs-on: [self-hosted, macos-10.15, xcode-11.2] targets the intended runner configuration. Runner groups are primarily an access-control and organizational mechanism and are not represented by the ${{ groups.* }} expression shown in option B. The Xcode/macOS versions in this exam scenario are historical, but the runner-label routing principle remains current. GitHub documentation confirms custom labels and cumulative runs-on label matching.

================

A. Use the actions/setup-docker action

B. Authenticate to the GitHub Container Registry.

C. Build the container image.

D. Push the image to the GitHub Container Registry

E. Pull the image from the GitHub Container Registry.

Searching the GitHub Marketplace for verified actions published by the cloud provider is the quickest and safest approach. Many cloud providers offer verified GitHub Actions that are maintained and optimized to interact with their services. These actions typically come with the correct configurations and best practices, allowing you to get started quickly without reinventing the wheel.

GitHub Actions supports organization-level secrets with repository access policies. When the same secret must be centrally managed but made available only to particular repositories, an organization owner can create an organization secret and configure its Repository access policy for selected repositories. This avoids creating and maintaining separate copies of the secret in every repository while still enforcing scope restrictions. Environment secrets are created for environments within individual repositories, so there is no organization-level environment secret matching option B. GitHub repositories also do not provide a general Share secret option like option D. External secret-management systems can be integrated with GitHub Actions, but they are unnecessary for this requirement. Therefore, an organization secret restricted to selected repositories is the direct GitHub-supported solution.

================

The workflow_dispatch event is used to manually trigger a workflow run in GitHub Actions. You can specify this event in the workflow file to allow users to manually trigger the workflow from the GitHub UI, often with optional input parameters.

The correct solution is to create an organization-level Actions secret. This minimizes administrative effort because the secret can be managed once at the organization level and made available to all repositories or selected repositories through an access policy. Option D gives the correct navigation path: organization page, Settings, Secrets and variables, then Actions. Option A would require duplicating the secret in every repository, increasing maintenance overhead and risk of inconsistent values. Option B is wrong because personal developer settings do not centrally expose a secret to all organization repositories. Option C is incomplete because the current GitHub path places Actions secrets under “Secrets and variables,” not just a generic “Security > Secrets” location. GitHub documents organization secrets and the repository access policy model for sharing them.

GitHub officially defines three major custom-action types: JavaScript actions, Docker container actions, and composite actions. There is no separate native Python action type. A Docker container action is appropriate when the implementation is written in Python because the container can package the Python runtime, application code, dependencies, and required operating-system components together. GitHub states that Docker container actions can use any base Docker image and therefore any programming language. This provides a predictable execution environment independent of the software preinstalled on the runner. JavaScript actions specifically execute packaged JavaScript using a supported Node.js runtime. Composite actions primarily combine multiple workflow steps and commands. For a self-contained custom action implemented in Python with its runtime and dependencies packaged alongside it, the Docker container action is the correct choice.

================

GitHub Actions uses the env key to define environment variables. The env mapping can be applied at the workflow, job, or individual step level. In option B, dbserver is defined directly beneath the step-level env key, making it available to that step ' s shell process. Because the example uses shell syntax appropriate to a Linux runner, $dbserver correctly references the environment variable from the run command. The variables and environment keys shown in options A and D are not valid substitutes for step-level env. Option C also uses an invalid list structure; env expects a mapping of variable names to values rather than name and value objects. Therefore, option B uses the supported GitHub Actions workflow syntax.

================

The $GITHUB_OUTPUT file is used to pass data from one step to another in GitHub Actions. The echo command appends the key-value pair to this file, which sets the output variable (MY_OUTPUT) for the current step.

The correct syntax for referencing a versioned action is owner/repository@ref. Therefore, to use version v1 of actions/javascript-action, the workflow step must use actions/javascript-action@v1. The @v1 portion is the ref, which can represent a tag, branch, or commit SHA depending on how the action publisher releases the action. Option A incorrectly treats the version as part of the repository path. Option B invents a separate version: key, which is not how action versions are selected. Option C changes the repository name and does not specify a ref. In GitHub Actions syntax, uses selects an action, and version selection is part of the action reference itself. GitHub examples use the uses: owner/action-name@ref form.

To use a starter workflow provided by your organization, you need to go to the Actions tab in the repository and select New workflow. This option allows you to either create a new workflow or select from a list of available workflow templates, including starter workflows provided by your organization.

The correct GitHub Actions syntax for running a job across multiple Node.js versions is strategy.matrix. The matrix values are referenced at runtime through the matrix context, so node-version: ${{ matrix.node-ver }} is correct. Option A defines the matrix correctly but references it incorrectly through strategy.node-ver; matrix values are not accessed through the strategy context. Option C uses matrix-strategy, which is not a valid GitHub Actions workflow key. Option D reverses the structure by putting strategy under matrix, which is invalid. This question tests matrix strategy syntax, dynamic job configuration, and using matrix values as inputs to actions such as actions/setup-node. GitHub defines jobs. < job_id > .strategy.matrix as the proper matrix mechanism.

