Microsoft GitHub Actions (GH-200) Exam Questions

Microsoft GitHub Actions Exam Exam Objectives

1. 1

   1.0 Author and manage workflows (20-25%)

   • 1.1Configure workflow triggers and events
   • 1.2Configure workflows to run for scheduled, manual, webhook, and repository events
   • 1.3Choose appropriate scope, permissions, and events for workflow automation
   • 1.4Define and validate workflow_dispatch inputs (types, required, defaults) and pass inputs to reusable workflows via workflow_call with inputs and secrets mapping
   • 1.5Design and implement workflow structure
   • 1.6Use jobs, steps, and conditional logic
   • 1.7Implement dependencies between jobs
   • 1.8Use workflow commands and environment variables
   • 1.9Use service containers (services:) for dependent services (databases, queues); configure ports, health checks, and container options
   • 1.10Use strategy and matrix to generate job variations (OS, language/runtime versions); apply include/exclude; control fail-fast and max-parallel; optimize matrix size for cost and performance; account for runner image changes (Ubuntu
   • 1.112
   • 1.12deprecation, Windows Server 2025 migration for windows-latest)
   • 1.13Implement YAML anchors and aliases (&, * and merge <<) to reuse repeated mappings/steps within a single workflow file
   • 1.14Use predefined contexts (github, runner, env, vars, secrets, inputs, matrix, needs, strategy, job, steps, github.event, github.ref) to access workflow, repository, and runtime metadata; understand immutable actions behavior and version pinning requirements
   • 1.15Evaluate expressions with ${{ }} referencing contexts; distinguish static (workflow parse) vs runtime evaluation; prevent secret leakage in logs and expressions
   • 1.16Leverage editor tooling (GitHub Actions VS Code extension / YAML schema completion, metadata IntelliSense, validation) to author and maintain workflows efficiently
   • 1.17Manage workflow execution and outputs
   • 1.18Configure caching and artifact management; apply retention policies via REST APIs (logs, artifacts, workflow runs) at org/repo level
   • 1.19Pass data between jobs and steps (artifacts, outputs, environment files via GITHUB_ENV and GITHUB_OUTPUT, reusable workflow outputs)
   • 1.20Generate job summaries using GITHUB_STEP_SUMMARY for rich Markdown reports (test results, coverage, links)
   • 1.21Add workflow status badges and environment protections
2. 2

   2.0 Consume and troubleshoot workflows (15-20%)

   • 2.1Interpret workflow behavior and results
   • 2.2Identify workflow triggers and effects from configuration and logs
   • 2.3Diagnose failed workflow runs using logs and run history
   • 2.4Expand and interpret YAML anchors, aliases, and merged mappings when analyzing workflow configuration
   • 2.5Interpret matrix expansions, correlate job names to matrix axes, analyze failures across variants, and selectively rerun individual matrix jobs
   • 2.6Access workflow artifacts and logs
   • 2.7Locate workflows, logs, and artifacts in the UI and via API
   • 2.8Download and manage workflow artifacts
   • 2.9Use and manage workflow templates
   • 2.10Consume organization-level and reusable workflows
   • 2.11Consume non-public organization workflow templates
   • 2.12Use starter workflows (public and private/non-public templates); customize and adapt; distinguish from reusable workflows and composite actions
   • 2.13Differentiate starter workflows (copy scaffold, independent after creation) vs reusable workflows (central versioned definition invoked via workflow_call) vs composite actions (encapsulated step logic)
   • 2.14Contrast disabling and deleting workflows
3. 3

   3.0 Author and maintain actions (15-20%)

   • 3.1Create and troubleshoot custom actions
   • 3.2Identify and implement action types (JavaScript, Docker, composite); understand immutable actions rollout on hosted runners and implications for version pinning and registry sources
   • 3.3Troubleshoot action execution and errors
   • 3.4Define action structure and metadata
   • 3.5Specify required files, directory structure, and metadata
   • 3.6Implement workflow commands within actions
   • 3.7Distribute and maintain actions
   • 3.8Select distribution models (public, private, marketplace)
   • 3.9Publish actions to the GitHub Marketplace
   • 3.10Apply versioning and release strategies
4. 4

   4.0 Manage GitHub Actions for the enterprise (20-25%)

   • 4.1Distribute and govern actions and workflows
   • 4.2Define and manage reusable components and templates
   • 4.3Control access to actions and workflows within the enterprise
   • 4.4Configure organizational use policies
   • 4.5Manage runners at scale
   • 4.6Configure and monitor GitHub-hosted and self-hosted runners
   • 4.7Apply IP allow lists and networking settings
   • 4.8Manage runner groups and troubleshoot runner issues
   • 4.9Identify preinstalled software/tool versions on GitHub-hosted runners (image release notes, toolcache) and install additional software at runtime (setup-* actions, package managers, caching, container images, custom self-hosted images)
   • 4.10Manage encrypted secrets and variables
   • 4.11Define and scope encrypted secrets and variables at the organization, repository, and environment levels
   • 4.12Access and use secrets and variables in workflows and actions; manage secrets and variables programmatically via REST APIs
5. 5

   5.0 Secure and optimize automation (10-15%)

   • 5.1Implement security best practices
   • 5.2Use environment protections and approval gates
   • 5.3Identify and use trustworthy actions from the Marketplace
   • 5.4Mitigate script injection (sanitize/validate inputs, least-privilege permissions, avoid untrusted data in run:, proper shell quoting, prefer vetted actions over inline scripts)
   • 5.5Understand GITHUB_TOKEN lifecycle (ephemeral, scoped), configure granular permissions, contrast with PAT; restrict write scopes
   • 5.6Use OIDC token (id-token permission) for cloud provider federation to eliminate long-lived cloud secrets
   • 5.7Pin third-party actions to full commit SHAs; align with immutable actions enforcement on hosted runners; avoid floating @main/@v* without justification
   • 5.8Enforce action usage policies (organization/repository allow/deny lists, required reviewers for unverified actions)
   • 5.9Generate and verify artifact attestations / provenance (e.g., SLSA, build metadata) and integrate into deployment verification
   • 5.10Optimize workflow performance and cost
   • 5.11Configure caching and artifact retention for efficiency; apply retention policies programmatically via REST APIs
   • 5.12Recommend strategies for scaling and optimizing workflows