Microsoft GH-200 Online Practice Questions and Exam Preparation

Microsoft GH-200 Online Questions & Answers

• Question 11:

  When creating and managing custom actions in an enterprise setting, which of the following is considered a best practice?

  A. creating a separate repository for each action so that the version can be managed independently
  B. creating a separate branch in application repositories that only contains the actions
  C. creating a single repository for all custom actions so that the versions for each action are all the same
  D. including custom actions that other teams need to reference in the same repository as application code
  A. creating a separate repository for each action so that the version can be managed independently

  ---

  Explanation

  Managing custom actions Choosing a location for your action If you're developing an action for other people to use, we recommend keeping the action in its own repository instead of bundling it with other application code. This allows you to

  version, track, and release the action just like any other software.

  Creating a separate repository for each custom action allows you to manage the versioning independently for each action. This approach provides flexibility, as each action can be updated, tested, and versioned separately, avoiding potential

  conflicts or dependencies between different actions.

  https://docs.github.com/en/actions/how-tos/create-and-publish-actions/manage-custom-actions

• Question 12:

  As a developer, you are configuring GitHub Actions to deploy VMs to production. A member of the VMOps team must provide approval before the deployment occurs. Which of the following steps should you take? (Each correct answer presents part of the solution. Choose two.)

  A. Navigate to the organization settings and create a Production environment with the VMOps team as a required reviewer.
  B. Specify the environment named Production in the workflow jobs that deploy to the VMs.
  C. Navigate to the repository settings and create a Production environment with the VMOps team as a required reviewer.
  D. Add the VMs to the environment.
  E. Specify the VMOps team as the owner of the environment.
  B. Specify the environment named Production in the workflow jobs that deploy to the VMs.
  C. Navigate to the repository settings and create a Production environment with the VMOps team as a required reviewer.

  ---

  Explanation

  [C, not A] Creating an environment Creating an environment To configure an environment in a personal account repository, you must be the repository owner. To configure an environment in an organization repository, you must have admin

  access.

  On GitHub, navigate to the main page of the repository.

  Under your repository name, click Settings. ...

  In the left sidebar, click Environments.

  Click New environment.

  Enter a name for the environment, then click Configure environment.

  .Etc.

  [B] Configure the scope for workflow jobs for the VMs to the correct new environment.

  https://docs.github.com/en/actions/how-tos/deploy/configure-and-manage-deployments/manage-environments

• Question 13:

  How can a workflow deploy mitigate the risk of multiple workflow runs that are deploying to a single cloud environment simultaneously? (Each correct answer presents part of the solution. Choose two.)

  A. Reference the mutex in the task performing the deployment.
  B. Set the concurrency in the deploymentjob to 1.
  C. Specify a target environment in the deploymentjob.
  D. Specify a concurrency scope in the workflow.
  E. Configure the mutex setting in the environment.
  F. Pass the mutex into the deployment job.
  C. Specify a target environment in the deploymentjob.
  D. Specify a concurrency scope in the workflow.

  ---

  Explanation

  [D] GitHub Actions now supports a concurrency key at both the workflow and job level that will ensure that only a single run or job is in progress.

  concurrency Use concurrency to ensure that only a single job or workflow using the same concurrency group will run at a time.

  Example: Using concurrency and the default behavior The default behavior of GitHub Actions is to allow multiple jobs or workflow runs to run concurrently. The concurrency keyword allows you to control the concurrency of workflow runs.

  For example, you can use the concurrency keyword immediately after where trigger conditions are defined to limit the concurrency of entire workflow runs for a specific branch:

  on: push: branches:

  -main

  concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true

  Incorrect:

  [Not A, not E, Not F]

  actions-mutex

  A GitHub Action for exclusive control.

  FEATURE avoid running multiple jobs concurrently across workflows

  OFFICIAL CONCURRENCY SUPPORT ON GITHUB ACTIONS The action is no longer maintained.

  On April 19, 2021, GitHub launched support for limiting concurrency in the workflow files

  https://github.blog/changelog/2021-04-19-github-actions-limit-workflow-run-or-job-concurrency/ https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#concurrency https://github.com/marketplace/actions/actions-mutex

• Question 14:

  Which default environment variable specifies the branch or tag that triggered a workflow?

