Microsoft GH-200: GitHub Actions

Last checked October 22, 2026 against the official Microsoft exam page.

1. Question 1Ecosystem and deployment

   A team wants to deploy a web app to Azure from a workflow using a service that has an official action. Which practice is most appropriate?

   1. AWrite a custom script that copies passwords and store them in a plain text file
   2. BDeploy by manually uploading files each time through the web portal
   3. CSkip authentication to save time so the deploy job runs faster
   4. DUse the official Azure login and deployment actions with OIDC credentials
   Show answer and explanationHide answer

   Correct answer: D

   Official Azure actions with OIDC give secure, maintained deployment with short-lived credentials. Custom password scripts, manual uploads and skipped authentication are weaker or unsafe.

2. Question 2Security and secrets

   A workflow needs an API token for a deployment. The token must not appear in logs or in the workflow file. Which approach is correct?

   1. AStore it as an encrypted repository or environment secret and reference it through the secrets context
   2. BCommit it to a file named token.txt in the repository root and read it back with a cat command
   3. CPaste it into the workflow description field of the pull request template so everyone can see it
   4. DPrint it at the start of the job for debugging and echo it to the console log unredacted
   Show answer and explanationHide answer

   Correct answer: A

   Encrypted secrets referenced through the secrets context are masked in logs and kept out of source. Printing, committing and pasting expose the value.

3. Question 3Automation and runners

   A workflow must run a build on a machine with a specific internal toolchain that GitHub-hosted runners do not provide. Which option should be used?

   1. AA GitHub-hosted runner that is renamed to match the internal toolchain labels in the workflow file
   2. BRunning the build on a developer laptop manually and uploading the final output
   3. CA self-hosted runner registered to the repository or organization with the required tools
   4. DRemoving the build step from the workflow so the job just checks out source code
   Show answer and explanationHide answer

   Correct answer: C

   Self-hosted runners let teams run jobs on their own machines with custom tools. Renaming a hosted runner changes nothing, manual laptop builds are not automation, and removing the step fails the requirement.

4. Question 4Workflow fundamentals

   A team wants a GitHub Actions workflow to run tests on every push to any branch and on pull requests targeting main. Which trigger configuration is correct?

   1. Aon: workflow_call, so tests run when another workflow calls this file with inputs
   2. Bon: release published, so tests run after a version tag is pushed to remote
   3. Con: schedule with cron '*/5 * * * *', so tests run every five minutes on a timer
   4. Don: push for all branches and pull_request with branches set to main
   Show answer and explanationHide answer

   Correct answer: D

   The push trigger runs on pushes and the pull_request trigger with a branch filter runs for PRs targeting main. Schedule, workflow_call and release triggers do not match the requirement.

5. Question 5Ecosystem and deployment

   A release must be deployed to production only after it has been tested in a staging environment, and the production job should show the deployment history. Which feature provides this?

   1. ANo deployment tracking, so release records exist in the CI console output
   2. BEnvironments with a deployment history and sequential jobs that depend on staging
   3. CA workflow that deploys both environments at the same moment without waiting for staging to pass
   4. DManual copying of files between servers using scp from a developer laptop with no audit record
   Show answer and explanationHide answer

   Correct answer: B

   Environments track deployment history and sequential jobs enforce order. Simultaneous deploys skip gating, manual copies are untracked, and no tracking removes visibility.