Manage GitHub identities and access — GH-100 Practice Quiz

Question 1

A team of contractors needs to triage issues and pull requests in a private repository, plus manage repository labels and milestones. Company policy requires least-privilege access, and the contractors must NOT be able to push code, merge pull requests, or change repository settings. The organization owner wants a reusable role that can be applied across several repositories. What is the best way to grant this access?

Accepted Answer

Create a custom repository role based on the Triage role, add the 'Manage labels' and 'Manage milestones' permissions, and assign it to the contractors

Answer

Assign the contractors the built-in Write role on each repository

Answer

Assign the contractors the built-in Maintain role so they can manage issues and milestones

Answer

Add the contractors as outside collaborators with the Read role and rely on branch protection rules to block merges

Question 2

Your company uses a GitHub Enterprise Cloud account with Enterprise Managed Users (EMU) integrated with Azure AD (Entra ID) via SAML SSO and SCIM provisioning. An employee leaves the company, and the HR team removes them from the corporate identity provider. As the enterprise administrator, what happens to this user's GitHub account and access, and what is the correct expectation?

Accepted Answer

The managed user account is automatically suspended via SCIM deprovisioning, revoking their access to the enterprise's organizations and repositories.

Answer

The user retains full access until an administrator manually deletes the account from the enterprise settings, because SCIM only handles provisioning, not deprovisioning.

Answer

The user's account is immediately and permanently deleted along with all their contributions and repository history within the enterprise.

Answer

Nothing changes automatically; the administrator must revoke the SAML session and remove the user from each team individually to fully cut off access.

Question 3

You administer an Enterprise Managed Users (EMU) instance for a financial services company. Compliance requires that every developer be protected by two-factor authentication. Your security team asks you to configure and enforce 2FA for all managed users directly in the GitHub enterprise settings. What should you tell them about implementing this requirement?

Accepted Answer

2FA cannot be configured within GitHub for EMU accounts; authentication and any multi-factor requirements are handled entirely by the configured identity provider.

Answer

Enable the 'Require two-factor authentication' organization policy for each organization in the enterprise to force managed users to register a second factor in GitHub.

Answer

Turn on the enterprise-level 2FA enforcement setting, which will prompt all managed users to enroll a TOTP app on next sign-in.

Answer

Have each managed user enable 2FA under their own personal security settings, then run an audit to confirm compliance.

Question 4

An enterprise uses a GitHub Enterprise Cloud with Managed Users (EMU) instance provisioned via SCIM from Azure AD (Entra ID). Two newly hired employees, both named Alex Kim, are being provisioned. The identity provider maps the SCIM userName attribute (derived from each user's email local-part 'alex.kim') to their GitHub handle. The first user provisions successfully as '@alex.kim_acme'. When the second Alex Kim is provisioned, what happens and how should the administrator ensure both users are created correctly?

Accepted Answer

The second provisioning fails or collides because managed usernames must be unique within the enterprise; the admin must ensure the IdP maps a unique SCIM userName (e.g., a distinct email/attribute) so GitHub generates a distinct normalized handle.

Answer

GitHub silently merges both identities into the single '@alex.kim_acme' account since they share the same display name, and no admin action is needed.

Answer

The second user is created automatically as '@alex.kim2_acme' with no configuration change required, because GitHub auto-increments any duplicate managed usernames.

Answer

Provisioning succeeds because managed usernames only need to be unique per organization, not per enterprise, so both can coexist in different orgs.

Question 5

Contoso is adopting GitHub Enterprise Cloud and wants all developer identities to be fully controlled by their Azure AD tenant, so that accounts are automatically created and deprovisioned centrally and users cannot use these accounts for personal open-source contributions outside the company. The security team also requires that these accounts cannot exist or be used before the identity provider authenticates them. Which enterprise account type should Contoso choose to meet these requirements?

Accepted Answer

An enterprise with Enterprise Managed Users (EMU), where user accounts are provisioned and managed exclusively through the identity provider

Answer

A standard enterprise where members bring existing personal accounts and authenticate through SAML SSO

Answer

A standard enterprise with SAML SSO plus mandatory two-factor authentication enforced on all personal accounts

Answer

A standard enterprise where members are invited by email and required to enable SCIM on their personal accounts

Question 6

You are the enterprise administrator for a GitHub Enterprise Cloud account with several organizations. Your security team asks you to identify every instance where a repository was changed from private to public across all organizations over the past 90 days, and they want this data pulled programmatically into their SIEM on a recurring schedule. Which approach best satisfies this requirement using native GitHub Enterprise capabilities?

Accepted Answer

Query the enterprise audit log using the audit log API, filtering on the repo.access action, and configure the SIEM to poll it on a schedule

Answer

Ask each organization owner to review their organization's Security tab and manually export a CSV of repository setting changes

Answer

Enable repository rulesets at the enterprise level to block visibility changes, since blocked events are the only ones logged

Answer

Configure a webhook on each repository for the 'repository' event and forward the payloads to the SIEM

Question 7

Your company runs a GitHub Enterprise Cloud account with Enterprise Managed Users (EMU) enabled through Okta. A project lead asks you to add an external contractor's existing personal GitHub.com account as an outside collaborator on one private repository so the contractor can submit pull requests. What should you tell the project lead?

