Contributed Questions

Info

This page contains all the questions that were contributed by the community when studying for the exam.

  1. What are the possible GitHub account types? (Select three.)
  2. Which of these GitHub features serves the purpose of an adaptable spreadsheet, task board and a roadmap that integrates with issues and pull requests on GitHub to plan and track your work effectively?
  3. How does the synchronization between GitHub projects, issues and pull requests work?
  4. Which of these is true regarding custom fields for items in GitHub Projects?
  5. What are the different available options for adding issues and pull requests to a GitHub Project board?
  6. Which of these layouts are available in GitHub Projects? (Choose three.)
  7. Which GitHub Project layout would best serve as a Kanban board?
  8. Which of these workflows are built-in automations in GitHub Projects? (Choose two.)
  9. What are the different options that allow you to automate operations in your GitHub Project? (Choose three.)
  10. What is the difference between GitHub projects and GitHub projects classic?
  11. What are the use cases for labels?
  12. Why would a repository owner want to use milestones? (Choose two.)
  13. How can you assign a person to an issue or pull request?
  14. If you face yourself often writing the same set of comments on issues or pull requests, what GitHub feature would you use to save time?
  15. Which of these statements about `saved replies` are true? (Choose two.)
  16. What are some actions you can do in regards to Repository Templates? (Choose two.)
  17. Which feature in GitHub Projects enables you to effortlessly generate graphs and charts for visualizing the current status and historical progression of your project?
  18. What is the name of GitHub's continuous integration and continuous delivery (CI/CD) platform?
  19. Which of these is a common use case for GitHub Actions?
  20. GitHub Action workflows are triggered by events. Which of these are valid events that GitHub Actions support? (Choose two.)
  21. Where can you find publicly available GitHub Actions?
  22. Which of these tools serves as an AI pair programmer that offers autocomplete-style suggestions as you code?
  23. Is GitHub Copilot free to use?
  24. What are the differences between GitHub Copilot Individual and GitHub Copilot Business?
  25. How can you start using GitHub Copilot after activating the GitHub Copilot subscription?
  26. What is a GitHub Codespace?
  27. What GitHub feature allows the creation of preconfigured development environments where all necessary tools and dependencies to contribute to a repository are installed?
  28. What GitHub features allow repository contributors to work on simple code changes directly through the web browser? (Choose two.)
  29. What are the different possible lifecycle phases for a GitHub Codespace?
  30. If you stop your GitHub Codespace environment can you come back to the changes later if you haven't committed them?
  31. Which of these statements regarding GitHub Codespaces lifecycle are true? (Choose three.)
  32. Your project requires appropriate hardware to run. Can you customize the amount of CPU cores that will be allocated to your GitHub Codespace environment?
  33. How can you customize the environment that is run in GitHub Codespaces?
  34. What is a GitHub Codespace deep link?
  35. Who should have 2 Factor Authentication enabled on GitHub?
  36. What are Enterprise Managed Users?
  37. What are the different permission levels for a repository owned by a personal account? (Choose two.)
  38. Which of these is NOT a role in a GitHub Organization?
  39. Can you disable the issues tab on a repository?
  40. Where can you disable repository features such as issues, wikis or projects on a repository that you own?
  41. What are the different repository visibility options?
  42. What is the purpose of a `CODEOWNERS` file?
  43. How can you enforce status checks passing before merging a pull request to the `main` branch?
  44. Which of these actions will make sure that prior to any push to the `main` branch, the changes have been approved by at least two people? (Choose three.)
  45. What can you find in the security tab of a repository?
  46. What is CodeQL?
  47. Which tool helps you keep the repository dependencies up to date?
  48. What are Repository Insights?
  49. Who are repository collaborators?
  50. How can you work together with a friend of yours on a repository that you have created on your personal GitHub account?
  51. What are GitHub teams?
  52. What is the role of an organization moderator?
  53. What is the role of an organization security manager?
  54. Which of these definitions best describes open source software?
  55. What is the GitHub Sponsors program?
  56. On your personal GitHub dashboard you received a notification that user `octocat` has created a new repository `octocat/my-repo`. Why did you receive that notification?
  57. What are the effects of you following a user on GitHub?
  58. What is the GitHub Marketplace?
  59. What is InnerSource?
  60. Which of these is a practice that encourages collaboration, visibility and sharing of code among different teams within an organization?
