Free GH-200 practice test: 30 questions with answers

Official Azure actions with OIDC give secure, maintained deployment with short-lived credentials. Custom password scripts, manual uploads and skipped authentication are weaker or unsafe.

Environments track deployment history and sequential jobs enforce order. Simultaneous deploys skip gating, manual copies are untracked, and no tracking removes visibility.

Publishing packages requires the packages write permission. Read-only contents, Pages and issues permissions do not allow publishing images.

timeout-minutes stops a job after a defined limit. continue-on-error ignores failures, a larger runner may not fix hangs, and cron schedules start runs.

Hosted and self-hosted runners can both run jobs, and concurrency helps manage parallel usage. Self-hosted runners still have infrastructure costs, they are available for private repositories, and hosted usage has limits.

Releases can be created with generated notes and assets through the API or actions. Manual files, deletion and commit messages do not produce proper release assets.

Deploying to Pages requires pages and id-token permissions along with the Pages deployment action. Issues, packages and admin permissions are not needed.

Environment protection rules support wait timers that delay deployments and allow cancellation. Cron schedules start runs, sleep commands waste resources, and unrestricted concurrency does not add a wait.

Encrypted secrets referenced through the secrets context are masked in logs and kept out of source. Printing, committing and pasting expose the value.

Environments provide protection rules such as required reviewers and scoped secrets. A README note has no enforcement, and public gists expose secrets.

Explicit least-privilege permissions limit what the GITHUB_TOKEN can do. Write-all and admin tokens expand risk, and the token is required for many actions.

Pinning to a commit SHA prevents silent changes when tags move. Mutable tags can be retargeted, random downloads are unsafe, and disabling all actions removes needed automation.

The pull_request trigger does not give fork PRs access to repository secrets by default. pull_request_target with checkout of untrusted code is a well-known risk, and printing secrets is unsafe.

OpenID Connect issues short-lived tokens to workflows, avoiding stored long-lived credentials. Root passwords, shared keys and base64 encoding are insecure.

Avoiding printed secrets and passing them only where needed limits exposure. Echoing, comments and artifact file names all risk leaking secret values.

A committed secret must be treated as compromised, so revoking and rotating it comes first. Deleting a branch does not remove history from forks or caches, emailing the secret spreads it, and waiting leaves exposure open.

Self-hosted runners let teams run jobs on their own machines with custom tools. Renaming a hosted runner changes nothing, manual laptop builds are not automation, and removing the step fails the requirement.

Self-hosted runners in public repositories can run code from untrusted forks, which risks compromise. Cosmetic and count factors are irrelevant.

The container keyword sets the image a job runs in. Services run supporting containers alongside the job, uses calls actions, and on defines triggers.

actions/cache saves and restores paths using a key, often a hash of the lock file, so the cache updates when dependencies change. Other options do not provide reliable caching.

Upload and download artifact actions share files between jobs in a workflow run. Cache is for reusable dependencies, checkout fetches source, and setup actions install tools.

Reusable workflows and composite actions reduce duplication, centralize maintenance and standardize steps. They do not remove security checks or guarantee zero failures.

Hosted macOS images include multiple Xcode versions, and a step can select the one needed. Random downloads are slow and unsafe, and renaming or scheduling does not change the toolchain.

The push trigger runs on pushes and the pull_request trigger with a branch filter runs for PRs targeting main. Schedule, workflow_call and release triggers do not match the requirement.

The needs keyword defines job dependencies, so a job waits for listed jobs to finish successfully. runs-on selects the runner, uses calls an action or reusable workflow, and env sets variables.

The failure() status function runs the step when a previous step failed. success() is the default, always() runs regardless, and runs-on is not a conditional.

A reusable workflow with workflow_call can be called from other workflows and repositories, which avoids duplication. Copying YAML creates drift, and tokens and secrets are not reuse mechanisms.

Writing to GITHUB_ENV makes a value available to later steps as an environment variable, and GITHUB_OUTPUT exposes step outputs. Comments and READMEs are not runtime channels.

The concurrency setting with cancel-in-progress cancels older runs in the same group. Timeouts stop long jobs, schedules start runs, and larger runners do not prevent duplicate runs.

Path and branch filters limit triggers to relevant changes. Removing the on key stops triggers entirely, and a zero timeout does not restrict runs.