Free Practice Questions for the Microsoft GitHub Administrator GH-200 Exam (2026 Updated)

The GitHub context exposes the short name of the branch or tag through github.ref_name. For a workflow triggered from a branch named feature-branch, the expression github.ref_name == ' feature-branch ' evaluates to true, allowing the job to run. GitHub also provides github.ref, but that value normally contains the complete Git reference, such as refs/heads/feature-branch, rather than only the short branch name. The properties github.branch_name, github.ref.name, and github.branch.name shown in the other options are not valid GitHub context properties. GitHub evaluates a job-level if expression before sending the job to a runner, making this an appropriate mechanism for conditional deployment execution. Therefore, option B uses the correct context property and comparison syntax.

================

GitHub Actions uses the special GITHUB_OUTPUT environment file to define output parameters for a workflow step. The required format is name=value, appended to the file. Therefore, writing action_color=purple to $GITHUB_OUTPUT correctly creates an output named action_color. The step should also have an id if another step needs to reference the value through the steps. < id > .outputs context. GITHUB_ENV serves a different purpose: it creates environment variables for subsequent steps in the same job. The add-mask workflow command masks sensitive values in logs, while debug writes diagnostic information. Neither defines an output parameter. GitHub ' s current workflow-command documentation explicitly identifies GITHUB_OUTPUT as the supported environment file for setting step outputs.

================

Creating workflow templates in the organization’s .github repository allows the organization to standardize workflows and make them easily reusable across multiple repositories. This ensures consistency and simplifies maintenance.

Creating reusable actions and workflows that can be called from other workflows helps modularize and standardize automation tasks. These reusable components can be maintained centrally and called from different workflows across repositories.

A TypeScript-based GitHub Action is implemented as a JavaScript action because TypeScript is compiled or bundled into JavaScript before execution by the GitHub Actions runner. JavaScript actions use an action.yml metadata file whose runs.using value specifies a supported Node.js runtime and whose runs.main property identifies the generated JavaScript entry point, commonly a file under dist. This approach allows the action to run directly on supported Linux, Windows, and macOS runners without requiring a separate Docker container. A composite action is intended primarily to combine reusable workflow steps, while a Bash script action is not a distinct metadata action type. Docker container actions are appropriate when a packaged container environment is specifically required. Therefore, a custom action authored in TypeScript should be packaged and distributed as a JavaScript action.

================

A. Use the actions/setup-docker action

B. Authenticate to the GitHub Container Registry.

C. Build the container image.

D. Push the image to the GitHub Container Registry

E. Pull the image from the GitHub Container Registry.

The best approach is to use a service container for Redis. Service containers provide temporary supporting services for a workflow job, such as databases, caches, and message brokers, without permanently changing the runner. This is exactly what is needed when Redis is required only during workflow execution and should not affect future jobs on the self-hosted Linux runner. Option A installs Redis directly during the job and can introduce dependency, cleanup, and configuration risk. Option C requires separate infrastructure, which is unnecessary. Option D is incorrect because installing Redis into the runner image makes the runner stateful and harder to maintain. GitHub Actions workflow syntax supports jobs. < job_id > .services for service containers.

Dockerfile: The Dockerfile is required for Docker container actions. It defines the environment for the action, specifying the base image, dependencies, and any commands to set up the action’s runtime inside the container.

action.yml: The action.yml file is required for all GitHub Actions, including Docker container actions. It contains metadata about the action, including the inputs, outputs, and the runtime environment (which in this case is Docker, defined under runs.using).

The ::debug:: syntax is used to output debug messages in GitHub Actions workflows. This command will print the message " action successfully debugged " in the debug logs when the workflow runs.

GitHub Actions routes jobs to self-hosted runners by using runner labels. Custom labels representing required capabilities, such as the operating-system version and Xcode version, can be created and assigned to the appropriate runner. The workflow then specifies those labels in runs-on. When multiple labels are supplied, GitHub requires an eligible runner to match all specified labels, so runs-on: [self-hosted, macos-10.15, xcode-11.2] targets the intended runner configuration. Runner groups are primarily an access-control and organizational mechanism and are not represented by the ${{ groups.* }} expression shown in option B. The Xcode/macOS versions in this exam scenario are historical, but the runner-label routing principle remains current. GitHub documentation confirms custom labels and cumulative runs-on label matching.