  61. What is a fork in GitHub?
  62. Which of these can make a repository more discoverable? (Choose three.)
  63. How can you define guiding protocols for users intending to submit bug reports or propose new features in your repository so they know what information to fill-in?
  64. What is a pull request template?
  65. Which of these statements best describes a version control system?
  66. What is the meaning of the word `distributed` in distributed version control system?
  67. Which of these best describes git?
  68. Which of these statements best describes what GitHub is?
  69. What is the relation between Git and GitHub?
  70. What is a repository in GitHub?
  71. What is a git commit?
  72. Which git feature allows developers to concurrently work on the same codebase without causing conflicts with each other?
  73. What is the GitHub Flow?
  74. What is a GitHub Pro plan?
  75. Is there a free version of GitHub for organizations?
  76. What are the different GitHub pricing plans for organization accounts? (Select three.)
  77. Which GitHub pricing plan offers self-hosted deployment of GitHub?
  78. Under which GitHub pricing plan can you create an unlimited number of public repositories?
  79. What are the different deployment options for GitHub Enterprise? (Select two.)
  80. Which of these statements about GitHub Enterprise deployment options are true? (Select two.)
  81. What are pinned repositories on GitHub?
  82. Which of these files can customize your GitHub profile?
  83. What language is used to write comments on GitHub issues and pull requests?
  84. What are GitHub's slash commands?
  85. How does GitHub help people that want to write proper issue and pull request comments but don't know Markdown syntax?
  86. What is GitHub Desktop?
  87. What is GitHub Mobile?
  88. How can you link a pull request to an issue? (Choose two.)
  89. What improvement do issue forms bring over issue templates?
  90. Which of these is a repository feature that is used as a community forum to have conversations, ask questions, post announcements and share ideas?
  91. What is the effect of adding a line `Closes #11` to the pull request's description?
  92. In GitHub a proposal to merge a set of changes from one branch into another branch is called a:
  93. You want to merge changes from branch `feature-a` into `main` and you are creating a pull request. Which branch should be the `base` branch and which branch should be the `compare` branch?
  94. What are draft pull requests?
  95. What are the possible statuses for a pull request review? (Choose three.)
  96. Which of these statements about the differences of issues and discussions is true?
  97. Which of the GitHub features best serves as a simple way to share small code snippets with others?
  98. What are GitHub Wikis?
  99. What are the two available options when you no longer need to use a Project?
  100. Can you change a gist from public to secret after creating it?
  101. What happens when you choose to close a Project?
  102. If there are multiple Readme.md files in a GitHub repository, what is the priority order to show them?
  103. Which of the following Git commands allow you to create a new branch and start working on it in one line? (Select two.)
  104. If a GitHub Discussion is converted into an Issue and the issue is closed or referred to using its corresponding # number, will the discussion be modified?
  105. Which information can be found in the Pulse section in the Insights tab of a repository? (Choose four)
  106. What are the different levels of GitHub organizational hierarchy? (Choose three.)
  107. Who can setup billing or assign billing managers for an organization? (Select three.)
  108. What is one of the main benefits for using a Personal Access Token (PAT) instead of a standard username and password for GitHub authentication?
  109. What are the different forms of two-factor or multi-factor authentication supported by GitHub? (Choose five.)
  110. What are the different GitHub pricing plans for personal accounts? (Select two)
  111. What is/are the common GitHub pricing plan(s) for both personal and organization accounts?
  112. What syntax is used in GitHub Markdown to create a task list?
  113. Which Markdown element is not correctly paired with its syntax?
  114. What feature is unique to GitHub Desktop compared to github.com?
  115. Which of the following actions cannot be performed directly from GitHub Desktop?
  116. What are some actions you can do in regards to Project Templates in your organization? (Choose three.)
  1. Which statement is correct regarding passing permissions to reusable workflows?
  2. What are the different permission levels you can assign to `GITHUB_TOKEN` in the `permissions` block?
  3. You can use `permissions` to modify the `GITHUB_TOKEN` permissions on: (Select two.)
  4. Are GitHub Actions free for public repositories?
  5. Which of these is not a valid event that could trigger a workflow?
  6. Which is true about workflows? (Select three.)
  7. Which components are required for a workflow? (Select two.)
  8. Which event is triggered by a webhook action from outside of the repository?
  9. Workflows are defined in which format
  10. Where should you store sensitive data such as passwords or certificates that will be used in workflows
  11. In a workflow with multiple jobs the default behavior is:
  12. If job B requires job A to be finished you have to:
  13. In a workflow with multiple jobs, if job A fails then:
  14. This code will launch 6 different jobs in parallel using the matrix strategy. Can you use the matrix strategy to parallelize entire workflows?
