CertArea
All Microsoft exams

Free GH-100 practice test: 30 questions with answers

30 original questions for GitHub Enterprise Administrator, drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
100 questions

GH-100 exam guide: topics, cost and format

All 30 GH-100 questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Actions (5 questions)

  1. Question 1

    A workflow must run on a machine inside the company network that can reach an internal service. Which runner type is appropriate?

    1. AA GitHub-hosted runner that has no network access to internal systems
    2. BA self-hosted runner installed on a machine inside the network
    3. CA Codespace that is not connected to the network
    4. DA workflow run on a developer's personal laptop without registration
    Show answer and explanation
    Correct answer: B

    A self-hosted runner inside the network can reach internal services. GitHub-hosted runners cannot reach private internal systems by default, and personal laptops and unconnected Codespaces are not managed runners.

  2. Question 2

    An administrator wants to restrict which repositories may use a particular group of self-hosted runners. Which feature supports this?

    1. AA label on the repository's home page
    2. BA shared password for the self-hosted runner
    3. CA comment in the workflow file that the runner ignores
    4. DRunner groups with repository access settings
    Show answer and explanation
    Correct answer: D

    Runner groups control which repositories or organizations can use a set of runners. Shared passwords, comments and homepage labels do not restrict runner use.

  3. Question 3

    A workflow needs cloud credentials, but the organization does not want long-lived secrets stored in GitHub. Which approach is preferred?

    1. AOpenID Connect to request short-lived credentials at run time
    2. BStore a permanent administrator key as a plain repository variable
    3. CPaste the cloud password into the workflow file
    4. DShare the cloud key in a team chat
    Show answer and explanation
    Correct answer: A

    OpenID Connect issues short-lived credentials at run time, which avoids storing long-lived secrets. Plain variables, file-embedded passwords and chat sharing expose credentials.

  4. Question 4

    Which secrets scope is most appropriate for a value that several repositories in one organization need?

    1. AA secret printed in plain text in each workflow run log file
    2. BAn organization secret with access granted to the selected repositories
    3. CA secret pasted into each commit message, where it stays in the Git history permanently
    4. DA secret stored in a public gist so that teammates can read it
    Show answer and explanation
    Correct answer: B

    An organization secret shared with selected repositories avoids duplicating the value. Logs, commit messages and public gists expose the secret.

  5. Question 5

    Which two practices make GitHub Actions workflows safer for an enterprise? (Choose two.)

    1. APin third-party actions to a full commit SHA
    2. BRun untrusted pull request code with secrets available to it
    3. CUse the latest version of every action with no review
    4. DGrant the GITHUB_TOKEN only the permissions the job needs
    5. EStore secrets as plain text in the workflow file
    Show answer and explanation
    Correct answer: A, D

    Pinning actions to a full commit SHA and limiting GITHUB_TOKEN permissions reduce supply chain and privilege risk. Running untrusted code with secrets, unreviewed latest actions and plain-text secrets all increase risk.

Identity and access (4 questions)

  1. Question 6

    A company requires that employees sign in to GitHub with the corporate identity provider and that accounts be created and removed automatically. Which feature addresses this?

    1. ASAML single sign-on with SCIM provisioning
    2. BSharing one password across all users
    3. CDisabling sign-in for all users
    4. DAllowing anyone with an email address to create an account
    Show answer and explanation
    Correct answer: A

    SAML single sign-on authenticates through the corporate identity provider, and SCIM provisioning creates and removes accounts automatically. Shared passwords, open sign-up and disabled sign-in do not meet the requirement.

  2. Question 7

    Which GitHub deployment model creates accounts that are fully owned and managed by the enterprise identity provider, and which cannot contribute to public repositories with personal accounts?

    1. AEnterprise Managed Users
    2. BAnonymous public access
    3. CFree personal accounts
    4. DGuest collaborators on a public fork
    Show answer and explanation
    Correct answer: A

    Enterprise Managed Users are accounts created and controlled by the enterprise identity provider and are restricted to the enterprise. Free personal accounts, anonymous access and public fork guests are different models.

