Medium — GH-100 Practice Quiz

Question 1

An enterprise administrator reviews the monthly Actions metered usage report and notices a sharp cost increase driven by one organization's CI workflows. Investigation shows these workflows run on GitHub-hosted 16-core larger runners, but the jobs are lightweight lint and unit-test steps that complete in under three minutes and never approach CPU or memory limits. The team originally chose larger runners hoping to speed up builds. What is the most appropriate optimization the administrator should recommend to reduce cost without harming these workflows?

Accepted Answer

Move the jobs to standard GitHub-hosted runners, since larger runners bill at a higher per-minute multiplier that is unjustified for jobs that do not consume the extra resources

Answer

Enable a shorter Actions log retention period for the organization to lower the per-minute billing rate on the larger runners

Answer

Convert the workflows to self-hosted runners so that the larger-runner minutes are removed from the metered usage report entirely at no cost

Answer

Increase the concurrency limit on the larger runners so the same minutes are spread across more jobs and reduce the per-minute charge

Question 2

You are the enterprise administrator for a GitHub Enterprise Cloud account with 12 organizations. Finance has asked you to produce an internal chargeback showing how many GitHub Actions minutes each individual organization consumed last month, broken down by the runner operating system (Linux, Windows, macOS) so they can apply the correct per-minute multipliers. Which approach gives you the most accurate, granular data to satisfy this request?

Accepted Answer

Download the enterprise metered usage report (CSV) from the billing settings, which itemizes Actions usage by organization, workflow, and runner operating system.

Answer

Read the 'Actions minutes used' summary gauge on each organization's billing page and manually total the values.

Answer

Query the audit log API filtering on workflows.completed_workflow_run events and sum the durations.

Answer

Open a ticket with GitHub Support and ask them to compile the per-organization minute breakdown for you.

Question 3

An enterprise owner notices that a compromised third-party action in one repository was able to push commits and create releases using the automatically generated GITHUB_TOKEN. They want to reduce the blast radius of the default token across all organizations without breaking existing workflows that explicitly request the permissions they need. Which enterprise-level setting should they configure?

Accepted Answer

Set the default GITHUB_TOKEN permissions for the enterprise to 'Read repository contents and packages permissions' (restricted), allowing workflows to elevate scopes via the permissions key as needed

Answer

Disable GitHub Actions entirely for all organizations until each third-party action is manually reviewed

Answer

Require that all workflows store a fine-grained PAT as an organization secret and use it instead of GITHUB_TOKEN

Answer

Enable an IP allow list so that only approved networks can trigger workflow runs

Question 4

An enterprise administrator receives complaints that a custom internal integration, which uses a GitHub App to bulk-create issues across hundreds of repositories, intermittently fails with HTTP 403 responses containing a 'You have exceeded a secondary rate limit' message. The primary hourly rate limit budget for the installation token is far from exhausted. The administrator is asked to recommend the most effective way to reduce these failures without requesting a special limit increase from GitHub. What should the administrator recommend?

Accepted Answer

Instruct the developers to add exponential backoff with retries honoring the 'Retry-After' header and to avoid concurrent content-creating requests, spacing out mutating calls

Answer

Switch the integration from a GitHub App installation token to a classic personal access token, which is not subject to secondary rate limits

Answer

Increase the GitHub App's requested permission scopes so the installation token receives a higher primary rate limit ceiling

Answer

Enable audit log streaming so the failing API requests are retried automatically from the SIEM pipeline

Question 5

An enterprise admin is investigating why a scheduled internal reporting tool that pulls repository metadata via the GitHub REST API intermittently fails with HTTP 403 responses during peak hours. The tool authenticates as a GitHub App installation. Support asks the admin to first determine whether the failures are caused by exhausting the app's hourly request budget before escalating. Which response header should the admin instruct the team to inspect to confirm this is a primary rate limit exhaustion?