  15. Which matrix job definition is syntactically correct?
  16. How do you access matrix variables in a matrix strategy job?
  17. When using the `pull_request` and `pull_request_target` events, how do you configure the workflow to run only when targeting the `prod` branch?
  18. This workflow will run on all pull requests where:
  19. Fill in the blank: When using `push` event trigger filters you can use <____> patterns to target multiple branches
  20. Which event allows you to manually trigger a workflow from the GitHub UI?
  21. What are the possible types of an input variable for a manually triggered workflow? (Select five.)
  22. A workflow that has only `workflow_dispatch` event trigger can be triggered using GitHub's REST API
  23. To stop a workflow from running temporarily without modifying the source code you should
  24. What are `activity types` of an event used for ?
  25. You want to create a reusable workflow `CI` that runs some quality checks, linting and tests on code changes. What event trigger should the `CI` workflow define to allow reusing it in other workflows?
  26. A reusable workflow named `build` creates zip file artifacts. How do you pass the zip file location to the caller workflow that is calling the `build` workflow? (Select three.)
  27. What are the valid use cases for using **defaults**? (Select two.)
  28. How can you ensure that a workflow called `Deploy Prod` is always running at most one at a time?
  29. Your Pull Request analysis workflow uses multiple code analysis tools and takes about 20minutes to fully complete. It is triggered on `pull_request` event with `branches` filter set to `master`. Therefore if a developer pushes multiple commits within few minutes multiple workflows are running in parallel. How can you stop all previous workflow runs and only run the one with latest changes?
  30. When will job3 run?
  31. What `jobs.job_id.if` conditional will make sure that job `production-deploy` is triggered only on `my-org/my-repo` repository? (Select two.)
  32. What GitHub-hosted runner types are available to use? (Select three.)
  33. Is this statement true? `Not all steps run actions, but all actions run as a step`
  34. For any action published in GitHub Marketplace, you can often use it in multiple versions, which approach is the most stable and secure?
  35. To prevent a job from failure when one of the steps fails you can include:
  36. You defined a matrix job `example_matrix`. How can limit the matrix to run a maximum of 2 jobs at a time?
  37. Which of these is a proper way of setting an output parameter `PET` with a value of `DOG` in a `step`.
  38. Which of these is a way of using `action_state` in `step_two`?
  39. Is this statement true? `Workflows can be reused, but a reusable workflow cannot call another reusable workflow.`
  40. In the following example, `workflow A` passes all of its secrets to `workflow B`, by using the inherit keyword. Then `workflow B` calls `workflow C`. Which statement regarding `secrets` is true for that example?
  41. When should you use `caching`?
  42. When should you use `artifacts`? (Select two.)
  43. If a workflow runs on a `feature-a` branch, can it restore `caches` created in the default `main` branch?
  44. To access an `artifact` that was created in another, previously triggered workflow run you can:
  45. What should you use to store coverage reports or screenshots generated during a workflow that runs automated testing for a repository?
  46. You can only upload a single file at a time when using `actions/upload-artifact` action
  47. In job `deploy`, if you want to access binaries (containing your application) that were created in job `build` you should
  48. A job called `job2` is using artifacts created in `job1`. Therefore it's important to make sure `job1` finishes before `job2` starts looking for the artifacts. How should you create that dependency?
  49. Which is true about `Starter Workflows` ? (Select three.)
  50. Secrets and configuration variables can be scoped to: (Select three.)
  51. What are the three types of Actions?
  52. Is this statement true? `Docker container actions are usually slower than JavaScript actions`
  53. When creating a custom GitHub Action you have to store the source code in `.github/workflows` directory
  54. When creating custom GitHub Actions - in what file does all the action `metadata` have to be defined?
  55. A workflow was initially run on `commit A` and failed. You fixed the workflow with the subsequent `commit B`. When you re-run that workflow it will run with code from which commit?
  56. How can you require manual approvals by a maintainer if the workflow run is targeting the `production` environment?
  57. Which is true about environments?
  58. When using GitHub Actions to access resources in one of the cloud providers (such as AWS, Azure or GCP) the safest and recommended way to authenticate is
  59. Your open-source publicly available repository contains a workflow with a `pull_request` event trigger. How can you require approvals for workflow runs triggered from forks of your repository?
