GH-200 sample exam questions

15 exam-style questions for Microsoft GH-200: GitHub Actions, with answers and explanations. Take them as a timed practice exam first if you want a score out of 1000.

Take the free practice exam GH-200 exam guide

Question 1Single choiceTopic 1

As a developer, you are designing a workflow and need to communicate with the runner machine to set environment variables, output values used by other actions, add debug messages to the output logs, and other tasks. Which of the following options should you use?
1. A
  composite run step
2. B
  enable debug logging
3. C
  self-hosted runners
4. D
  environment variables
5. E
  workflow commands
Show answer

Correct answer: E

Why
Workflow commands (echo "::command::" or writing to GITHUB_ENV / GITHUB_OUTPUT files) are how a step talks to the runner to set env vars, outputs, debug messages, masks and annotations. Debug logging, self-hosted runners and plain environment variables do not provide this channel.
Question 2Multiple responseTopic 1

In which locations can actions be referenced by workflows? (Each correct answer presents a complete solution. Choose three.)
1. A
  an .action extension file in the repository
2. B
  a published Docker container image on Docker Hub
3. C
  a public NPM registry
4. D
  the runs-on: keyword of a workflow file
5. E
  the repository’s Secrets settings page
6. F
  a separate public repository
7. G
  the same repository as the workflow
Show answer

Correct answer: B, F, G

Why
The uses: keyword can reference an action in the same repository (./path), in a separate public repository (owner/repo@ref), or a published Docker image (docker://image:tag). Actions are not pulled from NPM, the Secrets page, runs-on, or an .action file.
Question 3Single choiceTopic 1

Your organization is managing secrets using GitHub encrypted secrets, including a secret named SuperSecret. As a developer, you need to create a version of that secret that contains a different value for use in a workflow that is scoped to a specific repository named MyRepo. How should you store the secret to access your specific version within your workflow?
1. A
  Create MyRepo_SuperSecret in GitHub encrypted secrets to specify the scope to MyRepo.
2. B
  Create a duplicate entry for SuperSecret in the encrypted secret store and specify MyRepo as the scope.
3. C
  Create a file with the SuperSecret information in the .github/secrets folder in MyRepo.
4. D
  Create and access SuperSecret from the secrets store in MyRepo.
Show answer

Correct answer: D

Why
Create a repository-level secret named SuperSecret in MyRepo; when names collide, repository secrets take precedence over organization secrets, so secrets.SuperSecret returns the repository value. Renaming, duplicating org scope, or committing a secrets file are wrong or insecure.
Question 4Multiple responseTopic 1

As a developer, one of your workflows will require XCode version 11.2 hosted on macOS Catalina (i.e., v10.15). You’ve already created and configured a self-hosted runner to conform to those requirements and registered it with your organization. What else should you do to ensure that the workflow accesses the correct runner instance? (Each answer presents a complete solution. Choose three.)
1. A
  Add your runner to the appropriate runner groups.
2. B
  In the workflow, specify:
  runs-on: [ ${{groups.macos-10.15}}, ${{groups.xcode-11.2}} ].
3. C
  Create custom runner labels for macos-10.15 and xcode-11.2.
4. D
  Create runner groups named macos-10.15 and xcode-11.2.
5. E
  In the workflow, specify:
  runs-on: [self-hosted, macos-10.15, xcode-11.2].
6. F
  Assign the custom labels to the self-hosted runner.
Show answer

Correct answer: C, E, F

Why
Create custom labels for macos-10.15 and xcode-11.2, assign them to the self-hosted runner, and target them with runs-on: [self-hosted, macos-10.15, xcode-11.2]. Runner groups control access, not selection by capability, and there is no groups context for runs-on.
Question 5Single choiceTopic 2

While awaiting approval, how many days can a workflow be in the “Waiting” state before it automatically fails?
1. A
  30 days
2. B
  60 days
3. C
  14 days
4. D
  7 days
Show answer

Correct answer: A

Why
A job waiting on environment protection rules (required reviewers) fails automatically if it is not approved within 30 days.
Question 6Single choiceTopic 2

As a developer, how should you enable step debug logging for a workflow?
1. A
  Include the following code block in your workflow:
  env:
  ACTIONS_STEP_DEBUG: true
2. B
  Use the --actions-step-debug flag when calling the workflow.
3. C
  Include the following code block in your workflow:
  defaults:
  ACTIONS_STEP_DEBUG: true
4. D
  Set the ACTIONS_STEP_DEBUG secret or variable at the repository level to true.
Show answer

Correct answer: D

Why
Step debug logging is enabled by setting a repository secret or variable named ACTIONS_STEP_DEBUG to true (or by re-running a job with debug logging enabled). Setting it in env or defaults inside the workflow has no effect, and there is no --actions-step-debug flag.
Question 7Single choiceTopic 2

As a DevOps engineer, you need to execute a deployment to different environments like development and testing based on the labels added to a pull request. The deployment should use the releases branch and trigger only when there is a change in the files under ‘apps’ folder. Which code block should be used to define the deployment workflow trigger?
1. A
  on:
  pull_request_label:
  branches:
  - 'releases'
  paths:
  - 'apps/**'
2. B
  on:
  pull_request:
  types: [labeled]
  branches:
  - 'releases/**'
  paths:
  - 'apps'
3. C
  on:
  pull_request:
  types: [labeled]
  branches:
  - 'releases'
  paths:
  - 'apps/**'
4. D
  on:
  pull_request_review:
  types: [labeled]
  branches:
  - 'releases'
  paths:
  - 'apps/**'
Show answer