================

Scheduled GitHub Actions workflows use the schedule event beneath the workflow ' s on key. Each schedule is represented by a cron entry, which makes option A the valid structure. GitHub scheduled workflows use POSIX-style five-field cron syntax, and scheduled execution is interpreted in UTC by default. In the expression 45 7 * * 3,6, 45 represents minute 45, 7 represents 07:00 UTC, the two asterisks allow every day of the month and every month, and 3,6 specifies Wednesday and Saturday. Consequently, the workflow is scheduled for 07:45 UTC on both requested weekdays. Options B and D incorrectly place cron directly beneath on, while option C does not use the required schedule list containing a cron entry.

================

The key is required because it uniquely identifies the cache. It is used to store and retrieve cached data. When creating or restoring a cache, you need to define a key that will be used to identify the cache.

The path is the file path on the runner that you want to cache. This is where the cached files or dependencies are located and should be specified to tell GitHub where to store or retrieve the cache from.

Deleting artifacts from repositories manually will free up storage space. Artifacts are typically stored for a limited time by default, but manual cleanup can help manage space.

Configuring the artifact and log retention period allows you to control how long artifacts and logs are retained in your repository. By shortening the retention period, you can prevent unnecessary accumulation of data and manage storage more effectively.

A workflow becomes reusable when its on configuration includes the workflow_call event. This event declares that the workflow can be invoked by another workflow rather than only being started by ordinary repository events. Inputs and secrets can also be defined beneath workflow_call so the caller can provide values to the reusable workflow. workflow_run has a different purpose: it starts a workflow in response to another workflow running or completing. pull_request responds to pull-request activity, while check_run responds to GitHub Checks activity. GitHub ' s official reusable workflow documentation explicitly states that a reusable workflow must contain on: workflow_call. Therefore, workflow_call is the required keyword when defining a workflow intended to be called from other workflows.

================

A Docker container action is ideal for custom actions that require specific environments or dependencies, such as Python. By creating a Docker container, you can define the environment with the necessary Python version and dependencies, and your Python code can run inside that container.

For a JavaScript action using the official @actions/core toolkit, core.setFailed(error.message) is the documented method for reporting an exception and marking the action as failed. setFailed() logs the supplied message and sets a failing exit code so GitHub records the action and associated check run as unsuccessful. Neither core.setException() nor core.action.setException() exists in the supported @actions/core API, and action.setError() is likewise not the documented error-handling method. The source PDF visibly contains the first three choices but crops the final distractor; the missing fourth choice was reconstructed from the matching public GH-200 question listing, while the correct answer itself was independently verified against GitHub ' s official documentation. GitHub ' s JavaScript-action example uses this exact catch pattern.

================

GitHub Actions provides the concurrency mechanism for preventing overlapping workflow runs or jobs that share the same concurrency group. A workflow can define a concurrency group associated with a deployment target so that only one matching deployment is running at a time. The deployment job should also reference the target GitHub environment, such as production, so GitHub can associate the job with that deployment environment and apply its deployment controls. GitHub ' s documentation specifically describes using concurrency to ensure that an environment has a maximum of one deployment in progress at a time. GitHub does not provide the mutex configuration described in options A, B, and F, and concurrency is not configured simply by assigning the numeric value 1. Therefore, specifying the concurrency scope together with the target environment is the appropriate solution.

================

The matrix configuration specifies two variables: color and animal. The color variable has 2 values (green and pink), and the animal variable has 2 values (owl and magpie). This would result in 4 combinations (2 color values × 2 animal values). Additionally, the include section introduces two more combinations (color: blue and animal: owl; color: pink and animal: magpie).

The publish-npm job includes the JS-DevTools/npm-publish action, which is used to publish an npm package to an npm registry.

The publish-npm job has the needs: build directive, meaning it will only run after the build job successfully completes.

Once the runner is properly configured and labeled, users should be informed to select the specific runner by identifying the label or group name when defining the runner in their workflows.

Adding a custom label (like custom-software) to the runner makes it easier for users to select the runner in their workflows by using the runs-on key, which allows them to choose this specific runner based on its label.

GitHub Actions uses the env key to define environment variables. The env mapping can be applied at the workflow, job, or individual step level. In option B, dbserver is defined directly beneath the step-level env key, making it available to that step ' s shell process. Because the example uses shell syntax appropriate to a Linux runner, $dbserver correctly references the environment variable from the run command. The variables and environment keys shown in options A and D are not valid substitutes for step-level env. Option C also uses an invalid list structure; env expects a mapping of variable names to values rather than name and value objects. Therefore, option B uses the supported GitHub Actions workflow syntax.