  60. Which of the following default environment variables contains the name of the person or app that initiated the workflow run?
  61. Which of the following are default environment variables in GitHub Actions? (Select three.)
  62. Your organization defines a secret `SomeSecret`, however when you reference that secret in a workflow using `${{ secrets.SomeSecret }}` it provides a different value than expected. What may be the reason for that?
  63. Which is a correct way to print a debug message?
  64. How can organizations which are using GitHub Enterprise Server enable automatic syncing of third party GitHub Actions hosted on GitHub.com to their GitHub Enterprise Server instance?
  65. Where can you find network connectivity logs for a GitHub self-hosted-runner?
  66. How can you validate that your GitHub self-hosted-runner can access all required GitHub services?
  67. Which is the correct way of triggering a job only if configuration variable `MY_VAR` has the value of `MY_VALUE`?
  68. To run a `step` only if the secret `MY_SECRET` has been set, you can:
  69. How can you use the GitHub API to download workflow run logs?
  70. How can you use the GitHub API to create or update a repository secret?
  71. How can you override an organization-level GitHub Secret `API_KEY` with a different value when working within a repository? (Select two.)
  72. What components can be reused within a GitHub Organization? (Select four.)
  73. How many jobs will be executed in the following workflow?
  74. Which of the following default environment variables contains the full name (e.g `octocat/hello-world`) of the repository where the workflow is running?
  75. In a workflow that has multiple jobs, all running on GitHub-hosted runners, is it true that all jobs are guaranteed to run on the same runner machine?
  76. What's the maximum amount of reusable workflows that can be called from a single workflow file?
  77. What is a self-hosted runner?
  78. Which of the following is a correct statement about GitHub Workflows and Actions?
  79. On which commit and branch do scheduled workflows run in GitHub Actions?
  80. What is the correct syntax for setting the directory for all `run` commands in a workflow?
  81. How can you reuse a defined workflow in multiple repositories? (Choose two.)
  82. How can you ensure a job runs only on a specific branch?
  83. What does the `needs` keyword do in a GitHub Actions workflow?
  84. Which keyword allows you to define environment variables in a GitHub Actions workflow?
  85. What is the purpose of the `with` keyword in a GitHub Actions workflow?
  86. Which of the following GitHub Actions syntax is used to run multiple commands in a single step?
  87. How can you cache dependencies to speed up workflow execution?
  88. What does the `matrix` keyword do in a GitHub Actions workflow?
  89. Which of the following can be used to limit the number of concurrent jobs running in a GitHub Actions workflow?
  90. What is the default timeout for a GitHub Actions job?
  91. How can you specify the operating system for a job in GitHub Actions?
  92. In a GitHub Actions workflow, how do you specify a specific version of Node.js to use in a job?
  93. How do you reference a secret stored in GitHub Secrets in a workflow?
  94. What is the default shell used by GitHub Actions on Windows runners?
  95. Which of the following statements are true about adding a self-hosted runner in GitHub Actions? (Choose three.)
  96. Select the default environment variable that contains the operating system of the runner executing the job
  97. How does the `actions/cache` action in GitHub Actions handle a cache miss?
  98. How can you specify the schedule of a GitHub actions workflow to run on weekdays only?
  99. What is the recommended approach for storing secrets larger than 48 KB?
  100. Select status check functions in GitHub Actions
  101. How do you ensure that `Upload Failure test report` step is executed only if `Run Tests` step fails?
  102. Which context holds information about the event that triggered a workflow run?
  103. In GitHub Actions, if you define both branches and paths filter, what is the effect on the workflow execution?
  104. What is the recommended practice for treating environment variables in GitHub Actions, regardless of the operating system and shell used?
  105. Which of the following statements accurately describes the behavior of workflow jobs referencing an environment's protection rules?
  106. What is the purpose of the `restore-keys` parameter in `actions/cache` in GitHub Actions?
  107. Which variable would you set to `true` in order to enable step debug logging?
  108. Which configuration is appropriate for triggering a workflow to run on webhook events related to check_run actions?
  109. What is the purpose of the `timeout-minutes` keyword in a step?
  110. Dave is creating a templated workflow for his organization. Where must Dave store the workflow files and associated metadata files for the templated workflow?
  111. Dave wants to be notified when a comment is created on an issue within a GitHub repository. Which event trigger should be used within the workflow configuration?