  3. Question 8

    An organization owner wants to give a contractor access to a single repository only, without organization membership. Which role is most appropriate?

    1. AOrganization owner with administrative rights over organization settings
    2. BEnterprise owner with billing and policy control settings
    3. CMember with access to the full set of repositories in the organization
    4. DOutside collaborator with read or write access to that repository
    Show answer and explanation
    Correct answer: D

    An outside collaborator receives access to specific repositories without organization membership. Owners and members with broad access give more permission than needed.

  4. Question 9

    Which approach groups users so that repository access can be granted to a group rather than to each person?

    1. AShared passwords for each department
    2. BIndividual permissions set per user
    3. CTeams with assigned repository permissions
    4. DRepository topics listed in README
    Show answer and explanation
    Correct answer: C

    Teams group members and receive repository permissions, which scales access management. Individual grants, shared passwords and repository topics do not provide group-based access.

Repository governance (4 questions)

  1. Question 10

    Which feature lets an administrator define rules, such as required reviews and status checks, that apply to many repositories at once?

    1. AA list of repository names in a text file reviewed by hand
    2. BLabels applied to each issue, used to sort and triage bug reports
    3. CRepository rulesets applied across selected repositories
    4. DIndividual comments on each pull request from the reviewer team
    Show answer and explanation
    Correct answer: C

    Rulesets can apply rules, such as required reviews and status checks, across many repositories. Text lists, comments and labels do not enforce rules.

  2. Question 11

    A main branch must not be deleted or force-pushed, and must require a pull request review. Which mechanism enforces these rules?

    1. ABranch protection rules or a ruleset on the branch
    2. BA note in the contributing guide for pull request reviews
    3. CA label on the branch name that signals review expectations
    4. DA comment in the last commit message for the review team
    Show answer and explanation
    Correct answer: A

    Branch protection rules or rulesets enforce restrictions such as blocking force pushes and requiring reviews. Notes, labels and commit comments do not enforce anything.

  3. Question 12

    Which file defines the users or teams who must review changes to particular paths in a repository?

    1. AREADME.md
    2. BCODEOWNERS
    3. Cdependabot.yml
    4. DLICENSE
    Show answer and explanation
    Correct answer: B

    CODEOWNERS maps paths to owners who are requested for review. README, LICENSE and Dependabot configuration serve other purposes.

  4. Question 13

    A repository must be made private, but a fork of it already exists in a public account. What is the best first action for the administrator?

    1. AReview the fork relationship and address the public copy under the organization's policy
    2. BDelete the organization immediately, which removes its repositories, forks, teams and member access
    3. CIgnore the fork, because forks are created as private copies and are excluded from the organization's policy
    4. DMake the repositories across the enterprise public so that outside contributors can review the code
    Show answer and explanation
    Correct answer: A

    Reviewing the fork relationship and addressing the public copy under policy is the proportionate first step. Assuming forks are private is wrong, and deleting the organization or publishing everything is disproportionate.

Security features (4 questions)

  1. Question 14

    Which GitHub Advanced Security feature alerts a team when a committed credential matches a known pattern?

    1. ADependabot version updates for dependencies
    2. BGitHub Pages static site hosting
    3. CWiki search across project pages
    4. DSecret scanning with push protection
    Show answer and explanation
    Correct answer: D

    Secret scanning detects committed credentials, and push protection can block them. Dependabot updates dependencies, GitHub Pages hosts sites, and wiki search finds content.

  2. Question 15

    Which feature identifies known vulnerabilities in the dependencies a repository uses and can open pull requests to update them?

    1. ADependabot alerts and security updates
    2. BCode owners that assign review to changed files
    3. CGitHub Discussions for team questions and polls
    4. DRelease notes generated for each published tag
    Show answer and explanation
    Correct answer: A

    Dependabot alerts flag vulnerable dependencies and security updates open pull requests to fix them. Code owners, discussions and release notes do not scan dependencies.

