Implement Security Best Practices GH-200 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   How can you restrict the permissions of the GITHUB_TOKEN in a workflow?

   • ABy setting the token's expiration date in the repository settings
   • BBy using a personal access token instead
   • CBy adding a `token:` input to every action
   • DBy setting the `permissions` key at the workflow or job level
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What does a workflow need to do to use OIDC to authenticate with a cloud provider?

   • ASet the `id-token: write` permission in the job
   • BConfigure the cloud provider to trust the GITHUB_TOKEN
   • CUse a PAT with cloud provider scopes
   • DStore the cloud provider's access key as a secret
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which practice best mitigates script injection when a workflow must use a value from a pull request title?

   • AStoring the value in an environment variable and referencing it
   • BPassing the value to an action's input instead of using it in a run command
   • CUsing double quotes around the value in the run command
   • DTruncating the value to 10 characters
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which workflow snippet correctly sets the default permissions for all jobs to read-only?

   • Apermissions: read
   • Bpermissions: read-all
   • Cpermissions: contents: read
   • Dpermissions: {}
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the main security benefit of using OIDC federation instead of storing cloud credentials as secrets?

   • AIt removes the need for a GITHUB_TOKEN
   • BIt eliminates the need to store long-lived cloud secrets in GitHub
   • CIt allows the workflow to access any cloud resource without restrictions
   • DIt makes the workflow run faster
   Reveal Solution Discussion Select an answer first