GitHub Actions (GH-200) · 15% practice allocation

GitHub GH-200: Secure and Optimize Automation Practice Questions

5 free sample questions from the Secure and Optimize Automation domain, with answers and explanations. The full GH-200 bank has 133 questions across 5 domains. Questions are scenario-based and written from the official GitHub exam guide.

An organization owner wants to permit only actions authored by GitHub, verified creators, and a short list of specific third-party actions. Which combination of Actions policy settings achieves this? (Select TWO.)

A. Enable "Allow actions created by GitHub" and "Allow actions by Marketplace verified creators"
B. Disable GitHub Actions entirely for the organization and re-enable it per repository
C. Require that all workflow files be stored in a separate .github repository
D. Set the policy to "Allow enterprise, and select non-enterprise, actions and reusable workflows"✓ Correct
E. Set the default GITHUB_TOKEN permissions to read-only for all repositories
F. Add the specific third-party actions to the allow list using patterns such as owner/repo@*✓ Correct

Explanation

Correct: choosing the "Allow enterprise, and select non-enterprise, actions" policy unlocks the verified-creator/GitHub-authored checkboxes and the allow-list field, and specific third-party actions are then permitted by adding patterns like owner/repo@* (or a pinned SHA) to that list. Option 2 describes the checkboxes but they cannot be enabled without first selecting the restrictive policy, so on its own it is incomplete — the policy selection plus the allow list are the two required configuration actions. Disabling Actions blocks all automation rather than filtering it. Default token permissions control scopes, not which actions may run. Centralizing workflow files does not restrict which actions can be referenced.

You pin every third-party action to a full commit SHA. Which residual risks must you still manage? (Select TWO.)

A. Pinning to a SHA disables the action's ability to read the GITHUB_TOKEN, breaking authenticated actions
B. Pinned actions never receive security patches automatically, so you need a process (for example Dependabot for actions) to review and bump the SHAs✓ Correct
C. Pinning prevents the action from being blocked by an organization allow list, creating a policy bypass
D. A pinned JavaScript or composite action can still fetch and execute external code or mutable container images at run time, so pinning alone does not make it hermetic✓ Correct
E. A pinned SHA can be rewritten by the upstream maintainer, so the code you reviewed may change

Explanation

Correct: pinning freezes code, which also freezes vulnerabilities, so you need automated update proposals and human review; and a pinned action can still download scripts, install packages or pull a :latest image at run time, so transitive supply-chain risk remains. Pinning has no effect on token access. Git commit SHAs are content-addressed and cannot be repointed to different content, which is exactly why pinning works. Allow lists are evaluated against the action reference and still apply to SHA-pinned actions.

A matrix build of 30 jobs frequently has one job fail immediately due to a flaky external service, and you are paying for the remaining jobs that continue to run and then get discarded. Additionally, some jobs occasionally hang for hours. Which two settings address these cost problems most directly? (Select TWO.)

A. Set max-parallel: 1 to reduce concurrent billing
B. Increase the runner size to a larger machine so jobs finish faster
C. Set timeout-minutes on the job to a realistic upper bound so hung jobs are cancelled instead of running to the 6-hour limit✓ Correct
D. Add a concurrency group with cancel-in-progress: true so superseded runs on the same ref are cancelled✓ Correct
E. Set strategy.fail-fast: false so failing jobs do not stop the matrix

Explanation

Correct: timeout-minutes caps billable time for hung jobs (default is 360 minutes), and a concurrency group with cancel-in-progress stops superseded runs for the same branch, eliminating wasted minutes on obsolete commits. fail-fast: false increases spend by letting all jobs continue after a failure — the opposite of the goal (fail-fast defaults to true). max-parallel: 1 lengthens wall-clock time without reducing total billed minutes, since billing is per job-minute. Larger runners are billed at a higher per-minute multiplier and do not fix hangs or wasted runs.

A workflow needs to read repository contents and write comments on pull requests, but nothing else. Which job-level configuration follows the principle of least privilege for GITHUB_TOKEN?

A. Omit the permissions key so the repository default applies
B. permissions: contents: read pull-requests: write✓ Correct
C. permissions: write-all
D. permissions: contents: write pull-requests: write actions: write

Explanation

Correct: declaring only contents: read and pull-requests: write grants exactly the scopes the job needs; all other scopes are set to none when any permissions block is specified. write-all grants every scope, the opposite of least privilege. Adding contents: write and actions: write grants unnecessary write access that an injected script could abuse. Omitting permissions inherits the repository/organization default, which may be the permissive read/write-all setting and is not an explicit least-privilege declaration.

A team is evaluating Marketplace actions. Which factors most strongly indicate that an action is trustworthy? (Select THREE.)

A. The action's README states that it requires the workflow to grant write-all permissions
B. The action has a high star count and many downloads
C. You can review the action's source at a specific commit and pin your workflow to that SHA✓ Correct
D. The action's source repository is actively maintained with recent commits, released tags and responsive issue handling✓ Correct
E. The action is distributed only as a prebuilt Docker image from an unauthenticated registry
F. The publisher displays the Marketplace "verified creator" badge✓ Correct

Explanation

Correct: the verified-creator badge means GitHub has verified the publishing organization's domain; active maintenance signals that vulnerabilities get fixed; and being able to audit the source and pin a reviewed commit SHA means you control exactly what executes. Popularity metrics are social proof, not security evidence — popular actions have been compromised. An action demanding write-all is a red flag, not a trust signal. An opaque image pulled from an unauthenticated registry cannot be audited and can be replaced without notice.

Test yourself across every GH-200 domain

The free GH-200 practice test mixes about 20 questions weighted like the exam. The full 133-question bank adds instant grading, flashcards and a timed mock exam.

Take the free GH-200 practice test Practice the full bank

Study this domain

Secure and Optimize Automation study guide (GH-200) →

Other GH-200 domains

← All GitHub Actions study resources