Accepted Answer

The x-ratelimit-remaining header, checking whether it reaches 0 before the x-ratelimit-reset window elapses

Answer

The retry-after header, which is only returned on secondary rate limits and abuse detection

Answer

The x-github-request-id header, which uniquely identifies the failing request for correlation

Answer

The link header, which indicates whether additional paginated result pages remain

Question 6

A security incident report indicates that a repository's default branch protection was disabled sometime between 14:00 and 15:00 UTC on a specific day. As the enterprise owner, you need to programmatically retrieve only the audit log events that occurred within that one-hour window to identify who made the change, without pulling the entire log history. Which approach lets you scope the query most precisely?

Accepted Answer

Use the audit log REST API with a phrase query that combines created:>= and created:<= timestamp qualifiers to bound the results to the incident window

Answer

Download the full audit log export as JSON from the web UI and manually search for events near the incident time

Answer

Query the audit log API filtering only on action:protected_branch.destroy, which automatically returns just the most recent matching event

Answer

Open a GitHub Support ticket requesting that support extract the relevant time window, since timestamp filtering is not exposed to administrators

Question 7

Your compliance team requires that all enterprise audit log events on GitHub Enterprise Cloud be retained for seven years in a tamper-resistant store that your SIEM can query, well beyond GitHub's default retention window. The team also wants near-real-time delivery so security analysts can alert on suspicious events. As the enterprise owner, what is the most appropriate way to meet these requirements?

Accepted Answer

Configure enterprise audit log streaming to an external endpoint such as Amazon S3, Azure Blob Storage, or Splunk, and manage long-term retention there.

Answer

Increase the audit log retention period in the enterprise settings to seven years and grant analysts read access to the built-in audit log UI.

Answer

Write a scheduled GitHub Actions workflow that calls the audit log REST API nightly and commits the exported JSON to a private repository.

Answer

Enable Dependabot alerts forwarding and rely on the security overview dashboard to archive events for the required period.

Question 8

An enterprise administrator runs a fleet of self-hosted runners on a Kubernetes cluster to handle bursty CI demand. They notice that after a job completes, leftover files, cached credentials, and tool installations from previous jobs sometimes leak into subsequent jobs on the same runner, causing intermittent build failures and a potential security concern. They want to auto-scale runners with the actions-runner-controller (ARC) so each runner processes exactly one job and is then destroyed. Which runner configuration best meets this requirement?

Accepted Answer

Register the runners as ephemeral runners so each runner accepts a single job and is automatically removed after completion.

Answer

Add the runners to a dedicated runner group and restrict repository access to reduce cross-job contamination.

Answer

Enable the `--replace` flag when registering runners so a new runner overwrites the old registration token on each job.

Answer

Increase the number of persistent runners in the pool so jobs are distributed and rarely reuse the same runner.

Question 9

A GitHub Enterprise Cloud administrator notices the monthly invoice has grown significantly beyond the predictable per-seat license cost. Investigation shows heavy usage of GitHub Actions minutes for private repositories and large amounts of GitHub Packages storage. The finance team wants to understand which parts of the bill are fixed versus variable so they can forecast future costs. How should the administrator explain the billing structure for these consumption-based services?

Accepted Answer

Actions minutes and Packages storage are billed on a usage-based (metered) model beyond the plan's included allotments, separate from the fixed per-user license seats.

Answer

All Actions and Packages usage is bundled into the per-user license price, so the overage must be caused by additional purchased seats rather than usage.

Answer

Actions and Packages are billed only annually as part of the enterprise agreement true-up and cannot be tracked or forecasted monthly.

Answer

Actions minutes for private repositories are always free; only Packages storage is metered, so the entire overage stems from storage alone.

Question 10

You administer a GitHub Enterprise Cloud organization. A development team needs CodeQL code scanning enabled on a JavaScript repository. They want the fastest possible way to get scanning running, but a separate legacy C/C++ repository requires a custom build command and a specific compiler toolchain before CodeQL can analyze it. Which configuration approach correctly satisfies both repositories?