The most secure option listed is to use OIDC-based integration to obtain short-lived credentials from an external secrets manager or cloud provider. This avoids storing long-lived sensitive values directly in workflow YAML, repository text, or regular environment variables. Options A, B, and C are insecure because they expose or persist sensitive information in places that can be read, logged, committed, or mismanaged. With OIDC, the workflow requests a token from GitHub’s OIDC provider and exchanges it with the trusted external provider for a short-lived credential. This reduces secret sprawl and supports stronger authorization controls. GitHub documents OIDC as a way to avoid duplicating long-lived cloud credentials as GitHub secrets and to use short-lived access tokens instead.

For a composite action, commands are defined inside the runs.steps section of the action metadata file. When a specific command must execute from a particular folder, the correct key is working-directory, and it must be applied at the individual run step level. Option D is correct because it keeps using: " composite " at the runs level and applies working-directory: ${{ inputs.dir }} directly to the step that runs the script. Option A is incorrect because directory is not a valid GitHub Actions run-step key. Option B incorrectly places directory at the runs level. Option C uses the right keyword but places it at the wrong level. This tests composite action metadata syntax and correct step-level execution configuration.

Creating workflow templates in the organization’s .github repository allows the organization to standardize workflows and make them easily reusable across multiple repositories. This ensures consistency and simplifies maintenance.

Creating reusable actions and workflows that can be called from other workflows helps modularize and standardize automation tasks. These reusable components can be maintained centrally and called from different workflows across repositories.

The key is required because it uniquely identifies the cache. It is used to store and retrieve cached data. When creating or restoring a cache, you need to define a key that will be used to identify the cache.

The path is the file path on the runner that you want to cache. This is where the cached files or dependencies are located and should be specified to tell GitHub where to store or retrieve the cache from.

GitHub-hosted runners automatically handle patching, meaning they will be kept up to date with the latest security updates and software patches for both the runner environment and the underlying operating system.

GitHub-hosted runners support Linux, Windows, and macOS, giving you flexibility to run workflows on different operating systems without needing to manage your own self-hosted runners.

A non-zero exit code is used to set the status of an action to " failed " in GitHub Actions. When the action ' s script or code exits with a non-zero status, it indicates failure, and GitHub will mark the action as failed.

GITHUB_WORKSPACE is a default environment variable in GitHub Actions that points to the directory on the runner where your repository is checked out. This variable allows you to access files within your repository during the workflow.

GitHub automatically creates a GITHUB_TOKEN for workflow jobs so the workflow can authenticate to GitHub without requiring a separately maintained personal access token for many repository-scoped operations. A common use is making authenticated REST API, GraphQL API, or GitHub CLI requests against resources that the token has permission to access. The token ' s capabilities are governed by the workflow ' s permissions configuration and the repository or organization policy. It is not an SSH credential for connecting to a runner, and it is not required merely to read encrypted repository secrets that GitHub makes available through the secrets context. Likewise, simply invoking a public Marketplace action does not inherently require explicitly passing GITHUB_TOKEN. Therefore, making authenticated GitHub API calls is the correct use described by option A.

================

GitHub secrets are defined at different levels: organization, repository, and sometimes at the workflow level. If a secret is defined at both the organization level and the repository level, the repository-level secret will take precedence. So, if the value of the secret differs between these levels, the workflow will use the value from the repository level instead of the organization level.

The check_run event is triggered when a check (such as a code quality check) completes, including when the status of a check changes. By adding this event as a trigger, you can initiate a follow-up workflow when the code quality integration finishes its checks.

GitHub ' s REST API provides a dedicated Download workflow run logs endpoint. The request uses the HTTP GET method and the path /repos/{owner}/{repo}/actions/runs/{run_id}/logs. GitHub responds with a redirect to an archive containing the log files for that workflow run. The endpoint requires the repository owner, repository name, and workflow run ID. For private repositories, the caller must authenticate with appropriate repository or Actions read permissions. A POST request is not used because retrieving logs is a read operation. The artifacts endpoint manages workflow artifacts rather than workflow execution logs. Therefore, option A exactly matches the current GitHub REST API endpoint documented for downloading the log archive associated with a workflow run.

================

If a workflow depends on an external service that is down, disabling the workflow temporarily will prevent it from running and sending requests to the service, thus avoiding failed requests or unnecessary retries.

If a workflow is causing a negative impact on external services by generating too many requests or incorrect data due to a bug, temporarily disabling the workflow will stop this behavior while the issue is fixed.