Correct answer: C

Why
Use the pull_request event with types: [labeled], a branches filter of 'releases' (the PR base branch) and paths: 'apps/**' to match files under the apps folder. pull_request_label does not exist, pull_request_review has no labeled type, and 'apps' alone matches only a file named apps, not its contents.
Question 8Multiple responseTopic 2

What are the two ways to pass data between jobs? (Each correct answer presents part of the solution. Choose two.)
1. A
  Use data storage.
2. B
  Use the copy action with cache parameter to cache the data.
3. C
  Use the copy action with restore parameter to restore the data from the cache.
4. D
  Use artifact storage.
5. E
  Use job outputs.
6. F
  Use the copy action to save the data that should be passed in the artifacts folder.
Show answer

Correct answer: D, E

Why
Data moves between jobs through job outputs (jobs.<id>.outputs read via needs.<id>.outputs) for small values and through artifacts (actions/upload-artifact and download-artifact) for files. There is no copy action or generic data storage feature for this.
Question 9Single choiceTopic 3

What is the simplest action type to run a shell script?
1. A
  Bash script action
2. B
  Composite action
3. C
  JavaScript action
4. D
  Docker container action
Show answer

Correct answer: B

Why
A composite action (runs: using: composite) can run shell commands via run steps with a required shell, with no JavaScript code or container to build. JavaScript actions need Node code, Docker actions need an image, and there is no Bash script action type.
Question 10Multiple responseTopic 3

Which workflow commands send information from the runner? (Each correct answer presents a complete solution. Choose two.)
1. A
  reading from environment variables
2. B
  setting a debug message
3. C
  populating variables in a Dockerfile
4. D
  setting output parameters
Show answer

Correct answer: B, D

Why
Workflow commands let the runner process output from a step, such as ::debug:: messages and output parameters written to GITHUB_OUTPUT. Reading environment variables is not a workflow command, and populating Dockerfile variables is unrelated.
Question 11Single choiceTopic 3

As a developer, you created a JavaScript action. What is the best way to test your JavaScript action?
1. A
  Create a workflow that only executes your specific JavaScript action.
2. B
  Package your JavaScript action inside a docker container image and run it.
3. C
  Use a tool called @vercel/ncc to compile your code.
4. D
  Create a workflow that includes the actions/debug-javascript action.
Show answer

Correct answer: A

Why
Test a JavaScript action by creating a workflow that uses it (for example uses: ./ in the action's repository) and checking the run results. ncc only bundles code for distribution, Docker packaging changes the action type, and actions/debug-javascript does not exist.
Question 12Multiple responseTopic 3

While writing a custom action, some behavior within the runner must be changed. Which workflow commands would set an error message in the runner’s output? (Each correct answer presents a complete solution. Choose two.)
1. A
  echo "::error file=main.py,line=10,col=15::There was an error"
2. B
  echo "::error=There was an error::"
3. C
  echo "::error::There was an error"
4. D
  echo "::error message=There was an error::"
Show answer

Correct answer: A, C

Why
The error workflow command is ::error::message, optionally with parameters such as file, line and col before the second double colon. ::error=...:: and ::error message=...:: put the message in the wrong place and are not valid syntax.
Question 13Single choiceTopic 4

What is a valid scenario regarding environment secrets?
1. A
  configuring environment secrets for connecting to GitHub Enterprise Server
2. B
  configuring environment secrets to automatically pull from Azure Key Vault
3. C
  ensuring a job cannot access environment secrets until approval is obtained from a required reviewer
4. D
  ensuring only a specific step can access an environment secret
Show answer

Correct answer: C

Why
Environment secrets are only available to jobs that reference the environment, and if it has required reviewers the job cannot access them until approved. Secrets cannot be scoped to a single step, do not auto-sync from Azure Key Vault, and are unrelated to connecting to GHES.
Question 14Multiple responseTopic 4

GitHub-hosted runners support which capabilities? (Each correct answer presents a complete solution. Choose two.)
1. A
  support for Linux, Windows, and macOS
2. B
  support for a variety of Linux variations including CentOS, Fedora, and Debian
3. C
  requiring a payment mechanism (e.g., credit card) to use for private repositories
4. D
  automatic file-system caching between workflow runs
5. E
  automatic patching of both the runner and the underlying OS
Show answer

Correct answer: A, E

Why
GitHub-hosted runners offer Ubuntu Linux, Windows and macOS images, and GitHub maintains and patches the images and runner software. CentOS or Fedora images are not offered, private repos get free included minutes without a card, and caching requires the cache action.
Question 15Multiple responseTopic 4

You need to pass values from a runner to other parts of a GitHub Actions workflow.

Which two actions should you perform? Each correct answer presents a complete solution.

NOTE: Each correct selection is worth one point.
1. A
  Set a debug message.
2. B
  Read from the environment variables.
3. C
  Configure the output parameters.
4. D
  Create environment variables by writing to the GITHUB_ENV file.
Show answer

Correct answer: C, D

Why
Values are passed from a step on the runner to other parts of the workflow by writing output parameters to GITHUB_OUTPUT and environment variables to GITHUB_ENV. Debug messages only write logs, and reading environment variables does not send data anywhere.