Microsoft GH-100 Online Practice Questions and Exam Preparation

Microsoft GH-100 Online Questions & Answers

• Question 1:

  Which of the following are valid ways to pass data to a reusable workflow in a separate repository?

  A. Use environment variables to pass data directly to the reusable workflow.
  B. Define inputs in the reusable workflow and pass values from the calling workflow.
  C. Define the secrets in the caller repository and call the reusable workflow using the `secrets' keyword.
  D. Define the secrets in the reusable workflow's repository and reference the secret using the `secrets' context.
  B. Define inputs in the reusable workflow and pass values from the calling workflow.
  C. Define the secrets in the caller repository and call the reusable workflow using the `secrets' keyword.

  ---

  explanation:

  Explanation

  You declare named inputs in the reusable workflow's on.workflow_call block and then pass values from the caller using the with keyword, allowing the called workflow to consume those parameters. You define required secrets in the caller repository and supply them to the reusable workflow via the secrets keyword in the workflow-call step, ensuring sensitive values are securely passed.

• Question 2:

  When comparing fine-grained Personal Access Tokens (PATs) with classic PATs, which of the following statements is accurate?

  A. Fine-grained PATs automatically renew while classic PATs require manual renewal.
  B. Fine-grained PATs permissions can be scoped to specific repositories.
  C. Classic PATs offer more permission controls than fine-grained PATs.
  D. Classic PATs can be restricted to specific organizations, but fine-grained PATs cannot.
  B. Fine-grained PATs permissions can be scoped to specific repositories.

  ---

  explanation:

  Explanation

  Fine-grained personal access tokens let you scope permissions down to individual repositories, whereas classic PATs grant access across every repo the user can reach.

• Question 3:

  Which practice helps avoid service disruption when consuming GitHub APIs at scale?

  A. Designingyour application to work within GitHub's rate limits
  B. Using multiple tokens to bypass limits
  C. Caching all API responses permanently
  D. Ignoring secondary rate limits
  A. Designingyour application to work within GitHub's rate limits

  ---

  explanation:

  Explanation

  Designing your integration to stay within GitHub's documented rate limits--by batching requests, using conditional requests, handling 429 responses with back-off, and monitoring the X-RateLimit-* headers - ensures you won't be temporarily throttled or cut off when you hit secondary limits.

• Question 4:

  Which events from the audit log are exposed by the GraphQL API? Each answer presents a complete solution. (Choose three.)

  A. changes in permissions B promoting users to administrators
  B. pushes to repositories
  C. changes to permissions of a GitHub App
  D. cloning of repositories
  A. changes in permissions B promoting users to administrators
  B. pushes to repositories
  D. cloning of repositories

  ---

  explanation:

  Explanation

  The GraphQL Audit Log API surfaces entries whenever repository or organization permissions are changed ("Changes permissions").

  It records when users are elevated to administrative roles ("Promotes users to admin").

  It logs alterations to a GitHub App's granted permissions ("Changes permissions of a GitHub App").

• Question 5:

  What is the new capability of GitHub's billing dashboard?

  A. Automatically removes unused users from billing
  B. Enables tracking of GitHub Copilot usage byuser
  C. Allows self-service plan upgrades
  D. Offers real-time Slack alerts for billing
  B. Enables tracking of GitHub Copilot usage byuser

  ---

  explanation:

  Explanation

  The revamped Billing and Licensing dashboard now includes a dedicated "Copilot" tab that shows per-user seat assignments, usage counts, and estimated costs for your organization's GitHub Copilot licenses, enabling you to track Copilot consumption by individual users.

• Question 6:

  What needs to be done to ensure that only specific repositories can access the runners in an organization runner group?

  A. Use GitHub's meta API to configure access.
  B. Add a label to the runner group.
  C. Configure repository access in the runner group settings.
  D. Configure the Actions Policies to "Only selected repositories".
  C. Configure repository access in the runner group settings.

  ---

  explanation:

  Explanation

  In the organization's runner group settings, switch the access from "All repositories" to "Selected repositories" and then explicitly choose which repos may use those runners.

• Question 7:

  When a user becomes a member of multiple GitHub organizations, which THREE of the following are important considerations for administrators? (Choose three.)

  A. The user will automatically have the same role across all organizations.
  B. The user's repository access and/or team membership needs to be managed separately for each organization.
  C. The user will need to authorize credentials separately for each SAML-enabled organization.
  D. The user will have different permission levels in each organization.
  E. The user's profile information becomes private to non-organization members.
  F. The user's personal repositories will become accessible to all organizations.
  B. The user's repository access and/or team membership needs to be managed separately for each organization.
  C. The user will need to authorize credentials separately for each SAML-enabled organization.
  D. The user will have different permission levels in each organization.

  ---

  explanation:

  Explanation

  A user's repository access and team memberships are scoped to each organization, so admins must configure permissions separately per org.

  When an organization enforces SAML SSO, each member must authorize their personal access tokens or SSH keys for that org, requiring separate approval for each SAML-enabled organization

  Roles and permission levels (owner, member, billing manager, repository roles, etc.) are assigned on a per-organization basis, so a user often has different permissions in different organizations.

• Question 8:

  You discover that a secret (e.g., a token or password) was accidentally committed to a GitHub repository. What is the first step you should take to mitigate the risk?

  A. Contact GitHub Support to remove the secret from all forks and clones of the repository.
  B. Revoke and/or rotate the secret to render it unusable, then assess whether history rewriting is necessary.
  C. Rewrite the repository history using git filter-repo or BFG Repo-Cleaner to remove the secret from all commits.
  D. Delete the repository and create a new one to ensure the secret is no longer accessible.
  B. Revoke and/or rotate the secret to render it unusable, then assess whether history rewriting is necessary.

  ---

  explanation:

  Explanation

  The immediate priority is to revoke or rotate the exposed credential so it can no longer be used; once it's invalidated, you can safely proceed with history-rewriting or other cleanup steps.

• Question 9:

  What will happen if Dependabot discovers a vulnerable transitive dependency in a repository?

  A. It creates a pull request to update the direct dependency to a version that resolves the vulnerability.
  B. It opens a pull request to update the affected package directly, regardless of version compatibility.
  C. It automatically removes the package from the repository.
  D. It sends an email to the repository owner but does not alter code.
  A. It creates a pull request to update the direct dependency to a version that resolves the vulnerability.

  ---

  explanation:

  Explanation

  Dependabot will automatically open a pull request that updates the direct dependency to a version which, in turn, resolves (or removes) the vulnerable transitive dependency--ensuring the fix is applied via your declared dependencies.

• Question 10:

  Which THREE of the following accurately describe how the SCIM protocol enhances user management in GitHub Enterprise Cloud? (Choose three.)

  A. SCIM synchronizes changes to user attributes from the identity provider to GitHub.
  B. SCIM deactivates GitHub accounts when users are deleted from the identity provider.
  C. SCIM automatically deletes organization repositories when administrators are removed.
  D. SCIM automates user provisioning when new users are added to the identity provider.
  E. SCIM generates authentication tokens for accessing GitHub's REST API.
  F. SCIM configures repository permissions based on user roles within the organization.
  A. SCIM synchronizes changes to user attributes from the identity provider to GitHub.
  B. SCIM deactivates GitHub accounts when users are deleted from the identity provider.

  ---

  explanation:

  Explanation

  SCIM automatically updates a user's account on GitHub whenever their profile attributes change in the identity provider. When a user is removed or deactivated in the IdP, SCIM deactivates (soft-deprovisions) their GitHub account and disables access.

  SCIM provisions new GitHub Enterprise Cloud accounts automatically when users are added in the identity provider.