  3. Question 16

    Which feature runs static analysis to find security issues in code and reports them as alerts?

    1. AIssue templates for bug reports
    2. BProject boards for sprint work
    3. CSponsorship buttons on profiles
    4. DCode scanning with CodeQL
    Show answer and explanation
    Correct answer: D

    Code scanning with CodeQL performs static analysis and reports code security alerts. Issue templates, sponsorship buttons and project boards do not analyse code.

  4. Question 17

    Which two actions help an organization respond to an exposed secret? (Choose two.)

    1. ARemove the commit from the history and still treat the secret as compromised
    2. BLeave the credential active while investigating for a week
    3. CIgnore the alert if the repository is private
    4. DRevoke or rotate the exposed credential immediately
    5. EPost the secret in the incident channel for visibility
    Show answer and explanation
    Correct answer: A, D

    Revoking or rotating the credential is the priority, and removing the commit does not make the secret safe because it may already be copied. Leaving it active, ignoring alerts and posting the secret all increase exposure.

Enterprise accounts (4 questions)

  1. Question 18

    An organization wants to manage billing, policies and identity for several GitHub organizations from one place. Which GitHub construct provides this?

    1. AA team inside one organization for grouping members and their repository access
    2. BA single repository with many branches and a protected default branch
    3. CA personal access token shared among members of a team-owned service account
    4. DAn enterprise account that owns and governs multiple organizations
    Show answer and explanation
    Correct answer: D

    An enterprise account owns and governs multiple organizations, with shared billing and policies. A repository, a shared token and a single team do not provide enterprise-wide governance.

  2. Question 19

    An enterprise owner wants a policy that applies to all organizations, but one organization needs a stricter setting. What is the expected behaviour?

    1. AThe stricter setting can apply within that organization where the enterprise policy allows it
    2. BThe enterprise policy is ignored for that organization, whose local settings take full precedence
    3. CEvery organization must use one stricter setting, regardless of enterprise policy
    4. DPolicies are restricted to the enterprise level, so organization owners cannot configure them locally
    Show answer and explanation
    Correct answer: A

    Enterprise policies set the baseline and organizations can be stricter where the policy permits. Ignoring enterprise policy, forcing one setting everywhere and disallowing organization settings do not match how policies inherit.

  3. Question 20

    Which enterprise role has the broadest administrative control across all organizations in the enterprise?

    1. ARepository reader
    2. BOrganization member
    3. CEnterprise owner
    4. DOutside collaborator
    Show answer and explanation
    Correct answer: C

    Enterprise owners have the broadest control across the enterprise. Repository readers, members and outside collaborators have narrower access.

  4. Question 21

    A new organization is created inside the enterprise. Which step ensures it follows the enterprise security baseline from the start?

    1. AKeep the organization on default settings and review its setup after a year
    2. BApply the enterprise policies and rulesets to the new organization when it is created
    3. CDisable enterprise policies for newly created organizations at creation time
    4. DPlace the organization under a separate billing account that carries no enterprise policies or rulesets
    Show answer and explanation
    Correct answer: B

    Applying enterprise policies and rulesets at creation ensures the baseline from the start. Leaving defaults, disabling policies and separate unmanaged accounts all weaken governance.

Audit and compliance (4 questions)

  1. Question 22

    An auditor asks who changed an organization's member permissions last month. Which resource provides this record?

    1. AThe repository's README history as a changelog
    2. BThe organization or enterprise audit log
    3. CThe team's discussion board for the project
    4. DThe release notes page of a project
    Show answer and explanation
    Correct answer: B

    The audit log records administrative and membership events with actor and time. README history, discussions and release pages do not record permission changes.

  2. Question 23

    Which audit log feature lets an enterprise send events to an external system for long-term retention and analysis?

