What is the best way to control access to secrets and environment variables in GitHub Actions workflows?
Correct Answer: A
To control access to secrets and environment variables in GitHub Actions, you should use environments to define specific protection rules. By scoping secrets and variables to an environment rather than the entire repository, you can ensure they are only accessible to specific jobs after certain conditions are met. Key Protection Rules for Secrets and Variables When you use GitHub environments, you can implement several layers of control: Required Reviewers: You can specify up to six people or teams who must approve a workflow job before it can access the environment's secrets. Wait Timer: You can set a delay (in minutes) that must pass after a job is triggered before it can proceed and access sensitive data. Deployment Branch Restrictions: You can limit environment access to only specific branches or tags (e.g., only allow the main branch to access production secrets). Custom Protection Rules: For Enterprise accounts, you can use GitHub Apps to create custom gates, such as checking for open Jira tickets or passing external security scans before secrets are released. Implementation Best Practices Environment vs. Repository Secrets: Always prefer Environment secrets for sensitive data like production API keys. They take precedence over repository-level secrets with the same name. Least Privilege: Only map the specific jobs that require sensitive data to the protected environment using the environment: keyword in your YAML file. Plan Requirements: While environments are available for all public repositories, they require a GitHub Pro, Team, or Enterprise plan for private repositories. Reference: https://docs.github.com/actions/deployment/targeting-different-environments/using-environments- for-deployment
GH-200 Exam Question 7
You are a DevOps engineer working on deployment workflows. You need to execute the deploy job only if the current branch name is feature-branch. Which code snippet will help you to implement the conditional execution of the job?
Correct Answer: A
"ref_name" refers to the short name of a Git branch or tag, as seen on platforms like GitHub, and is often used in CI/CD workflows to specify which code to build or deploy. For example, when a workflow is triggered by a commit to the feature-branch-1 branch, the github.ref_name would be feature-branch-1. In GitHub Actions: Purpose: github.ref_name is a read-only context variable that contains the short name of the branch or tag that triggered the workflow. Examples: If a workflow is triggered by a commit to the main branch, github.ref_name would be main. If it's triggered by a new tag, such as v1.2.3, github.ref_name would be v1.2.3. Reference: https://docs.github.com/en/actions/reference/workflows-and-actions/contexts
GH-200 Exam Question 8
In GitHub Enterprise Cloud, where do you set the policy that allows only enterprise hosted actions and reusable workflows to run?
Correct Answer: B
The enterprise Actions policy is the centralized place where enterprise owners enforce which actions and reusable workflows are permitted across all organizations in GitHub Enterprise Cloud. From this scope you can require that only actions and reusable workflows hosted within the enterprise are allowed to run, and this policy flows down to organizations and repositories to ensure consistent enforcement.
GH-200 Exam Question 9
In which of the following scenarios should you use self-hosted runners? (Each correct answer presents a complete solution. Choose two.)
Correct Answer: B,C
[B] You can use self-hosted runner to run more than 6 hours job. Self-hosted runners give you the opportunity to persist whatever you like for your jobs and not be subject to the six-hour time-out in hosted virtual environments. [C] Give you more control of hardware, operating system, and software tools than GitHub-hosted runners provide. All runners can run Linux, Windows, or macOS. Reference: https://github.com/orgs/community/discussions/26679 https://docs.github.com/en/enterprise-cloud@latest/admin/managing-github-actions-for-your- enterprise/getting-started-with-github-actions-for-your-enterprise/getting-started-with-self-hosted- runners-for-your-enterprise https://docs.github.com/en/enterprise-cloud@latest/actions/concepts/runners/self-hosted-runners
GH-200 Exam Question 10
When creating and managing custom actions in an enterprise setting, which of the following is considered a best practice?
Correct Answer: A
Managing custom actions Choosing a location for your action If you're developing an action for other people to use, we recommend keeping the action in its own repository instead of bundling it with other application code. This allows you to version, track, and release the action just like any other software. Creating a separate repository for each custom action allows you to manage the versioning independently for each action. This approach provides flexibility, as each action can be updated, tested, and versioned separately, avoiding potential conflicts or dependencies between different actions. Reference: https://docs.github.com/en/actions/how-tos/create-and-publish-actions/manage-custom-actions