Accepted Answer

Use CodeQL default setup for the JavaScript repository and advanced setup with a custom workflow file for the C/C++ repository

Answer

Use advanced setup for both repositories because default setup does not support any compiled or interpreted languages

Answer

Use default setup for both repositories and add the custom build command through the repository's Dependabot configuration

Answer

Enable secret scanning on both repositories, since CodeQL default setup only runs after secret scanning completes

Question 11

A team of contractors needs to triage issues and pull requests in a private repository, plus manage repository labels and milestones. Company policy requires least-privilege access, and the contractors must NOT be able to push code, merge pull requests, or change repository settings. The organization owner wants a reusable role that can be applied across several repositories. What is the best way to grant this access?

Accepted Answer

Create a custom repository role based on the Triage role, add the 'Manage labels' and 'Manage milestones' permissions, and assign it to the contractors

Answer

Assign the contractors the built-in Write role on each repository

Answer

Assign the contractors the built-in Maintain role so they can manage issues and milestones

Answer

Add the contractors as outside collaborators with the Read role and rely on branch protection rules to block merges

Question 12

You are the GitHub Enterprise administrator for an organization that has grown to 200 developers across 15 teams. Leadership wants to standardize the developer workflow so that all production code changes are peer-reviewed by domain owners before merging, while allowing individual teams flexibility on their feature-branch naming. Which approach best establishes an enforceable, consistent review standard across all repositories?

Accepted Answer

Configure organization-level rulesets targeting the default branch that require pull requests with a minimum number of approvals and require review from code owners defined in CODEOWNERS files

Answer

Ask each team lead to manually verify reviews were completed before merging, documented in a shared wiki page

Answer

Disable direct push access for all users at the enterprise account level so no one can push to any branch

Answer

Require each team to create a personal access token policy that blocks merges without approval

Question 13

A security engineer enables Dependabot alerts on a repository, but no alerts appear even though the team knows a direct dependency in their Python project has a published CVE. The repository contains a requirements.txt file, and the dependency graph feature shows as enabled in the repository's Settings. What is the most likely reason Dependabot is not generating an alert?

Accepted Answer

The vulnerable version is not yet included in the GitHub Advisory Database, so Dependabot has no advisory to match against the manifest.

Answer

Dependabot alerts only work for repositories that also have Dependabot version updates configured in a dependabot.yml file.

Answer

Dependabot alerts cannot parse requirements.txt files and require a Pipfile.lock or poetry.lock instead.

Answer

Secret scanning must be enabled before Dependabot alerts can run against the dependency graph.

Question 14

You administer a GitHub Enterprise Cloud organization with hundreds of repositories. The security team complains that Dependabot alerts are overwhelming: developers are inundated with low-severity notifications and are ignoring the truly critical ones. Leadership wants a way to focus response effort on the highest-risk vulnerabilities across the organization without disabling Dependabot alerts entirely. Which approach best meets this requirement?

Accepted Answer

Use the organization-level security overview dashboard to filter and prioritize Dependabot alerts by severity and CVSS score, directing remediation effort at critical and high alerts first

Answer

Disable Dependabot alerts organization-wide and rely only on Dependabot version updates to keep dependencies current

Answer

Add a .github/dependabot.yml file that sets a global severity threshold so that only critical alerts are ever generated

Answer

Turn off email notifications for all members so alerts stop reaching developers, then review alerts manually once per quarter

Question 15

A platform team maintains a Node.js monorepo where Dependabot version updates are already enabled. Every week the team receives dozens of separate pull requests — one for each npm dependency that has a new release — which overwhelms reviewers and slows the merge queue. The team wants to keep receiving updates but consolidate related dependency bumps into a smaller number of pull requests per ecosystem. Which configuration change in dependabot.yml best achieves this?