  112. What level of access is required on a GitHub repository in order to delete log files from workflow runs?
  113. What is true about the following workflow configuration if triggered against the `octo/my-dev-repo` repository?
  114. How can you access the current values of variables in a matrix within a job in the example below:
  115. What level of permission is required to re-run the workflows
  116. When can you delete workflow runs? (select two)
  117. Who can bypass configured deployment protection rules to force deployment (by default)
  118. How can you skip the following workflow run when you commit or create a PR?
  119. How can you determine if an action is a container action by looking at its action.yml file?
  120. What is the correct syntax for specifying a cleanup script in a container action?
  121. What’s true about default variables? (choose three)
  122. What are the scopes defined for custom variables in a workflow? (choose three)
  1. As a GitHub Organization administrator, you want users to authenticate using a corporate identity provider. Which of the following is a way to achieve this?
  2. What is the GitHub dependency graph?
  3. Which is the minimum level of support that provides help with installing and using Advanced Security?
  4. Which of the following issues can GitHub Support help resolve? (Choose four.)
  5. Which of the following are correct methods to generate and share a diagnostic file for GitHub Enterprise Server? (Choose two.)
  6. Which of the following is the correct procedure for generating a support bundle in GitHub Enterprise Server? (Choose two.)
  7. Which endpoints does the GitHub API provide to administer your enterprise? (Choose six.)
  8. What are the steps to install a GitHub App from GitHub Marketplace for an organization?
  9. What are the benefits and risks of using apps and actions from the GitHub Marketplace?
  10. What are the key implications of enabling SAML single sign-on (SSO) for an organization in GitHub Enterprise Cloud?
  11. What is a key difference between enabling SAML Single Sign-On (SSO) for all organizations in an enterprise account versus enabling it for a single organization in GitHub Enterprise Cloud?
  12. Which GitHub Support level provides SLA and written support in English 24/7?
  13. What are the steps to enable and enforce SAML SSO for a single organization?
  14. Which of the following identity providers (IdPs) is NOT officially supported and internally tested by GitHub Enterprise Cloud for SAML SSO?
  15. How do you require two-factor authentication (2FA) for an organization?
  16. Which identity providers (IdPs) support GitHub Enterprise Cloud SCIM API for organizations? (Choose three.)
  17. What is the primary function of Enterprise Managed Users in GitHub?
  18. How are user accounts provisioned with Enterprise Managed Users?
  19. What is required for a user to authenticate with an Enterprise Managed Users account?
  20. Which statement is true regarding usernames and profile information for Enterprise Managed Users?
  21. What are the implications of a managed user needing to contribute to resources outside of the enterprise?
  22. What is SCIM in the context of GitHub?
  23. What's the purpose of SCIM and team synchronization in GitHub?
  24. What are valid authentication methods available in GitHub? (choose six.)
  25. How does GitHub Enterprise Cloud differ from GitHub Enterprise Server?
  26. Which of the following are extra features provided by GitHub Enterprise Cloud over GitHub Free plan? (choose four.)
  27. What is the purpose of enterprise accounts in GitHub Enterprise Cloud?
  28. Which of the following is a management option exclusive to GitHub Enterprise Cloud?
  29. Which is the main restriction of Enterprise Managed User accounts in GitHub Enterprise Cloud?
  30. What is GitHub Enterprise Server primarily designed for?
  31. Which environments can GitHub Enterprise Server be deployed to?
  32. Which of the following is a key feature of GitHub Enterprise Server?
  33. How can GitHub Enterprise Server's administration be handled?
  34. What does GitHub recommend for safeguarding against data loss in GitHub Enterprise Server?
  35. What's the usage cost of GitHub Actions for public repositories?
  36. How are minutes calculated for jobs that run on different operating systems in GitHub Actions?
  37. What is the default spending limit for GitHub Actions on monthly-billed accounts?
  38. How can an organization owner find statistics on license usage for their GitHub Enterprise Server?
  39. How can an organization admin set default permissions for new members in a GitHub organization?
  40. How does team synchronization with Microsoft Entra ID (previously Azure AD) benefit GitHub Enterprise Cloud organizations?
