Project Management and GitHub Administration: free practice questions

The organization's Audit Log is the correct location. The `org.update_member` event is recorded whenever an organization member's role is changed (e.g., from member to owner or vice versa), and the log can be filtered by event type, actor, and date range. The repository Insights tab shows contribution statistics like commits and pull requests, not organization-level membership changes. A user's personal Security log records actions on their own account (e.g., logins, SSH key additions) rather than organization-level administrative events. The Billing section tracks spending and payment information, not membership role changes.

Using the GitHub Audit Log API with filters for invitation-related events is the most appropriate approach. The audit log captures `org.invite_member` and `org.accept_invitation` events, is queryable via the API, supports time-range filtering (including 90-day windows), and can be exported programmatically — satisfying all requirements for automation and compliance reporting. — Manually downloading a member list and cross-referencing a spreadsheet is not scriptable or automatable, and does not reflect historical invitation states — only the current member roster. — GitHub Insights provides contribution metrics (commits, PRs, code frequency) for members and does not record invitation status, acceptance events, or onboarding history. — The `/orgs/{org}/members` endpoint with `filter=2fa_disabled` returns current members who have 2FA disabled — it is unrelated to invitation status and does not provide historical acceptance data.

Viewing recent deliveries and using the Redeliver button is the best approach. GitHub's webhook settings page shows a log of recent delivery attempts, including the full request payload, response headers, and response body. The Redeliver button allows the developer to resend a specific payload without needing to trigger a new push event — ideal for debugging. — Deleting and recreating the webhook would lose the delivery history and does not help debug the existing failures; it also does not replay missed events. — The audit log records security and administrative events, not webhook payload details or CI server responses; it cannot be used to retry webhook deliveries. — GitHub does NOT automatically replay missed webhook deliveries when a webhook is re-enabled. Any deliveries that failed while the webhook was disabled are lost unless manually redelivered.

When SCIM is configured, the identity provider manages the user lifecycle end-to-end. When the employee's account is deprovisioned in the IdP, SCIM sends a deprovision request to GitHub, which unlinks the SAML external identity and removes the user from the organization automatically — without requiring manual Owner intervention. The employee's GitHub.com personal account itself is NOT deleted; SCIM only manages organization membership, not the underlying GitHub account. Retaining full access until manual removal describes the behavior when SCIM is NOT configured; with SCIM, the process is automated. Selective loss of private repository access is not how SAML/SCIM deprovisioning works — membership in the organization is revoked entirely.

GitHub Apps are specifically designed for this scenario. They can be installed organization-wide (covering all repositories at once), act under their own bot identity independent of any individual user, use fine-grained permission scopes, and authenticate via short-lived JWTs and installation tokens — making them ideal for automated, server-side integrations. OAuth Apps act on behalf of a specific authenticated user, meaning their actions are attributed to that user and tied to user session tokens; they are not suitable for autonomous, identity-independent automation. A personal access token is tied to an individual user account, creating a dependency on that user's account status and violating least-privilege principles. Deploy keys provide Git push/pull access to a single repository only and cannot perform API actions like posting comments or managing labels.