Hard — GH-100 Practice Quiz

Question 1

An enterprise owner is reviewing suspicious activity where several repositories had their visibility changed to public overnight. Using the audit log, they need to determine whether these changes were performed by a human clicking in the web UI or by an automated integration acting on a user's behalf. Which audit log field or approach best allows them to distinguish programmatic (token-based) actions from interactive web sessions?

Accepted Answer

Examine the programmatic_access_type (or hashed_token / actor via token) attributes to identify whether the event originated from a PAT, OAuth app, or GitHub App rather than a browser session

Answer

Filter on the actor field, since only automated integrations populate an actor value

Answer

Sort events by the created_at timestamp, because programmatic actions always occur in tight time clusters

Answer

Check the country field in the audit log, since API calls are never geolocated while web logins always are

Question 2

Your enterprise runs security-sensitive CI/CD workflows on GitHub-hosted larger runners. The security team requires that all outbound traffic from these runners to your internal Azure resources travels over a private network without traversing the public internet, and that the runners receive IP addresses from your own Azure virtual network. As the enterprise administrator, what is the correct approach to meet this requirement?

Accepted Answer

Configure Azure private networking for GitHub-hosted runners by associating a runner group with a network settings resource that references a subnet in your Azure VNet

Answer

Add your Azure VNet's public IP ranges to the enterprise IP allow list so GitHub-hosted runners can reach internal resources

Answer

Deploy self-hosted runners as the only option, since GitHub-hosted runners cannot use private networking under any circumstances

Answer

Enable IP allow list entries for GitHub's published Actions IP ranges and route them through an Azure ExpressRoute circuit

Question 3

An enterprise uses a GitHub Enterprise Cloud with Managed Users (EMU) instance provisioned via SCIM from Azure AD (Entra ID). Two newly hired employees, both named Alex Kim, are being provisioned. The identity provider maps the SCIM userName attribute (derived from each user's email local-part 'alex.kim') to their GitHub handle. The first user provisions successfully as '@alex.kim_acme'. When the second Alex Kim is provisioned, what happens and how should the administrator ensure both users are created correctly?

Accepted Answer

The second provisioning fails or collides because managed usernames must be unique within the enterprise; the admin must ensure the IdP maps a unique SCIM userName (e.g., a distinct email/attribute) so GitHub generates a distinct normalized handle.

Answer

GitHub silently merges both identities into the single '@alex.kim_acme' account since they share the same display name, and no admin action is needed.

Answer

The second user is created automatically as '@alex.kim2_acme' with no configuration change required, because GitHub auto-increments any duplicate managed usernames.

Answer

Provisioning succeeds because managed usernames only need to be unique per organization, not per enterprise, so both can coexist in different orgs.

Question 4

Your company runs a GitHub Enterprise Cloud account with Enterprise Managed Users (EMU) tied to Microsoft Entra ID. The security team wants to enforce Conditional Access policies (device compliance, sign-in risk) that are evaluated by Entra ID on every authentication to GitHub, without requiring an on-premises component to relay authentication state. Which identity federation protocol should you configure for the EMU enterprise to meet this requirement?

Accepted Answer

OIDC (OpenID Connect) federation with Entra ID

Answer

SAML SSO with Entra ID as the SAML IdP

Answer

LDAP synchronization against Entra Domain Services

Answer

SCIM provisioning with a personal access token fallback

Question 5

At Contoso, an enterprise account contains 12 organizations on GitHub Enterprise Cloud. Priya is an enterprise owner but is NOT a member or owner of the 'payments-team' organization. A developer asks Priya to directly add a specific outside collaborator to a private repository inside the 'payments-team' organization. Without changing her own membership, what can Priya do based on the GitHub authorization model?

Accepted Answer

She cannot manage repository-level access in that organization until she joins it as a member or is made an organization owner; enterprise owners manage policies, not individual repo collaborators by default.

Answer

As an enterprise owner she automatically has owner permissions on every organization, so she can add the collaborator to the repository directly right now.

Answer

She must first convert the repository to internal visibility, after which enterprise owners gain the ability to add collaborators enterprise-wide.

Answer

She can add the collaborator only by creating an enterprise team and assigning it to the repository, because enterprise teams override organization membership.

Question 6

You administer a GitHub Enterprise Cloud organization that must comply with a new supply-chain integrity policy. Auditors require that every commit merged into the default branch of all repositories be cryptographically verifiable, and that release tags matching 'v*' cannot be deleted or overwritten by anyone except a small release-engineering group. You want to enforce this consistently across all current and future repositories with the least ongoing maintenance. Which approach best meets these requirements?

Accepted Answer

Create an organization-level repository ruleset targeting all repositories with a branch rule requiring signed commits on the default branch and a tag rule for 'v*' that restricts updates/deletions, granting the release-engineering team a bypass

Answer

Enable classic branch protection on the default branch of each repository and manually check the 'Require signed commits' box, then ask developers not to delete release tags

Answer

Configure a required GitHub Actions workflow that verifies commit signatures on pull requests and fails the check if any tag is force-pushed

Answer

Turn on the organization setting to require two-factor authentication and rely on Dependabot to flag any unsigned or tampered commits

Question 7

An enterprise owner wants every repository across all organizations to be able to call a centrally maintained reusable workflow stored in a private repository named 'org-shared/ci-templates'. However, the organization's Actions policy is currently set to 'Allow enterprise, and select non-enterprise, actions and reusable workflows', and repositories report that they cannot reference the reusable workflow. What is the correct action to enable this while keeping the restrictive policy in place?

Accepted Answer

Grant the calling repositories access to the 'org-shared/ci-templates' repository via its Actions access settings, so private reusable workflows can be shared

Answer

Change the policy to 'Allow all actions and reusable workflows' for every organization

Answer

Add 'org-shared/ci-templates' to the list of allowed actions patterns in the enterprise Actions policy

Answer

Publish the reusable workflow to the GitHub Marketplace so it becomes an enterprise-approved action

Question 8

Your enterprise uses GitHub Enterprise Cloud with SAML SSO enforced (not EMU). A developer leaves the company, and their IdP account is disabled. A security reviewer notices the developer's personal GitHub account still appears in an organization and worries they could still access repositories via a previously authorized personal access token. As the enterprise administrator, what is the most reliable way to ensure this former employee can no longer access organization resources?

Accepted Answer

Remove the user from the organization, which revokes their authorized SSO credentials (PATs and SSH keys) and organization membership

Answer

Rely on the disabled IdP account alone, since SAML SSO enforcement automatically deletes the user's GitHub personal account

Answer

Rotate the organization's SAML certificate so the former employee's existing tokens can no longer authenticate

Answer

Ask the former employee to manually revoke their own personal access tokens before their last day