  41. What is the primary purpose of a GitHub organization?
  42. Which role in a GitHub organization has the authority to manage access to the organization's resources?
  43. How can access management and collaboration be simplified within a GitHub organization?
  44. Which GitHub plan allows to use secret scanning in private repositories?
  45. What is the advantage of having an enterprise account on GitHub Enterprise Cloud for an organization?
  46. How can an organization enhance the security of their GitHub Actions workflows?
  47. Which of the following are recognized roles within a GitHub organization?
  48. Which role in a GitHub organization has the highest level of access?
  49. What are the default permissions of a member in a GitHub organization?
  50. What is the primary responsibility of a billing manager in a GitHub organization?
  51. How does the role of an outside collaborator differ from that of a member within a GitHub organization?
  52. How can an organization owner change the role of a member within the organization?
  53. How can you give a user the minimum required permissions necessary for accessing a specific repository within a GitHub organization?
  54. What are the key features and functionalities of teams within a GitHub organization?
  55. What distinguishes a visible team from a secret team in a GitHub organization?
  56. How do nested teams benefit an organization's structure within GitHub?
  57. What can be found on a team’s page within a GitHub organization?
  58. What is the role of a Security Manager within a GitHub organization?
  59. What permissions does a GitHub App manager have within an organization?
  60. What roles can a team member hold within a GitHub team?
  61. Which repository role in a GitHub organization is recommended for contributors who need to proactively manage issues and pull requests without having write access?
  62. What are the repository roles available in a GitHub organization? (Choose five.)
  63. What functionality does the audit log provide to organization admins within a GitHub organization?
  64. Which formats are available for exporting the audit log from a GitHub organization?
  65. How can an organization admin search the audit log for events related to webhook modifications?
  66. Why might webhooks be considered an efficient alternative to the audit log or API polling in certain use cases within GitHub organizations?
  67. Which tools can be used to remove sensitive data from a Git repository's history?
  68. What should you do before running git filter-repo or BFG Repo-Cleaner to remove sensitive data from your repository?
  69. After sensitive data is removed from a repository's history and pushed to GitHub, what is a necessary step to fully remove the data from GitHub?
  70. Which of these practices can help avoid committing sensitive data or files to a git repository?
  71. Which of these best defines GitHub Enterprise Policies?
  72. What are enterprise policies in the context of GitHub Enterprise Cloud?
  73. What steps should organization admins follow to access audit logs of actions performed within their GitHub organization?
  74. Which of the following are types of access tokens supported by GitHub? (Choose three.)
  75. What is the primary rate limit for authenticated personal users making REST API requests to GitHub API?
  76. What's the difference between GitHub Apps and OAuth apps?
  77. How can GitHub Apps react to specific events, and what are some examples of these events?
  78. How can enterprises track their usage of GitHub Actions?
  79. Who can configure IP allow lists for an enterprise on GitHub?
  80. Can organization owners manage IP allow list entries inherited from the enterprise account's allow list?
  81. Which runners must you use with GitHub Actions when an IP allow list is enabled on your enterprise?
  82. How can you ensure your self-hosted or larger hosted runners can communicate with GitHub when using an IP allow list?
  83. When an Enterprise IP allow list is in place, what happens when you try publish your GitHub Pages site from a branch instead of using a custom GitHub Actions workflow?
  84. What are some potential abuse vectors of enabling self-hosted runners on public repositories? (Choose four.)
  85. How should you select appropriate runners to support your workflow's specific workloads?
  86. How do you add a self-hosted runner to a GitHub repository?
  87. What is required to add a self-hosted runner to an organization on GitHub?
  88. How can you manage access to self-hosted runners in an organization using runner groups?
  89. What steps are involved in creating a self-hosted runner group for an organization on GitHub?
  90. How do you change which repositories can access a specific runner group in an organization?
  91. How can you use 3rd party vaults to manage secrets for GitHub Actions?
  92. Which package managers and formats are supported by GitHub Packages? (Choose five.)
  93. How can one authenticate to GitHub Packages?
  94. What is required to download or publish a GitHub Package within workflows, such as with GitHub Actions or other CI/CD tools?
  95. What are the differences and use cases between GitHub Packages and releases?
  96. By which header can you check the number of requests you have made in the current rate limit window when using the GitHub REST API?
  1. What is CodeQL?
  2. What does `shifting left` mean in the context of Security?
  3. What are Repository Security Advisories?
  4. Which tool helps you keep the repository dependencies up to date?
  5. Which of the following is a curated list of security vulnerabilities found in open source projects?
  6. Which of these GitHub security features are available for FREE for both public and private personal repositories? (Choose four.)