Accepted Answer

It is not possible; EMU accounts can only collaborate with other managed users provisioned by the identity provider, so the contractor must be provisioned through Okta.

Answer

Add the contractor's personal account as an outside collaborator, but require them to enable 2FA first.

Answer

Invite the contractor as an enterprise member through the enterprise settings, then downgrade them to outside collaborator.

Answer

Add the contractor's personal account as a repository-level guest collaborator by enabling the outside collaborator policy at the organization level.

Question 8

An enterprise administrator has created an organization-level ruleset targeting the default branch of all repositories in an organization. The ruleset requires pull requests with at least two approvals and blocks force pushes. A senior release engineer reports they need to occasionally push directly to the default branch during emergency hotfixes, but the platform team wants to preserve the two-approval requirement for everyone else and keep a record of who used the exception. What is the most appropriate way to accommodate this requirement?

Accepted Answer

Add the release engineer's team to the ruleset's bypass list, which allows designated actors to skip the rules while the ruleset remains enforced for all other users.

Answer

Delete the organization-level ruleset and recreate it as a repository-level branch protection rule that excludes the release engineer.

Answer

Set the ruleset's enforcement status to 'Evaluate' so the rules are logged but never actually block any push.

Answer

Grant the release engineer the enterprise owner role so they inherit the ability to override all organization policies.

Question 9

Your company runs a GitHub Enterprise Cloud account with Enterprise Managed Users (EMU) tied to Microsoft Entra ID. The security team wants to enforce Conditional Access policies (device compliance, sign-in risk) that are evaluated by Entra ID on every authentication to GitHub, without requiring an on-premises component to relay authentication state. Which identity federation protocol should you configure for the EMU enterprise to meet this requirement?

Accepted Answer

OIDC (OpenID Connect) federation with Entra ID

Answer

SAML SSO with Entra ID as the SAML IdP

Answer

LDAP synchronization against Entra Domain Services

Answer

SCIM provisioning with a personal access token fallback

Question 10

An enterprise owner at a company using GitHub Enterprise Cloud with Enterprise Managed Users (EMU) wants to grant a group of 40 backend engineers access to several organizations at once. The engineers already exist as a group in the company's identity provider. The owner creates an enterprise team and wants its membership to be automatically driven by the IdP group, while also using that same team to assign organization roles across multiple organizations. Which approach correctly achieves automatic, IdP-driven membership for an enterprise team?

Accepted Answer

Connect the enterprise team to the IdP group so membership is synchronized via SCIM/identity provider groups, then add the enterprise team to the desired organizations.

Answer

Enable team synchronization (team sync) on each individual organization team and map them to the IdP group, since enterprise teams cannot be linked to IdP groups.

Answer

Manually add each of the 40 users to the enterprise team, because enterprise teams only support manual membership management.

Answer

Create a repository ruleset that grants the IdP group access, which automatically populates the enterprise team from the provider.

Question 11

An organization on GitHub Enterprise Cloud has its base permission set to 'Write', meaning all organization members can push to every repository. A contractor who is NOT a member of the organization needs to contribute code to only one private repository. The security team requires that this contractor be able to access that single repository and nothing else in the organization. How should the enterprise administrator grant this access while respecting the least-privilege requirement?

Accepted Answer

Invite the contractor as an outside collaborator on the specific repository with the 'Write' role.

Answer

Add the contractor as an organization member and rely on the base permission of 'Write' to scope their access.

Answer

Lower the organization base permission to 'Read' and add the contractor as an organization member.

Answer

Create a new team, add the contractor to it, and grant the team 'Write' access to the repository.

Question 12

At Contoso, an enterprise account contains 12 organizations on GitHub Enterprise Cloud. Priya is an enterprise owner but is NOT a member or owner of the 'payments-team' organization. A developer asks Priya to directly add a specific outside collaborator to a private repository inside the 'payments-team' organization. Without changing her own membership, what can Priya do based on the GitHub authorization model?

Accepted Answer

She cannot manage repository-level access in that organization until she joins it as a member or is made an organization owner; enterprise owners manage policies, not individual repo collaborators by default.

Answer

As an enterprise owner she automatically has owner permissions on every organization, so she can add the collaborator to the repository directly right now.

Answer

She must first convert the repository to internal visibility, after which enterprise owners gain the ability to add collaborators enterprise-wide.

Answer

She can add the collaborator only by creating an enterprise team and assigning it to the repository, because enterprise teams override organization membership.

Question 13

A team lead at your company wants a group of contractors to be able to manage issues and pull requests—applying labels, closing issues, requesting reviews, and marking duplicates—on a specific repository, but they must NOT be able to push code to any branch or change repository settings. As an organization owner, which built-in repository role should you assign to the contractors' team to grant exactly this level of access with the least privilege?