Accepted Answer

Add a groups key under the npm package-ecosystem entry to bundle multiple dependency updates into combined pull requests

Answer

Set open-pull-requests-limit to 0 for the npm ecosystem to stop Dependabot from opening excess pull requests

Answer

Change the schedule interval from daily to weekly so all updates arrive in a single pull request

Answer

Enable Dependabot security updates instead of version updates so only vulnerable packages generate pull requests

Question 16

A platform team at a fintech company wants Dependabot to automatically open pull requests for known security vulnerabilities in their npm dependencies as soon as advisories are published, but they explicitly do NOT want routine PRs opened just because a newer non-vulnerable version of a package is released. The repository already has the dependency graph enabled. Which configuration achieves exactly this behavior?

Accepted Answer

Enable Dependabot security updates, but do not create a dependabot.yml enabling version updates

Answer

Add a dependabot.yml file with a package-ecosystem entry and a daily schedule for version updates

Answer

Enable Dependabot version updates and set open-pull-requests-limit to 0 in dependabot.yml

Answer

Enable only Dependabot alerts without turning on any Dependabot update feature

Question 17

An enterprise administrator is establishing standard developer workflows across all organizations. Team leads want to guarantee that any change touching files in the `/infrastructure` directory is automatically reviewed by the platform engineering team before merge, without relying on developers to remember to add reviewers manually. Which approach should the administrator recommend to enforce this as a repeatable standard?

Accepted Answer

Add a CODEOWNERS file mapping `/infrastructure` to the platform engineering team and enable a branch protection rule (or ruleset) that requires review from Code Owners.

Answer

Instruct developers to manually assign the platform engineering team as reviewers on every pull request that changes infrastructure files.

Answer

Create a repository webhook that posts a Slack reminder whenever the `/infrastructure` directory is modified in a pull request.

Answer

Set the organization base permission to Read so only platform engineers can push changes to infrastructure files.

Question 18

Your company uses a GitHub Enterprise Cloud account with Enterprise Managed Users (EMU) integrated with Azure AD (Entra ID) via SAML SSO and SCIM provisioning. An employee leaves the company, and the HR team removes them from the corporate identity provider. As the enterprise administrator, what happens to this user's GitHub account and access, and what is the correct expectation?

Accepted Answer

The managed user account is automatically suspended via SCIM deprovisioning, revoking their access to the enterprise's organizations and repositories.

Answer

The user retains full access until an administrator manually deletes the account from the enterprise settings, because SCIM only handles provisioning, not deprovisioning.

Answer

The user's account is immediately and permanently deleted along with all their contributions and repository history within the enterprise.

Answer

Nothing changes automatically; the administrator must revoke the SAML session and remove the user from each team individually to fully cut off access.

Question 19

You administer an Enterprise Managed Users (EMU) instance for a financial services company. Compliance requires that every developer be protected by two-factor authentication. Your security team asks you to configure and enforce 2FA for all managed users directly in the GitHub enterprise settings. What should you tell them about implementing this requirement?

Accepted Answer

2FA cannot be configured within GitHub for EMU accounts; authentication and any multi-factor requirements are handled entirely by the configured identity provider.

Answer

Enable the 'Require two-factor authentication' organization policy for each organization in the enterprise to force managed users to register a second factor in GitHub.

Answer

Turn on the enterprise-level 2FA enforcement setting, which will prompt all managed users to enroll a TOTP app on next sign-in.

Answer

Have each managed user enable 2FA under their own personal security settings, then run an audit to confirm compliance.

Question 20

Contoso is adopting GitHub Enterprise Cloud and wants all developer identities to be fully controlled by their Azure AD tenant, so that accounts are automatically created and deprovisioned centrally and users cannot use these accounts for personal open-source contributions outside the company. The security team also requires that these accounts cannot exist or be used before the identity provider authenticates them. Which enterprise account type should Contoso choose to meet these requirements?

Accepted Answer

An enterprise with Enterprise Managed Users (EMU), where user accounts are provisioned and managed exclusively through the identity provider

Answer

A standard enterprise where members bring existing personal accounts and authenticate through SAML SSO

Answer

A standard enterprise with SAML SSO plus mandatory two-factor authentication enforced on all personal accounts

Answer

A standard enterprise where members are invited by email and required to enable SCIM on their personal accounts

Question 21

As an enterprise owner for a GitHub Enterprise Cloud organization with 30 orgs, leadership asks you to evaluate whether teams are actually adopting the security features you've paid to enable across the enterprise. You specifically want to see, at the enterprise level, how many repositories currently have code scanning, Dependabot, and secret scanning enabled versus disabled, so you can target the orgs that are lagging. Which built-in capability should you use to get this cross-org adoption view most efficiently?