  A. GITHUB_REF
  B. GITHUB_BRANCH
  C. ENV_BRANCH
  D. GITHUB_TAG
  A. GITHUB_REF

  ---

  Explanation

  GITHUB_REF : The branch or tag ref that triggered the workflow.

  https://graphite.dev/guides/github-actions-variables

• Question 15:

  As a developer, you need to use GitHub Actions to deploy a microservice that requires runtime access to a secure token. This token is used by a variety of other microservices managed by different teams in different repos. To minimize management overhead and ensure the token is secure, which mechanisms should you use to store and access the token? (Each correct answer presents a complete solution. Choose two.)

  A. Store the token as a GitHub encrypted secret in the same repo as the code. During deployment, use GitHub Actions to store the secret in an environment variable that can be accessed at runtime.
  B. Use a corporate non-GitHub secret store (e.g., HashiCorp Vault) to store the token. During deployment, use GitHub Actions to store the secret in an environment variable that can be accessed at runtime.
  C. Store the token as an organizational-level encrypted secret in GitHub. During deployment, use GitHub Actions to store the secret in an environment variable that can be accessed at runtime.
  D. Store the token as a GitHub encrypted secret in the same repo as the code. Create a reusable custom GitHub Action to access the token by the microservice at runtime.
  E. Store the token in a configuration file in a private repository. Use GitHub Actions to deploy the configuration file to the runtime environment.
  B. Use a corporate non-GitHub secret store (e.g., HashiCorp Vault) to store the token. During deployment, use GitHub Actions to store the secret in an environment variable that can be accessed at runtime.
  C. Store the token as an organizational-level encrypted secret in GitHub. During deployment, use GitHub Actions to store the secret in an environment variable that can be accessed at runtime.

  ---

  Explanation

  [B] Using a corporate secret store like HashiCorp Vault provides a secure, centralized location for sensitive information. GitHub Actions can then retrieve and store the token securely during deployment by setting it as an environment variable, ensuring the token remains secure and accessible at runtime. [C] Storing the token as an organizational-level encrypted secret in GitHub ensures it is accessible across multiple repositories, minimizing management overhead. GitHub Actions can then use this secret during deployment by setting it as an environment variable, allowing the microservice to access it securely at runtime.

• Question 16:

  Which command correctly masks a secret value in the logs?

  A. echo "::mask::${SECRET_KEY}"
  B. echo "::add-mask::${SECRET_KEY}"
  C. echo "::hide::${SECRET_KEY}"
  D. echo "::add-secret::${SECRET_KEY}"
  B. echo "::add-mask::${SECRET_KEY}"

  ---

  Explanation

  add-mask prevents a value from appearing in workflow logs for security.

• Question 17:

  You want to make sure a reusable workflow can accept inputs and return outputs. What file must define these?

  A. action.yml
  B. metadata.json
  C. workflow-call.yml
  D. the called workflow’s YAML file
  D. the called workflow’s YAML file

  ---

  Explanation

  Reusable workflows define inputs and outputs directly in their YAML using on: workflow_call.

  Example:

  on:

  workflow_call:

  inputs:

  env:

  required: true

  type: string

  outputs:

  result:

  value: ${{ jobs.build.outputs.status }}

  Reusable workflows

• Question 18:

  You need to ensure that only one workflow run per branch can execute at a time. Which syntax should you use?

  A. limit: branch-level
  B. concurrency: group: ${{ github.ref }} cancel-in-progress: true
  C. exclusive-run: branch
  D. group-concurrency: branch-only
  B. concurrency: group: ${{ github.ref }} cancel-in-progress: true

  ---

  Explanation

  The concurrency key ensures that only one job or workflow in the same concurrency group runs simultaneously.

  Example:

  on: push:

  branches: [main]

  concurrency:

  group: ${{ github.workflow }}-${{ github.ref }}

  cancel-in-progress: true

  GitHub Docs – Workflow concurrency

• Question 19:

  As a developer, which workflow steps should you perform to publish an image to the GitHub Container Registry? (Each correct answer represents part of the solution. Choose three).