    1. APrinting the audit log each day for paper records
    2. BEmailing a screenshot of the audit log
    3. CAudit log streaming to a supported destination
    4. DDeleting the audit log after just 24 hours
    Show answer and explanation
    Correct answer: C

    Audit log streaming sends events to an external destination for retention and analysis. Printing, rapid deletion and screenshots do not provide reliable retention.

  3. Question 24

    An administrator needs to find which user created a personal access token used against the organization. Where should they look?

    1. AThe repository's full commit history and blame annotations
    2. BThe public release notes of the organization
    3. CThe organization audit log for token-related events
    4. DThe user's public profile and contribution graph
    Show answer and explanation
    Correct answer: C

    The audit log records events related to tokens and access. Commit history, release notes and public profiles do not record token creation or use.

  4. Question 25

    Which retention consideration matters most when an organization streams audit events to its security tooling?

    1. AThe events should be deleted immediately from the source system as soon as they have been streamed to the tool
    2. BThe external destination must retain events for the period the organization's policy requires
    3. CThe events should be kept on an engineer's unencrypted local laptop as a spreadsheet export on the desktop
    4. DThe events should be printed each day and then discarded from the office shredder
    Show answer and explanation
    Correct answer: B

    The external destination should retain events for the policy period so they remain available for investigation and compliance. Deleting, laptop storage and daily discarding lose evidence.

Copilot and billing (4 questions)

  1. Question 26

    An enterprise wants to decide which members can use a paid AI coding assistant, and to control seat costs. Which administrative setting addresses this?

    1. AA label on each pull request that marks the change as eligible for AI-assisted review
    2. BCopilot licence assignment and policies for the enterprise or organization
    3. CA wiki page about pricing and seat costs for internal budget planning each quarter
    4. DA repository topic for AI tools that lists approved assistants and usage guidelines for teams
    Show answer and explanation
    Correct answer: B

    Copilot licence assignment and policies control who can use paid seats and costs. Repository topics, labels and wiki pages do not manage licences.

  2. Question 27

    An administrator wants to see how many seats are assigned and whether they are used. Which information is most relevant?

    1. AThe total number of Gists created by members during the last quarter across the enterprise
    2. BCopilot seat assignment and usage reports for the enterprise or organization
    3. CThe count of issues closed by maintainers across each repository
    4. DThe combined total number of stars on the organization's public repositories and forks
    Show answer and explanation
    Correct answer: B

    Seat assignment and usage reports show how paid seats are allocated and used. Stars, closed issues and Gist counts do not reflect seat usage.

  3. Question 28

    An enterprise wants to allow Copilot for some organizations but not others. Which control supports this?

    1. ACopilot policies configured per organization within the enterprise
    2. BA single enterprise-wide switch that applies uniformly with no exceptions
    3. CA repository label applied to each project in the enterprise
    4. DA profile setting each developer toggles in their personal account preferences
    Show answer and explanation
    Correct answer: A

    Copilot policies can be configured per organization within the enterprise, allowing selective enablement. A single global switch, labels and profile settings do not provide organization-level control.

  4. Question 29

    Which information is most useful for forecasting the cost of paid AI seats for the next quarter?

    1. AThe colour scheme of the enterprise dashboard header
    2. BThe number of forks on public repositories over the past fiscal quarter
    3. CThe average length of repository descriptions and tags
    4. DCurrent seat assignments, usage trends and planned hiring
    Show answer and explanation
    Correct answer: D

    Seat assignments, usage trends and hiring plans drive forecasts. Fork counts, colour schemes and description length do not affect seat cost.

Policies (1 question)

  1. Question 30

    An enterprise wants to ensure that every organization requires two-factor authentication for members. Where is this enforced?

    1. AIn each repository's README file, reviewed by maintainers
    2. BIn each user's personal profile settings, configured by the account holder
    3. CIn the enterprise policy settings that apply to all organizations
    4. DIn the GitHub Actions workflow file of each new project
    Show answer and explanation
    Correct answer: C

    Enterprise policy settings apply security requirements, such as two-factor authentication, to all organizations. README files, personal profiles and workflows cannot enforce it across the enterprise.