GitHub Actions (GH-200) - Practice Exam 1

1. A build job computes a package version. A separate publish job needs that version on another runner. Which two steps establish the supported output chain? Select 2.
2. A caller workflow grants its GITHUB_TOKEN contents: read. A nested reusable workflow tries to grant itself contents: write. What should the platform team expect?
3. A cloud deployment should replace a stored long-lived cloud key with GitHub Actions OIDC federation. Which two controls are essential to the intended design? Select 2.
4. A company autoscaling platform should create a clean self-hosted runner for one job and dispose of it afterward. Which runner registration mode best matches that lifecycle?
5. A compatibility test matrix has os: [ubuntu-latest, windows-latest] and node: [22, 24]. Node 22 must not run on Windows. Which change removes only that combination?
6. A composite action computes a digest in a step with id: hash. A consumer needs steps.scan.outputs.digest after using the action with id: scan. Which two configurations expose the value correctly? Select 2.
7. A composite action declares an input named target. A shell step inside it reads INPUT_TARGET but receives an empty value. Which change correctly supplies the declared input to that step?
8. A composite action ships scripts/check.sh in its own repository. A consumer invokes the action after checking out an unrelated application repository. Which base path should the action use to locate its bundled script?
9. A container action works on ubuntu runners. A team changes runs-on to windows-latest and the action no longer runs. What requirement should they check?
10. A custom action needs Python and several native Linux packages in a controlled userspace. The author wants its dependencies packaged with the action instead of installed separately by every consumer workflow. Which implementation is the best match?
11. A custom JavaScript action uses @actions/core. It reads a required configuration input and should fail clearly when the caller omits it. Which implementation best enforces that contract?
12. A deployment must reach an internal endpoint through a controlled network path. Standard GitHub-hosted runner addresses change, and the organization does not want a very broad IP allow list. Which architecture is most suitable?
13. A deployment run fails before the application build starts. The checkout step is green, but the dependency-install step is red. Which investigation most directly identifies the immediate cause?
14. A Docker container action declares an input named package_name. Its entrypoint expects the value as the first positional argument. Which metadata is needed in addition to the input declaration?
15. A first-time external contributor opens a pull request against a public repository. The workflow shows that approval is required and no runner has started a job. What should a maintainer investigate first?
16. A JavaScript action catches a deployment API error, prints console.error, and returns normally. The workflow step is still green. Which change correctly reports failure to GitHub Actions?
17. A job started failing after the software image behind ubuntu-latest changed. The workflow assumed that a particular tool version was preinstalled. Which two actions improve reproducibility? Select 2.
18. A Linux build job has many steps. One step calculates BUILD_DIR and wants later steps in that same job to receive it as an environment variable. Which command pattern is appropriate?
19. A maintainer disabled a noisy workflow through the Actions interface. After correcting its YAML, ordinary pushes still do not start it. What is the most relevant administrative check?
20. A maintainer wants predictable updates for consumers of a custom action: immutable full-SHA references for strict consumers and an intentionally moving major-version reference for consumers accepting compatible updates. What release approach supports both?
21. A manually started deployment workflow accepts dry_run as a workflow_dispatch input of type boolean. A job should execute only when the operator selected true. Which expression directly uses the typed input?
22. A Node.js project uses setup-node dependency caching. CI fails before npm ci because the configured cache-dependency-path points at a lockfile that does not exist in the checked-out revision. What is the appropriate first correction?
23. A platform team runs its self-hosted Actions infrastructure on Kubernetes and wants a supported foundation for runner scale sets and autoscaling. Which project is the appropriate starting point?
24. A private repository hosts a reusable workflow for selected application repositories. A caller receives a not-found or access error even though the owner and file path are correct. Which two settings should be checked? Select 2.
25. A public repository caches a directory containing a private registry credential alongside downloaded dependencies. The team believes a hard-to-guess cache key prevents exposure. What is the correct assessment?
26. A pull_request_target workflow has access to a write-capable token and repository secrets. It checks out the external contributor head commit and executes its install script. What is the central security issue?
27. A read-only monitoring integration needs to list recent Actions runs for one repository through the REST API. Which token-permission approach follows least privilege?
28. A release job should publish only after both lint and test complete successfully. The three jobs are currently independent. What is the smallest appropriate change?
29. A release process adds artifact attestations. Which two statements correctly describe their value and necessary use? Select 2.
30. A release workflow has an unprivileged build job and a deployment job referencing an environment with required reviewers. Deployment credentials are stored as environment secrets. What does this design provide?
