Implement Security Best Practices GH-200 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of applying least-privilege permissions to a GitHub Actions workflow?

   • ATo reduce the attack surface by granting only the permissions the job actually needs
   • BTo speed up workflow execution by reducing permission checks
   • CTo ensure the workflow can access all repository resources
   • DTo comply with GitHub's requirement that all workflows use read-only permissions
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Why are long-lived Personal Access Tokens (PATs) considered a security risk in GitHub Actions workflows?

   • AThey cannot be scoped to specific repositories
   • BThey are only valid for a single workflow run
   • CThey are more likely to be leaked and remain valid for a long time
   • DThey are automatically rotated by GitHub
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A workflow needs to authenticate to AWS to deploy infrastructure. Currently, it uses long-lived AWS access keys stored as secrets. You want to eliminate these long-lived secrets and use OIDC instead. What should you do?

   • AConfigure the workflow with permissions: id-token: write and use the aws-actions/configure-aws-credentials action with the role-to-assume parameter.
   • BStore the AWS secret in a GitHub Environment and reference it in the workflow.
   • CUse GITHUB_TOKEN to authenticate to AWS directly.
   • DKeep using AWS access keys but rotate them every 30 days.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   Your team uses a GitHub Actions workflow to deploy a critical application to production. You need to ensure that only senior engineers can trigger the deployment job and that the deployment job has the minimum permissions required. The workflow currently uses the default GITHUB_TOKEN permissions. What should you do?

   • AAdd a job-level if condition that checks the actor's team membership, and set the GITHUB_TOKEN permissions to write-all.
   • BUse a personal access token (PAT) stored as a secret for the deployment job, and set permissions to read-only.
   • CAdd an environment named 'production' with required reviewers, and set the job's permissions to read-only for contents.
   • DAdd an environment with required reviewers, and set the job's permissions to write-all to ensure the deployment can update the environment.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the purpose of requiring review for unverified actions in an organization's action policy?

   • ATo automatically update actions to the latest version
   • BTo speed up workflow execution
   • CTo prevent all third-party actions from being used
   • DTo ensure that only actions from verified publishers are used without manual approval
   Reveal Solution Discussion Select an answer first