Microsoft GH-200 Exam Questions Instant Access

Question 1

As a developer, what options should you recommend to implement standards for automation reuse? (Choose two.)

ACreate workflow templates and store them in the organization's .github repository.

BCreate reusable actions and workflows that can be called from other workflows.

CCreate a marketplace partition to publish reusable automation for the company.

DStore shared corporate actions in subfolders in a defined and documented internally accessible repository.

Answer : A, B

Creating workflow templates in the organization's .github repository allows the organization to standardize workflows and make them easily reusable across multiple repositories. This ensures consistency and simplifies maintenance.

Creating reusable actions and workflows that can be called from other workflows helps modularize and standardize automation tasks. These reusable components can be maintained centrally and called from different workflows across repositories.

Question 2

Which statement accurately describes using labels to route GitHub Actions workflows to runners?

AA user can assign multiple labels to a self-hosted runner and use the labels in a runs-on to target only runners that match all the specified labels.

BLabels apply only to GitHub-hosted runners and are ignored by self-hosted runners.

CGitHub Actions automatically assigns the runner's IP address as a label, and the label must be used in a runs-on.

DTo target a specific runner, the runs-on must match the runner's hostname rather than its labels.

Answer : A

Self-hosted runners can have default labels and custom labels. These labels are used in the runs-on field to route workflow jobs to runners that match the required criteria. When multiple labels are specified, the runner must match all listed labels before GitHub Actions can assign the job to that runner. Therefore, option A is correct. Option B is false because labels are especially important for self-hosted runners. Option C is incorrect because GitHub does not require the runner IP address as a routing label. Option D is also incorrect because workflows target runners by labels or runner groups, not by hostname. This topic validates runner selection, self-hosted runner configuration, and workflow job routing.

================

Question 3

As a DevOps engineer, you need to execute a deployment to different environments like development and testing based on the labels added to a pull request. The deployment should use the releases branch and trigger only when there is a change in the files under apps folder. Which code block should be used to define the deployment workflow trigger?

Aon:pull_request_label:branches:- 'releases'paths:- 'apps/**'

Bon:pull_request_review:types: [labeled]branches:- 'releases'paths:- 'apps/**'

Con:pull_request:types: [labeled]branches:- 'releases/**'paths:- 'apps'

Don:pull_request:types: [labeled]branches:- 'releases'paths:- 'apps/**'

Answer : D

The correct trigger must use the pull_request event because the workflow is based on activity on a pull request. The specific activity is a label being added, so types: [labeled] is required. The deployment must target the releases branch, so the branch filter must be branches: - 'releases'. The workflow must also run only when files under the apps folder change, so paths: - 'apps/**' is the correct recursive path filter. Option A is invalid because pull_request_label is not a GitHub Actions event. Option B uses the wrong event, pull_request_review. Option C uses an incorrect branch/path combination. GitHub workflow syntax supports event activity types, branch filters, and path filters together.

Question 4

What is the most secure way to store sensitive information in GitHub Actions workflows?

AUse environment variables in the workflow and store sensitive data directly in the variables.

BFrom the GitHub repository settings, store sensitive data as unencrypted text.

CStore the sensitive information as plain text in the workflow YAML file.

DUse GitHub Enterprise Managed User (OIDC) integration to dynamically fetch secrets from a third-party secrets manager.

Answer : D

The most secure option listed is to use OIDC-based integration to obtain short-lived credentials from an external secrets manager or cloud provider. This avoids storing long-lived sensitive values directly in workflow YAML, repository text, or regular environment variables. Options A, B, and C are insecure because they expose or persist sensitive information in places that can be read, logged, committed, or mismanaged. With OIDC, the workflow requests a token from GitHub's OIDC provider and exchanges it with the trusted external provider for a short-lived credential. This reduces secret sprawl and supports stronger authorization controls. GitHub documents OIDC as a way to avoid duplicating long-lived cloud credentials as GitHub secrets and to use short-lived access tokens instead.

Question 5

As a developer, you need to add the correct syntax to allow the following workflow file to be triggered by multiple types of events.

Which two code blocks should you add starting at line 5? Each correct answer presents a complete solution.

NOTE: Each correct answer is worth one point.

4 name: Node CI/CD

8 jobs:

9 build:

10 runs-on:

11 steps:

12 - uses: actions/checkout@v2

13 - uses: actions/setup-node@v1

14 with:

15 node-version: 12

16 - run: npm ci

17 - run: npm test

Aon:env:- 'prod'- 'qa'- 'test'

Bon: [push, commit]

Con: [push, pull_request]

Don:branches:- 'main'- 'dev'

Eon:push:branches:- mainrelease:types:- created

Fon:schedule:- cron: '*/15 * * * *'initiate:- 'main'

Answer : C, E

A workflow can be triggered by multiple events either by using array syntax, such as on: [push, pull_request], or by configuring each event separately when filters or activity types are needed. Option C is valid because both push and pull_request are supported workflow events. Option E is also valid because it configures two event triggers: push filtered to the main branch and release filtered to the created activity type. Option B is invalid because commit is not a GitHub Actions workflow event. Option A wrongly puts environments under on. Option D defines branch filters without an event. Option F uses initiate, which is not a valid event. GitHub documents both multiple-event array syntax and separate event configuration for filters.

Question 6

What is the simplest action type to run a shell script?

ADocker container action

BComposite action

CBash script action

DJavaScript action

Answer : B

The simplest official GitHub Actions action type for running shell commands or shell scripts is a composite action. Composite actions allow an action author to combine one or more run steps and reusable workflow commands in an action.yml file without needing to package a Docker image or write a JavaScript action. Option B is correct because it directly supports shell-based automation. Option A is heavier because Docker container actions require a container image or Dockerfile. Option D is used when the action logic is written in JavaScript and executed with Node.js. Option C is incorrect because ''Bash script action'' is not an official GitHub Actions action type. This topic checks custom action types and reuse patterns.

Question 7

Which choices represent best practices for publishing actions so that they can be consumed reliably? (Choose two.)

Arepo name

Btag

Ccommit SHA

Dorganization name

Edefault branch

Answer : B, C

Using a tag is a best practice because tags are immutable and represent a fixed version of your action. By referencing tags, consumers of your action can be assured they are using a stable and specific version of the action, which helps in avoiding issues with breaking changes.

The commit SHA is another reliable way to specify a particular version of an action. By referencing a specific commit SHA, consumers can ensure they are using exactly the code that was written at that moment, avoiding the potential for changes in the future.

Microsoft GitHub Actions GH-200 Exam Questions