  A. Push the image to the GitHub Container Registry.
  B. Authenticate to the GitHub Container Registry.
  C. Use the actions/setup-docker action.
  D. Pull the image from the GitHub Container Registry.
  E. Build the container image.
  A. Push the image to the GitHub Container Registry.
  B. Authenticate to the GitHub Container Registry.
  E. Build the container image.

  ---

  Explanation

  Publishing Docker images

  The below workflow checks out the GitHub repository, uses the login-action to log in to the registry [B], and then uses the build-push-action action to: build a Docker image based on your repository's Dockerfile [E]; push the image to Docker Hub [A], and apply a tag to the image.

  Note:

  # This workflow uses actions that are not certified by GitHub.

  # They are provided by a third-party and are governed by

  # separate terms of service, privacy policy, and support

  # documentation.

  # GitHub recommends pinning actions to a commit SHA.

  # To get a newer version, you will need to update the SHA.

  # You can also reference a tag or branch, but the action may change without warning.

  name: Publish Docker image

  on: release: types: [published]

  jobs:

  push_to_registry:

  name: Push Docker image to Docker Hub

  runs-on: ubuntu-latest

  permissions:

  packages: write

  contents: read

  attestations: write

  id-token: write

  steps:

  -

  name: Check out the repo

  uses: actions/checkout@v4

  -

  name: Log in to Docker Hub

  uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a

  with:

  username: ${{ secrets.DOCKER_USERNAME }}

  password: ${{ secrets.DOCKER_PASSWORD }}

  -

  name: Extract metadata (tags, labels) for Docker

  id: meta

  uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7

  with:

  images: my-docker-hub-namespace/my-docker-hub-repository

  -

  name: Build and push Docker image

  id: push

  uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671

  with:

  context: .

  file: ./Dockerfile

  push: true

  tags: ${{ steps.meta.outputs.tags }}

  labels: ${{ steps.meta.outputs.labels }}

  -

  name: Generate artifact attestation

  uses: actions/attest-build-provenance@v2

  with:

  subject-name: index.docker.io/my-docker-hub-namespace/my-docker-hub-repository

  subject-digest: ${{ steps.push.outputs.digest }}

  push-to-registry: true

  https://docs.github.com/en/actions/tutorials/publish-packages/publish-docker-images

• Question 20:

  In which scenarios could the GITHUB_TOKEN be used? (Each correct answer presents a complete solution. Choose two.)

  A. to create a repository secret
  B. to add a member to an organization
  C. to read from the file system on the runner
  D. to publish to GitHub Packages
  E. to create issues in the repo
  F. to leverage a self-hosted runner
  D. to publish to GitHub Packages
  E. to create issues in the repo

  ---

  Explanation

  [D] To authenticate to a GitHub Packages registry within a GitHub Actions workflow, you can use: *-> GITHUB_TOKEN to publish packages associated with the workflow repository.

  * A personal access token (classic) with at least read:packages scope to install packages associated with other private repositories (GITHUB_TOKEN can be used if the repository is granted read access to the package.

  [E] You can use the GITHUB_TOKEN to make authenticated API calls. This example workflow creates an issue using the GitHub REST API:

  name: Create issue on commit

  on: [ push ]

  jobs:

  create_issue:

  runs-on: ubuntu-latest

  permissions:

  issues: write

  steps:

  -name: Create issue using REST API

  run: |

  curl --request POST \

  --url https://api.github.com/repos/${{ github.repository }}/issues \

  --header 'authorization: Bearer ${{ secrets.GITHUB_TOKEN }}' \

  --header 'content-type: application/json' \

  --data '{

  "title": "Automated issue for commit: ${{ github.sha }}", "body": "This issue was automatically created by the GitHub Action workflow **${{ github.workflow }}**. \n\n The commit hash was: _${{ github.sha }}_." }' \ --fail

  Incorrect:

  [Not A] The secrets API requires the secrets permission, which is not available in an Actions workflow via

  the GITHUB_TOKEN.

  [Not B] The token cannot be given organization-scoped permissions. The scope is relatively limited.

  https://docs.github.com/en/packages/learn-github-packages/introduction-to-github-packages

  https://docs.github.com/en/actions/tutorials/authenticate-with-github_token