================

The best design is to use environment-scoped secrets with the same secret name, such as DEPLOY_KEY, in separate environments such as DevCloud and TestCloud. This lets the same reusable deployment logic reference one consistent secret name while the selected environment supplies the correct value. Option A is invalid because GitHub secret names should not be designed around dotted property access, and reusable workflows should not parse secret names dynamically. Option C introduces unnecessary marketplace dependency and weak secret handling. Option D is also wrong because GitHub secrets are opaque strings; ${{ secrets.DEPLOY_KEY.DevCloud }} is not valid secret property access. Reusable workflows can define and receive named secrets through the secrets mapping.

Using a tag is a best practice because tags are immutable and represent a fixed version of your action. By referencing tags, consumers of your action can be assured they are using a stable and specific version of the action, which helps in avoiding issues with breaking changes.

The commit SHA is another reliable way to specify a particular version of an action. By referencing a specific commit SHA, consumers can ensure they are using exactly the code that was written at that moment, avoiding the potential for changes in the future.

GitHub-hosted runners have a limit on the number of concurrent workflows (typically 20 for free-tier accounts and 5 for enterprise). If your organization needs to run more workflows simultaneously, you would need to use self-hosted runners to increase the available concurrency.

Self-hosted runners allow you to configure specialized hardware or software setups that are necessary for certain workflows. GitHub-hosted runners may not have access to custom hardware configurations like GPUs or other specialized resources, so self-hosted runners are required in such cases.

A JavaScript action is identified in its action metadata file by the runs.using runtime value. In older exam-style content, this is commonly shown as node16; in current GitHub documentation, supported JavaScript runtimes have moved forward, but the principle remains the same: JavaScript actions declare a Node.js runtime under runs.using and specify the main JavaScript file under runs.main. Option A is not reliable because a repository can contain package.json without being a JavaScript action. Option B is unrelated because workflow files do not define the action type. Option C is naming-based and has no technical meaning. GitHub metadata syntax defines runs.using as the runtime for JavaScript actions.

If a workflow depends on an external service that is down, disabling the workflow temporarily will prevent it from running and sending requests to the service, thus avoiding failed requests or unnecessary retries.

If a workflow is causing a negative impact on external services by generating too many requests or incorrect data due to a bug, temporarily disabling the workflow will stop this behavior while the issue is fixed.

The $GITHUB_OUTPUT file is used to pass data from one step to another in GitHub Actions. The echo command appends the key-value pair to this file, which sets the output variable (MY_OUTPUT) for the current step.

GitHub ' s REST API provides a dedicated Download workflow run logs endpoint. The request uses the HTTP GET method and the path /repos/{owner}/{repo}/actions/runs/{run_id}/logs. GitHub responds with a redirect to an archive containing the log files for that workflow run. The endpoint requires the repository owner, repository name, and workflow run ID. For private repositories, the caller must authenticate with appropriate repository or Actions read permissions. A POST request is not used because retrieving logs is a read operation. The artifacts endpoint manages workflow artifacts rather than workflow execution logs. Therefore, option A exactly matches the current GitHub REST API endpoint documented for downloading the log archive associated with a workflow run.

================

The most secure option listed is to use OIDC-based integration to obtain short-lived credentials from an external secrets manager or cloud provider. This avoids storing long-lived sensitive values directly in workflow YAML, repository text, or regular environment variables. Options A, B, and C are insecure because they expose or persist sensitive information in places that can be read, logged, committed, or mismanaged. With OIDC, the workflow requests a token from GitHub’s OIDC provider and exchanges it with the trusted external provider for a short-lived credential. This reduces secret sprawl and supports stronger authorization controls. GitHub documents OIDC as a way to avoid duplicating long-lived cloud credentials as GitHub secrets and to use short-lived access tokens instead.

Caching is ideal for files that change rarely, such as dependencies or build outputs, as it speeds up subsequent workflow runs by reusing previously cached files instead of re-downloading or rebuilding them.

Artifacts are used for persisting files produced during a job that need to be used in later jobs or after the workflow has ended, allowing them to be downloaded or referenced later.