  7. Which of these best describes secret scanning?
  8. Which parts of the repository are scanned by secret scanning? (Choose two.)
  9. What's the purpose of the Secret scanning partner program?
  10. Public repositories owned by personal users as well as public repositories owned by organizations can use secret scanning for free.
  11. How can you prevent commits containing cloud provider credentials from being pushed to GitHub?
  12. Which of these is true about the GitHub secret scanning partner program? (Choose three.)
  13. How can you exclude certain directories or files from secret scanning?
  14. You have included some fake secrets in your test code and they have been picked up by GitHub's secret scanning. What can you do to tell GitHub that these are fake secrets used in tests and can be ignored by secret scanning? (Choose two.)
  15. You have accidentally committed your GitHub personal access token to a public repository. What actions should you take to prevent your account from being compromised?
  16. What is the behavior when a new secret pattern is added or updated in the GitHub secret scanning partner program?
  17. Who will be notified when a NEW secret is pushed and detected in a repository? (Choose five.)
  18. When GitHub runs a scan of all historical code in enterprise repositories what is the notification behavior? (Select two.)
  19. Does GitHub use the same set of secret scanning patterns for both user alerts and push protection alerts?
  20. What are the three different sets of secret scanning patterns that GitHub maintains? (Select three.)
  21. Multiple public repositories that you are contributing to do not have secret scanning push protection option enabled. What can you do to protect yourself from accidentally pushing secrets to these repositories?
  22. Your company has internal secrets that should not be pushed to GitHub repositories. The pattern of these secrets is not known by GitHub and therefore is not detected by secret scanning. What can companies do to protect their developers from accidentally pushing these secrets to repositories in their GitHub Organization?
  23. What information do Dependabot alerts provide?
  24. What is the GitHub dependency graph?
  25. Is GitHub dependency graph available for free to all repositories?
  26. How does GitHub Dependency graph know what dependencies your project is using? (Choose two.)
  27. When will the GitHub Dependency graph for your repository be updated? (Choose two.)
  28. In what format can you export the GitHub Dependency graph of your repository?
  29. Can your repository use Dependency Graph without using Dependabot Alerts?
  30. Which feature is a pre-requisite for using Dependabot Alerts on a repository?
  31. Which of these statements about Dependabot Alerts are true? (Choose three.)
  32. What are the primary benefits of the Security Overview feature in GitHub?
  33. What is CodeQL?
  34. What do Dependabot alerts indicate in GitHub?
  35. What is the purpose of code scanning in GitHub?
  36. Is secret scanning available for both public and private repositories on GitHub?
  37. What does the default CodeQL analysis setup in GitHub do?
  38. What is the main purpose of using the CodeQL CLI?
  39. Which of the following languages is NOT supported by CodeQL for code scanning?
  40. How does CodeQL analyze code in GitHub?
  41. How can CodeQL be used in an external CI system together with GitHub repositories?
  42. Which of these statements isn't true about secret scanning on GitHub?
  43. Which top-level keys are required in the `dependabot.yml` file?
  44. Which GitHub Action can be used to upload a third-party SARIF file?
  45. Which tool can be used in a third-party CI system to upload code analysis results to GitHub?
  46. What is required for a CI server to upload SARIF results to GitHub?
  47. What happens when a second SARIF results file is uploaded to GitHub for a single commit?
  48. How can users exclude specific directories from secret scanning alerts on GitHub?
  49. Which key should be used in a `secret_scanning.yml` file to exclude directories from secret scanning alerts in GitHub?
  50. What is the maximum number of custom patterns that can be defined for secret scanning on GitHub?
  51. Fill in the blank: `GitHub __________ is a feature that you can use to analyze code in a GitHub repository to find security vulnerabilities and coding errors.`
  52. Which GitHub Advanced Security feature allows you to find, triage, and prioritize fixes for new and existing problems in your code?
  53. How can you enable code scanning for a repository?
  54. How can you configure your GitHub repository to run CodeQL analysis on a schedule? (Choose two.)
  55. An organization has recently started using CodeQL analysis for all pull requests on their repositories as well as running the analysis on an hourly schedule. Since then they are experiencing larger than usual GitHub Actions bills. What is the most likely cause of this?
  56. If you don't want to use GitHub Actions, you can run code scanning in an external CI system, then upload the results to GitHub.
  57. When using a third party CI system to run code scanning, what GitHub tool do you need to analyze the codebase?
  58. When using GitHub Actions as your CI system and a third party tool to run code scanning, how can you upload the SARIF results to GitHub?