Accepted Answer

Triage

Answer

Write

Answer

Maintain

Answer

Read

Question 14

An enterprise owner on GitHub Enterprise Cloud (without Enterprise Managed Users) notices that a contractor was added directly to a single private repository in the Acme-Web organization, but the contractor is NOT a member of the organization. Leadership wants to ensure this contractor cannot see any other private repositories in the organization and cannot be counted against internal team-based base permissions. Which statement correctly describes the contractor's status and how their access is governed?

Accepted Answer

The contractor is an outside collaborator, so the organization's base permission setting does not grant them any access; they can only access repositories to which they are explicitly added.

Answer

The contractor is automatically an organization member because they were granted repository access, so the base permission setting applies and must be set to 'None' to restrict them.

Answer

The contractor is a billable enterprise team member, so they inherit read access to all internal repositories in the organization by default.

Answer

The contractor's access is controlled by SCIM provisioning attributes, so their repository access can only be limited by adjusting the identity provider group mapping.

Question 15

Your enterprise uses GitHub Enterprise Cloud with SAML SSO enforced (not EMU). A developer leaves the company, and their IdP account is disabled. A security reviewer notices the developer's personal GitHub account still appears in an organization and worries they could still access repositories via a previously authorized personal access token. As the enterprise administrator, what is the most reliable way to ensure this former employee can no longer access organization resources?

Accepted Answer

Remove the user from the organization, which revokes their authorized SSO credentials (PATs and SSH keys) and organization membership

Answer

Rely on the disabled IdP account alone, since SAML SSO enforcement automatically deletes the user's GitHub personal account

Answer

Rotate the organization's SAML certificate so the former employee's existing tokens can no longer authenticate

Answer

Ask the former employee to manually revoke their own personal access tokens before their last day

Question 16

You administer a GitHub Enterprise Cloud organization backed by personal accounts (not EMU). Leadership requires all members to authenticate through the company's SAML identity provider. You enable and enforce SAML SSO for the organization. A developer complains that their existing personal access token (PAT) and SSH key suddenly stopped working against organization repositories, even though they can still sign in to github.com. What must the developer do to restore programmatic access?

Accepted Answer

Re-authenticate to the SAML IdP in the browser, then authorize the existing PAT and SSH key for use with SSO on the organization

Answer

Wait for the enterprise owner to disable IP allow lists, since SAML enforcement blocks all token traffic by default

Answer

Delete the personal account and have it re-provisioned as a managed user (EMU) so tokens are auto-authorized

Answer

Enable two-factor authentication on the personal account, which automatically re-validates all existing credentials for SSO

Question 17

Your company uses a GitHub Enterprise Managed Users (EMU) instance with Azure AD (Entra ID) as the identity provider, connected via SAML SSO and SCIM provisioning. An HR change updates an employee's display name and email in Entra ID. Days later, a colleague notices the user's profile name in GitHub still shows the old value. The user can still sign in normally. What is the most likely cause of the outdated profile information?

Accepted Answer

The SCIM provisioning integration in the identity provider has not pushed the updated user attributes to GitHub, so the profile is not synchronized.

Answer

The user must edit their own name and email directly in their GitHub profile settings, since EMU users manage their own profile data.

Answer

SAML SSO only updates profile attributes at each sign-in, so the user simply has not signed in again since the change.

Answer

Team synchronization controls profile attributes and the IdP group mapping needs to be refreshed to update the name and email.

Question 18

An enterprise uses SAML SSO with Azure AD (Entra ID) for their GitHub Enterprise Cloud organization (not EMU). The security team wants GitHub team membership to be automatically driven by Azure AD security groups, so that when a user is removed from an Azure AD group they lose the corresponding GitHub team membership without manual intervention. Team Synchronization has been enabled for the organization. What must an organization owner do to make a specific GitHub team's membership managed by an identity provider group?

Accepted Answer

Connect the GitHub team to one or more IdP groups in that team's settings; members are then added or removed to match the linked IdP group membership.

Answer

Enable SCIM provisioning on the organization, which will automatically map all existing GitHub teams to identically named Azure AD groups.

Answer

Add each user to the GitHub team manually and rely on SAML SSO to remove them when their Azure AD group changes.

Answer

Create an enterprise-level ruleset that binds repository access to Azure AD group names for every team.

Question 19

An enterprise uses GitHub Enterprise Cloud (not EMU) with SAML SSO already configured against Microsoft Entra ID. The security team wants organization team membership to be governed centrally by Entra ID security groups, so that when a user is added to or removed from an Entra group, their membership in the corresponding GitHub team updates automatically. They do NOT want to manage user accounts or provisioning through this mechanism. Which GitHub feature should the administrator enable to meet this requirement?

Accepted Answer

Team synchronization, connecting GitHub teams to Entra ID groups

Answer

SCIM provisioning, mapping Entra groups to GitHub teams

Answer

A repository ruleset that restricts pushes to members of the Entra group

Answer

Enterprise teams with a base permission mapped to the SAML assertion

More GH-100 practice