31. A report job should run after a failed test job so that it can publish diagnostic information, but the final deployment must still require successful tests. Where should the status override be applied?
32. A repository stores a React application in app/ and internal documentation in docs/. CI should run for pull requests targeting main only when an app/ file changes. Which configuration meets both conditions?
33. A required pull-request workflow has paths: ["src/**"]. A pull request changes only docs/readme.md, and the required check remains pending. What best explains this result?
34. A reusable workflow exposes a result calculated by a step in its package job. A caller needs the result as an output of the reusable-workflow job. Which mapping chain is required?
35. A reusable workflow succeeds, but its caller receives an empty result output. The producing step wrote the value to GITHUB_OUTPUT, and the called job has a job output. Which missing configuration should be checked next?
36. A scheduled maintenance workflow should run at 02:30 UTC on weekdays. The schedule is committed only on a feature branch. Why is no scheduled run created for that branch?
37. A security team approved a specific revision of a third-party action. The publisher later moves its v3 tag to new code that has not been reviewed. Which reference best preserves the approved implementation?
38. A self-hosted runner was used by an untrusted build and still contains modified tools and workspace files. The next job deploys a sensitive application. Which platform change most directly reduces this cross-job risk?
39. A team is spending excessive runner time on jobs that wait indefinitely for a failed external service. Which workflow control directly bounds each affected job execution time?
40. A team needs a reusable deployment workflow with a required string input named environment_name. Which declaration and call correctly establish a typed interface?
41. A team packages a custom JavaScript action. The repository contains src/index.js and node_modules locally, but the released revision contains neither the dependencies nor a bundled distributable. Consumers see Cannot find module. What is the most reliable packaging correction?
42. A team wants faster builds while preserving dependency reproducibility. Which caching strategy best balances the two goals?
43. A workflow contains a 12-job matrix. Eleven jobs succeeded and one failed because a package registry was temporarily unavailable. An authorized maintainer wants to retry the failed work while preserving the original revision. What should they do?
44. A workflow inserts a pull request title directly into a run script using ${{ github.event.pull_request.title }}. An attacker controls the title. Which correction best reduces script-injection risk?
45. A workflow log redacts an API token, but a later script encodes that token and prints the encoded value. Why is this still a security problem?
46. A workflow on pull_request has branches: [release]. A pull request from feature/payments to main does not run. The author says the source branch should satisfy the filter. Which interpretation is correct?
47. A workflow receives a JSON array of deployment regions as the string output of a preparation job. A later matrix should create one job for each region. Which expression turns that output into matrix data?
48. A workflow uploads an audit report as an artifact. Repository policy permits at most 30 days of retention, while the workflow requests retention-days: 90. What is the appropriate correction?
49. A workflow uses a PostgreSQL service container and runs the test job directly on an ubuntu runner, not inside a job container. The service maps 5432:5432. How should the test process connect?
50. An enterprise permits only a reviewed set of third-party actions. A repository administrator wants to permit a different unreviewed action locally. Which policy relationship applies?
51. An internal JavaScript action is maintained in a private repository. Approved consumer repositories in the same organization should use it while the implementation remains private. Which two facts are relevant? Select 2.
52. An organization defines configuration variable DEPLOY_REGION as us-east-1. A repository defines the same configuration variable as eu-west-1. With no deployment-environment override, which value does vars.DEPLOY_REGION use in a workflow from that repository?
53. An organization has a runner group named production and runners labeled self-hosted, linux, and deploy. A deployment job must use an allowed runner in that group that has all three labels. Which selection is correct?
54. An organization publishes a standard CI workflow template. A repository creates its own workflow from that template. Later, the organization fixes the template. Why does the existing repository workflow still contain the old commands?
55. An organization secret named DEPLOY_KEY is configured for selected repositories, but a newly onboarded repository receives an empty value. The secret name is spelled correctly. What should an administrator check first?
56. An organization wants teams to discover a starter workflow in the GitHub Actions new-workflow interface. Which files belong in the organization .github repository?
57. Each feature branch deploys a preview environment. A new commit should cancel an older preview deployment for the same branch without cancelling deployments for other branches. Which concurrency configuration is most appropriate?
58. Only a trusted release job needs to publish a package. Other jobs should keep read-only repository access. Which two permission decisions meet that requirement? Select 2.
59. The build job creates dist/app.zip successfully. A deploy job on a different GitHub-hosted runner cannot find that file. Which correction is appropriate?
60. Two steps write human-readable test statistics that should appear on the workflow run summary page. Which destination should they use?

Comments — 0