GitHub Foundations (GH-900) · 13% practice allocation

GitHub GH-900: Apply Modern Development Practices Practice Questions

5 free sample questions from the Apply Modern Development Practices domain, with answers and explanations. The full GH-900 bank has 150 questions across 7 domains. Questions are scenario-based and written from the official GitHub exam guide.

A security engineer wants Dependabot to automatically open pull requests whenever a direct npm dependency in the repository has a new patch or minor version available. They also want checks to run weekly rather than daily. Which file should they create, and where?

A. A file named dependabot.json in the repository root
B. A file named .github/workflows/dependabot.yml in the repository
C. A file named .github/dependabot.yml in the repository✓ Correct
D. A file named security-policy.yml in the .github directory

Explanation

Dependabot version updates are configured in '.github/dependabot.yml'. This file specifies the package ecosystem (e.g., npm), directory, and update schedule (e.g., weekly). 'dependabot.json' in the root is not a valid filename or location for Dependabot configuration. '.github/workflows/dependabot.yml' would be interpreted as a GitHub Actions workflow file, not a Dependabot configuration. 'security-policy.yml' is not a recognized configuration file for Dependabot; security policies are conventionally stored as SECURITY.md.

A developer wants to automatically run a test suite every time code is pushed to any branch in a repository. Which workflow trigger should they use?

A. pull_request
B. workflow_dispatch
C. push✓ Correct
D. repository_dispatch

Explanation

'push' is the correct trigger because it fires whenever commits are pushed to any branch (or specific branches if filtered). 'workflow_dispatch' only fires when a user manually triggers the workflow from the UI or API. 'pull_request' only fires on pull request events (opened, synchronized, closed, etc.), not on direct pushes to branches. 'repository_dispatch' fires only when an external system sends a custom HTTP POST event to the GitHub API — it is not tied to code pushes.

A developer is writing a GitHub Actions workflow and wants to trigger it on a schedule — every day at midnight UTC. Which trigger syntax is correct?

A. on: timer: '0 0 * * *'
B. on: cron: '0 0 * * *'
C. on: schedule: - cron: '0 0 * * *'✓ Correct
D. on: schedule: - interval: 'daily'

Explanation

The correct syntax uses 'on: schedule:' with a list item containing 'cron:' followed by the standard cron expression. '0 0 * * *' means midnight UTC every day. 'on: timer:' is not a valid GitHub Actions trigger key. 'on: cron:' omits the required 'schedule' wrapper. 'on: schedule: - interval: daily' is not valid YAML syntax for GitHub Actions — GitHub does not support a plain 'interval' keyword; it requires a cron expression.

Which of the following statements correctly describes the relationship between workflows, jobs, and steps in GitHub Actions?

A. A workflow contains one or more jobs; each job contains one or more steps.✓ Correct
B. A step contains one or more jobs; each job contains one or more workflows.
C. A workflow contains one or more steps; each step contains one or more jobs.
D. A job contains one or more workflows; each workflow contains one or more steps.

Explanation

In GitHub Actions, the hierarchy is: Workflow → Jobs → Steps. A workflow is defined in a YAML file and contains one or more jobs. Each job runs on a runner and consists of one or more steps, which are individual tasks (shell commands or actions). The other options invert or scramble this hierarchy, which are common misconceptions among new users.

A team has a workflow that builds a Docker image and pushes it to the GitHub Container Registry (ghcr.io). After the push, they want a subsequent job in the same workflow to pull that image and run integration tests. What is the correct ghcr.io image reference format they should use?

A. packages.github.com/OWNER/IMAGE_NAME:TAG
B. docker.pkg.github.com/OWNER/REPOSITORY/IMAGE_NAME:TAG
C. ghcr.io/OWNER/IMAGE_NAME:TAG✓ Correct
D. registry.github.com/OWNER/IMAGE_NAME:TAG

Explanation

'ghcr.io/OWNER/IMAGE_NAME:TAG' is the correct format for the GitHub Container Registry. 'docker.pkg.github.com' was the legacy GitHub Packages Docker registry that has been superseded by ghcr.io and is no longer recommended for new projects. 'registry.github.com' and 'packages.github.com' are not valid GitHub registry hostnames — they are common distractors that sound plausible.

Test yourself across every GH-900 domain

The free GH-900 practice test mixes about 20 questions weighted like the exam. The full 150-question bank adds instant grading, flashcards and a timed mock exam.

Take the free GH-900 practice test Practice the full bank

Study this domain

Apply Modern Development Practices study guide (GH-900) →

Other GH-900 domains

← All GitHub Foundations study resources