Which of the following is the most secure way to reference a third-party action in a workflow?

uses: actions/checkout@a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2

Your organization is adopting a third-party action from the GitHub Marketplace to perform code scanning. The action is popular but has not been updated in over a year. Your security team requires that all actions be trustworthy and immutable. What should you do?

Create an organization allowlist that includes the action, and use the latest major version tag for simplicity.

Fork the action into your own repository and use the default branch, assuming your fork is secure.

Pin the action to a full commit SHA and verify the repository's maintenance history and community adoption before using it.

Use the action with a floating tag like @v1 to always get the latest version, and rely on the Marketplace's 'verified creator' badge.

Which GitHub feature allows an organization to restrict which actions can be used in its workflows?

The Actions permissions policy in organization settings

The environment protection rules

The workflow's `permissions` key

The repository's branch protection rules

Which of the following is a red flag when reviewing an action before adding it to a workflow?

The action is published by a verified organization

The action has many open issues and no recent releases

The action has a clear license and documentation

The action's source code is publicly visible

What is an artifact attestation in GitHub Actions?

A log of all workflow runs that produced the artifact

A cryptographically signed statement about the build metadata and provenance of an artifact

A permission rule that controls who can download the artifact

A checksum of the artifact stored in the repository

GitHubActions Certification

Domain 5Objective 1

Implement Security Best Practices GH-200 Practice Questions (Page 4)

Part of the Secure and optimize automation domain, which accounts for 10-15% of the GH-200 exam.

26questions here

6free pages

10concepts

10-15%of the exam

Questions 16–20

16foundation · easy
Which of the following is the most secure way to reference a third-party action in a workflow?
Select an answer first
17application · medium
Your organization is adopting a third-party action from the GitHub Marketplace to perform code scanning. The action is popular but has not been updated in over a year. Your security team requires that all actions be trustworthy and immutable. What should you do?
Select an answer first
18foundation · easy
Which GitHub feature allows an organization to restrict which actions can be used in its workflows?
Select an answer first
19foundation · easy
Which of the following is a red flag when reviewing an action before adding it to a workflow?
Select an answer first
20foundation · easy
What is an artifact attestation in GitHub Actions?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GH-200

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitHub. “GH-200” is a trademark of its owner, used for identification only.