When evaluating a third-party action on the GitHub Marketplace, which factor is most important for determining whether it is trustworthy?

The action's publisher, maintenance activity, and community adoption

The action's star count on GitHub

The action's name being short and memorable

The action being listed on the first page of Marketplace search results

What is a security advantage of using GITHUB_TOKEN over a Personal Access Token (PAT) in a workflow?

GITHUB_TOKEN can access private repositories without any configuration

GITHUB_TOKEN has more permissions than a PAT

GITHUB_TOKEN is not visible in logs

GITHUB_TOKEN is automatically scoped and expires after the job, while a PAT is long-lived

What is a key characteristic of the GITHUB_TOKEN in GitHub Actions?

It is automatically generated for each job and expires when the job completes

It has the same permissions as a repository admin

It is a long-lived token that persists across workflow runs

It can be used to authenticate to any cloud provider

Why should a deployment workflow verify an artifact attestation before deploying?

To confirm the artifact was built from a trusted source and has not been tampered with

To reduce the number of workflow runs

To speed up the deployment process

To automatically roll back the deployment if it fails

Which component of a GitHub Actions workflow must reference an environment so that its protection rules apply?

The repository's default branch

GitHubActions Certification

Domain 5Objective 1

Implement Security Best Practices GH-200 Practice Questions (Page 3)

Part of the Secure and optimize automation domain, which accounts for 10-15% of the GH-200 exam.

26questions here

6free pages

10concepts

10-15%of the exam

Questions 11–15

11foundation · easy
When evaluating a third-party action on the GitHub Marketplace, which factor is most important for determining whether it is trustworthy?
Select an answer first
12foundation · easy
What is a security advantage of using GITHUB_TOKEN over a Personal Access Token (PAT) in a workflow?
Select an answer first
13foundation · easy
What is a key characteristic of the GITHUB_TOKEN in GitHub Actions?
Select an answer first
14foundation · easy
Why should a deployment workflow verify an artifact attestation before deploying?
Select an answer first
15foundation · easy
Which component of a GitHub Actions workflow must reference an environment so that its protection rules apply?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GH-200

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitHub. “GH-200” is a trademark of its owner, used for identification only.