GitHub Actions supports organization-level secrets with repository access policies. When the same secret must be centrally managed but made available only to particular repositories, an organization owner can create an organization secret and configure its Repository access policy for selected repositories. This avoids creating and maintaining separate copies of the secret in every repository while still enforcing scope restrictions. Environment secrets are created for environments within individual repositories, so there is no organization-level environment secret matching option B. GitHub repositories also do not provide a general Share secret option like option D. External secret-management systems can be integrated with GitHub Actions, but they are unnecessary for this requirement. Therefore, an organization secret restricted to selected repositories is the direct GitHub-supported solution.

================

Environment secrets are scoped to GitHub Actions environments and can be protected by environment protection rules. If an environment requires reviewers, a job that references that environment cannot access its environment secrets until the required approval is granted. This makes option A correct. Option B is incorrect because environment secrets are made available to jobs that reference the protected environment, not selectively to only one specific step by default. Option C is not the purpose of environment secrets; they are not specifically for connecting to GitHub Enterprise Server. Option D is also incorrect because GitHub environment secrets do not automatically pull from Azure Key Vault without additional integration or custom workflow logic. This topic covers environment protection, secrets, and deployment governance.

================

The pull_request event supports activity-type filtering, including the labeled activity, so a workflow can respond when a label is added to a pull request. The branches filter limits execution according to the pull request ' s target or base branch, while the paths filter limits execution according to changed files. GitHub also states that when branch and path filters are both configured, both conditions must be satisfied . Therefore, a pull request targeting releases, containing a change beneath apps/**, and receiving a label matches option C. pull_request_review concerns review activity rather than labeling, and pull_request_label is not a GitHub Actions workflow event. Option B also uses filters that do not accurately represent the stated exact branch and folder requirement.

================

GitHub Actions supports the env key at three workflow syntax scopes: the workflow ' s top level, an individual job, and an individual step. A top-level env value is available to steps across all jobs in the workflow. jobs. < job_id > .env limits variables to the steps of one job, while jobs. < job_id > .steps[*].env limits them to a particular step. When the same variable name is defined at several levels, the most specific definition takes precedence while that scope executes. GitHub Actions does not define a generic stage scope, and defaults is used for default settings such as the shell or working directory rather than as another env scope. Likewise, runner level is not a workflow-file env scope. Therefore, step, top, and job levels are correct.

================

The workflow_call event is used to trigger a reusable workflow from another workflow. This allows you to create workflows that can be reused in multiple places within your organization, enabling better modularity and reducing duplication.

The run keyword is used to execute command-line programs and scripts on a GitHub Actions runner. When several commands must execute within the same workflow step, YAML ' s literal block indicator (|) can be placed after run: and the commands written on separate indented lines. GitHub ' s workflow syntax explicitly demonstrates this pattern with npm ci followed by npm run build. The shell keyword does not contain commands; it specifies which shell should interpret the commands supplied through run. Therefore, options B and C misuse the shell property. Option D also lacks the YAML literal block notation required to represent the multiple command lines as the value of run. Option A correctly executes both commands sequentially within the same shell process and is the documented syntax.

================

Documentation is critical when distributing custom GitHub Actions because users need to understand what the action does and how to use it correctly. A good README or marketplace description explains the action’s purpose, required inputs, outputs, permissions, and expected behavior. This directly supports option B. Documentation should also include practical usage examples, such as a workflow snippet showing the uses: syntax and required with: inputs, which supports option C. Option A is incorrect because documentation does not create a README inside the consuming workflow; the action author provides documentation in the action repository. Option D is also incorrect because documentation does not automatically generate workflow auto-completion. This topic tests custom action publishing and usability best practices.

================

While Docker can run on various operating systems, Linux is often the most common and preferred OS for containerized workloads. Docker works well on Linux and is a widely-used platform for running containers.

For container jobs to run on a self-hosted runner, Docker must be installed and properly configured on the runner. Docker is required to build and run containerized workloads in a GitHub Actions workflow.

The run keyword executes commands using the default shell unless a different shell is specified. Since the commands shown are Python statements, the step must define shell: python so GitHub Actions interprets the script using Python instead of Bash, PowerShell, or another default shell. Option D is therefore correct. Option A is invalid because with: is used to pass inputs to actions, not to define the interpreter for a run command. Option B would execute the text as Bash and fail because import os is not Bash syntax. Option C only changes the working directory and does not change the shell. This exam topic checks workflow syntax, shell selection, and step-level command execution.

================