  59. Can you use CodeQL analysis with third party CI systems?
  60. Which of these is true about code scanning? (Choose two.)
  61. When using CodeQL analysis in your GitHub Actions workflow, how often is the scan triggered?
  62. What is the effect of adding the `paths-ignore` keyword to your code scanning GitHub Actions workflow?
  63. CodeQL scanning supports:
  64. What are CodeQL queries used for?
  65. What is QL?
  66. What is a CodeQL query suite?
  67. What are the different types of CodeQL packs? (Choose three.)
  68. What is a CodeQL query pack?
  69. What are the steps of CodeQL analysis workflow?
  70. What is extraction in the context of CodeQL code analysis?
  71. Which of these statements are true regarding running CodeQL analysis on codebases with multiple programming languages? (Choose two.)
  72. What are the differences when running CodeQL database creation for compiled and interpreted languages? (Choose two.)
  73. Where can you see when the last CodeQL analysis was run when using the default code scanning setup?
  74. Which of the following statements about enabling CodeQL scanning default setup are true? (Choose three.)
  75. How can you customize your advanced CodeQL scanning setup with additional CodeQL query suites? (Choose two.)
  76. When running CodeQL analysis in GitHub Actions, what Actions should you use? (Choose three.)
  77. What is the simplest method to execute CodeQL analysis concurrently for each language in a multi-language repository using GitHub Actions?
  78. How can you use a custom CodeQL configuration file in a GitHub Actions workflow?
  79. Where can you specify the CodeQL queries to run in a GitHub Actions workflow? (Choose two.)
  80. What is the purpose of the `external-repository-token` parameter in `github/codeql-action/init` GitHub Action?
  81. What CodeQL CLI command is used to create a CodeQL database?
  82. What is the purpose of the `codeql database analyze` command in CodeQL CLI?
  83. As part of your Jenkins CI pipeline you've successfully created and then analyzed a CodeQL database, therefore producing a SARIF file. How can you upload the SARIF file to GitHub? (Choose two.)
  84. What details can you find on a code scanning alert page? (Choose three.)
  85. Which of these statements regarding viewing the results of a CodeQL analysis are true? (Choose two.)
  86. When a CodeQL analysis GitHub Actions workflow detects a new vulnerability on a pull request, where can you find the information about that vulnerability?
  87. When viewing a code scanning alert what is the `Show paths` option used for?
  88. What does it mean to dismiss a code scanning alert?
  89. Which of these is NOT a valid approach one can take to reduce the time it takes for CodeQL analysis workflow to complete?
  90. What is the purpose of defining a SARIF category?
  91. How can you enable GitHub Advanced Security features on GitHub Enterprise Server? (Choose two.)
  92. How can you enable GitHub Advanced Security features for all repositories in an organization in GitHub Enterprise Cloud?
  93. As a repository maintainer where should you put instructions on how to report a security vulnerability in your codebase?
  94. What is a GitHub security policy?
  95. How can you set a default security policy for all repositories in `my-org` GitHub Organization?
  96. Which API endpoint can be used to retrieve a list of all Dependabot alerts for an enterprise?
  97. Which API endpoint can be used to retrieve a list of all secret scanning alerts for an organization?
  98. Which API endpoint can be used to retrieve a list of all code scanning alerts for a repository?
  99. Which of these statements best defines a vulnerable dependency?
  100. What are Dependabot security updates?
  101. Dependabot Alerts are enabled by default on:
  102. Who can enable Dependabot alerts on a repository?
  103. What's the lowest access level needed to see Dependabot alerts in a repository within an organization?
  104. To enable Dependabot Alerts on all repositories in an organization you should:
  105. Which of these is a valid `dependabot.yml` configuration file?
  106. Which of these is not a GitHub supported channel for receiving Dependabot alerts?
  107. What are Dependabot auto-triage rules?
  108. How can you automate dismissing low severity Dependabot alerts?
  109. To enable Dependabot security updates on all repositories in an organization you should:
  110. The tool that checks if a pull request introduces any dependencies with security vulnerabilities is called:
  111. You need GitHub Actions enabled for
  112. What does `CVSS` stand for?
  113. What does `CVE` stand for?
  114. What does `CWE` stand for?
  115. Which Dependabot comment command will get a pull request successfully completed?
  116. Jobs that run on macOS runners that GitHub hosts consume minutes at __ rate as Linux runners consume
  1. Is GitHub Copilot free to use for everyone?