Accepted Answer

The enterprise-level security overview dashboard, which aggregates security feature enablement and alert coverage across all orgs and repositories

Answer

The enterprise audit log, filtered on repository configuration change events to count enablement actions

Answer

A support bundle generated from each organization and analyzed offline

Answer

The metered-usage billing report, which lists which security features each repository consumes

Question 22

You are the enterprise administrator for a GitHub Enterprise Cloud account with several organizations. Your security team asks you to identify every instance where a repository was changed from private to public across all organizations over the past 90 days, and they want this data pulled programmatically into their SIEM on a recurring schedule. Which approach best satisfies this requirement using native GitHub Enterprise capabilities?

Accepted Answer

Query the enterprise audit log using the audit log API, filtering on the repo.access action, and configure the SIEM to poll it on a schedule

Answer

Ask each organization owner to review their organization's Security tab and manually export a CSV of repository setting changes

Answer

Enable repository rulesets at the enterprise level to block visibility changes, since blocked events are the only ones logged

Answer

Configure a webhook on each repository for the 'repository' event and forward the payloads to the SIEM

Question 23

Your company runs a GitHub Enterprise Cloud account with Enterprise Managed Users (EMU) enabled through Okta. A project lead asks you to add an external contractor's existing personal GitHub.com account as an outside collaborator on one private repository so the contractor can submit pull requests. What should you tell the project lead?

Accepted Answer

It is not possible; EMU accounts can only collaborate with other managed users provisioned by the identity provider, so the contractor must be provisioned through Okta.

Answer

Add the contractor's personal account as an outside collaborator, but require them to enable 2FA first.

Answer

Invite the contractor as an enterprise member through the enterprise settings, then downgrade them to outside collaborator.

Answer

Add the contractor's personal account as a repository-level guest collaborator by enabling the outside collaborator policy at the organization level.

Question 24

An enterprise administrator has created an organization-level ruleset targeting the default branch of all repositories in an organization. The ruleset requires pull requests with at least two approvals and blocks force pushes. A senior release engineer reports they need to occasionally push directly to the default branch during emergency hotfixes, but the platform team wants to preserve the two-approval requirement for everyone else and keep a record of who used the exception. What is the most appropriate way to accommodate this requirement?

Accepted Answer

Add the release engineer's team to the ruleset's bypass list, which allows designated actors to skip the rules while the ruleset remains enforced for all other users.

Answer

Delete the organization-level ruleset and recreate it as a repository-level branch protection rule that excludes the release engineer.

Answer

Set the ruleset's enforcement status to 'Evaluate' so the rules are logged but never actually block any push.

Answer

Grant the release engineer the enterprise owner role so they inherit the ability to override all organization policies.

Question 25

As an enterprise owner, you enable a policy in the enterprise security settings that turns on secret scanning for all organizations and disables the ability for organization owners to change it. A few weeks later, an organization owner opens a support request claiming they cannot disable secret scanning for a repository containing intentionally committed test fixtures with fake credentials. What is the correct explanation and resolution?

Accepted Answer

The enterprise-level policy enforces the setting and removes the toggle for organizations; the org owner must ask the enterprise owner to change the policy or the affected repos should use secret scanning exclusions/alert dismissal instead of disabling scanning.

Answer

Secret scanning cannot be enforced at the enterprise level, so the org owner must be using an outdated UI; refreshing their browser will restore the disable toggle.

Answer

Organization owners always override enterprise policies, so the org owner should simply disable secret scanning at the organization level and the change will propagate.

Answer

The only resolution is for the enterprise owner to delete the repository containing the fake credentials, since enforced secret scanning cannot coexist with test fixtures.