Self-hosted runners can have default labels and custom labels. These labels are used in the runs-on field to route workflow jobs to runners that match the required criteria. When multiple labels are specified, the runner must match all listed labels before GitHub Actions can assign the job to that runner. Therefore, option A is correct. Option B is false because labels are especially important for self-hosted runners. Option C is incorrect because GitHub does not require the runner IP address as a routing label. Option D is also incorrect because workflows target runners by labels or runner groups, not by hostname. This topic validates runner selection, self-hosted runner configuration, and workflow job routing.

================

Actions can be stored in a separate public repository and referenced in workflows by specifying the repository and action name.

Actions can also be stored in the same repository as the workflow and referenced directly by their path (e.g., ./.github/actions/my-action).

Actions can be packaged as Docker container images and published to Docker Hub. These can then be referenced in workflows by specifying the Docker image.

The correct trigger must use the pull_request event because the workflow is based on activity on a pull request. The specific activity is a label being added, so types: [labeled] is required. The deployment must target the releases branch, so the branch filter must be branches: - ' releases ' . The workflow must also run only when files under the apps folder change, so paths: - ' apps/** ' is the correct recursive path filter. Option A is invalid because pull_request_label is not a GitHub Actions event. Option B uses the wrong event, pull_request_review. Option C uses an incorrect branch/path combination. GitHub workflow syntax supports event activity types, branch filters, and path filters together.

Documentation helps action consumers understand both what an action does and how to invoke it correctly. GitHub specifically recommends creating a README.md when publishing or sharing an action. Recommended content includes a detailed description of the action, required and optional inputs and outputs, secrets and environment variables used by the action, and an example showing how the action is referenced from a workflow. Therefore, documentation directly provides users with the action ' s description and practical usage examples. It does not automatically generate a README in the consuming repository or workflow, and documentation itself does not enable YAML autocomplete. Those capabilities are unrelated to ordinary action documentation. Clear documentation is especially important for reusable actions because consumers must understand expected inputs, outputs, permissions, and version references without inspecting the implementation source code.

================

A job using runs-on: [gpu] depends on an available runner matching that label. If the workflow previously succeeded but now remains waiting, the runner ' s availability, registration, connectivity, or label assignment should be investigated. GitHub stores self-hosted runner application diagnostic logs in the runner installation ' s _diag directory; Runner_ log files provide details about runner startup, connectivity, registration, and update activity, making option A useful. Checking the Set up job information from a previous successful run can also identify which runner previously accepted the job, providing a concrete target for investigation. Rotating GITHUB_TOKEN does not repair runner scheduling because job assignment does not depend on manually rotating that workflow token. GitHub-hosted usage limits are similarly unrelated to a custom gpu runner label. Therefore, A and C are appropriate troubleshooting actions.

================

GITHUB_RUN_NUMBER is one of the default environment variables automatically created by GitHub for every workflow run. It contains a unique sequential number for each run of a particular workflow in a repository. When referenced from a shell command on a Linux runner, the correct environment-variable syntax is $GITHUB_RUN_NUMBER, making option A correct. GitHub also explains that default environment variables are not members of the env context, so ${{ env.GITHUB_RUN_NUMBER }} is not the appropriate workflow expression. The equivalent GitHub context property is ${{ github.run_number }}, but that exact expression is not one of the answer choices. The vars context is intended for configuration variables explicitly created by users or administrators. Therefore, among the supplied choices, $GITHUB_RUN_NUMBER is the documented valid reference.

================

The run keyword is used to execute command-line programs and scripts on a GitHub Actions runner. When several commands must execute within the same workflow step, YAML ' s literal block indicator (|) can be placed after run: and the commands written on separate indented lines. GitHub ' s workflow syntax explicitly demonstrates this pattern with npm ci followed by npm run build. The shell keyword does not contain commands; it specifies which shell should interpret the commands supplied through run. Therefore, options B and C misuse the shell property. Option D also lacks the YAML literal block notation required to represent the multiple command lines as the value of run. Option A correctly executes both commands sequentially within the same shell process and is the documented syntax.

================

When a workflow job targets an environment that has required reviewers, the job enters a waiting state until it is approved or rejected. GitHub Actions does not allow that waiting state to remain indefinitely. If the job is not approved within the allowed period, the workflow fails automatically. The correct duration is 30 days, making option C correct. Options A, B, and D do not match the GitHub Actions environment approval behavior. This is important for deployment governance because required reviewers can block access to protected environments and environment secrets, but pending approvals still have a maximum lifetime. This exam topic aligns with protected environments, deployment approvals, required reviewers, and workflow execution control.

================

Some actions may require a GITHUB_TOKEN as an input to authenticate and perform specific tasks, such as creating issues, commenting on pull requests, or interacting with the GitHub API. In such cases, you would need to explicitly pass the token to the action.

When making an authenticated GitHub API request, the GITHUB_TOKEN is required to authenticate the request. This token is automatically provided by GitHub in the workflow, and it must be explicitly used when interacting with the GitHub API.