Implement Security Best Practices GH-200 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   A team wants to require manual approval before a workflow job deploys to a production environment. Which GitHub Actions feature should they configure?

   • AA job-level timeout-minutes setting
   • BA repository rule set requiring pull request reviews
   • CEnvironment protection rules with required reviewers
   • DA workflow-level concurrency group
   Reveal Solution Discussion Select an answer first
2. 7expert · medium

   Your organization is required to provide verifiable provenance for all build artifacts before deployment. You need to integrate artifact attestations into your deployment workflow. What should you do?

   • AUpload the build logs as an artifact and manually review them before deployment.
   • BUse a custom script to hash the artifact and store the hash in a GitHub secret.
   • CUse the actions/attest-build-provenance action to generate an attestation and verify it in the deployment job.
   • DSet the job's permissions to write-all to ensure the attestation can be created.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   A workflow uses `${{ github.event.issue.title }}` directly in a `run` command. What security risk does this introduce?

   • AInvalid YAML syntax in the workflow file
   • BPerformance degradation due to large payloads
   • CExposure of the GITHUB_TOKEN in logs
   • DScript injection, because untrusted input is interpreted by the shell
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A workflow uses a pull_request event and executes a script that includes the PR title in a shell command. A malicious user could inject shell commands through the PR title. You need to mitigate this script injection risk while maintaining the workflow's functionality. What should you do?

   • ASet the job's permissions to write-all so the script can handle any input safely.
   • BUse the github.event.pull_request.title context directly in the run command without quoting.
   • CPass the PR title as an argument to a vetted action that sanitizes input, and avoid using it in inline scripts.
   • DUse single quotes around the context expression in the run command, and set the shell to bash.
   Reveal Solution Discussion Select an answer first
6. 10expert · medium

   A workflow processes pull request comments and uses the comment body in a shell command. A security review flags this as a script injection risk. You need to fix it without breaking the workflow's ability to respond to the comment. What is the best approach?

   • AUse the github.event.comment.body context directly in the run command without quoting.
   • BUse the comment body as an argument to a vetted action that sanitizes input, and avoid using it in inline scripts.
   • CSet the job's permissions to write-all to allow the script to handle any input.
   • DUse single quotes around the comment body in the shell command.
   Reveal Solution Discussion Select an answer first