GH-100 Microsoft Exam Questions and Answers

Question 1

A token was used to access an organization's resource via API. What fields in the audit log help determine who used it?

A. The token's permissions and the geographic region of access
B. The token expiration date
C. The GitHub Actions runner name
D. The token ID, requesting IP address, and associated user

Answer : D

Question 2

What will happen if Dependabot discovers a vulnerable transitive dependency in a repository?

A. It creates a pull request to update the direct dependency to a version that resolves the vulnerability.
B. It opens a pull request to update the affected package directly, regardless of version compatibility.
C. It automatically removes the package from the repository.
D. It sends an email to the repository owner but does not alter code.

Answer : A

Question 3

Which GitHub feature is responsible for tracking dependencies and known vulnerabilities in those dependencies from an advisory database?

A. Repository Insights
B. Dependency Graph
C. Security Policy
D. CodeQL

Answer : B

Question 4

Which events from the audit log are exposed by the GraphQL API? Each answer presents a complete solution. (Choose three.)

A. changes in permissions
B. promoting users to administrators
C. pushes to repositories
D. changes to permissions of a GitHub App
E. cloning of repositories

Answer : ABD

Question 5

When a token is used to perform actions across different GitHub resources, how is this reflected in audit logs?

A. Each API action made with the token generates a separate audit log entry
B. Only the first repository accessed is recorded
C. GitHub creates a ZIP archive of all token activity
D. The audit log stores only the token name and not its actions

Answer : A

Question 6

Which practice helps avoid service disruption when consuming GitHub APIs at scale?

A. Designing your application to work within GitHub's rate limits
B. Using multiple tokens to bypass limits
C. Caching all API responses permanently
D. Ignoring secondary rate limits

Answer : A

Question 7

How does GitHub handle secrets found via secret scanning in a public repository?

A. It alerts the service provider (e.g., AWS, Stripe).
B. It immediately blocks the commit to protect the secret.
C. It deletes the secret from the repository automatically.
D. It notifies the admin via webhook.

Answer : A

Question 8

Our organization is updating its enterprise policies. Which of the following steps should you take to ensure alignment with security requirements?

A. Maintain clear documentation of existing policies and policy changes.
B. Implement the new enterprise policies across the organization first and then consult with the security team to identify any necessary adjustments or retrofits.
C. Implement changes without consulting stakeholders.
D. Regularly assess and adjust policies based on evolving risks.

Answer : AD

Question 9

Which of the following correctly describes the difference between controlling actions at the enterprise level versus the organization level in GitHub?

A. Enterprise policies and organization policies are independent, with organization policies taking precedence for repositories within the organization.
B. Enterprise policies configure mandatory settings for organizations.
C. Enterprise policies apply only to public repositories, while organization policies apply to public, internal, and private repositories.
D. Enterprise policies can block specific actions, while organization policies can only enable or disable actions entirely.

Answer : B

Question 10

What is the potential consequence of enabling multiple rulesets that apply to the same branch in a repository?

A. Only organization-level rulesets are enforced over repository-level ones
B. All applicable rulesets will be evaluated, and their combined rules enforced
C. Only the most recently created ruleset will be enforced
D. Rulesets will override each other, leading to unpredictable behavior

Answer : B

Question 11

In a GitHub repository using Dependabot, which of the following best describes the purpose of the .github/dependabot.yml file?

A. It configures scheduling, package ecosystems, and target directories for update checks.
B. It lists commit SHAs to exclude from automatic pull requests.
C. It enables GitHub to scan for secrets in dependency files.
D. It encrypts dependency versions before storing them in the repo.

Answer : A

Question 12

What is the key benefit of using a GitHub security advisory within a repository?

A. It automatically reverts commits that introduced the vulnerability.
B. It allows maintainers to privately disclose, discuss, and publish vulnerabilities.
C. It flags all forks of the repository as vulnerable.
D. It prevents users from cloning the repository until issues are resolved.

Answer : B

Question 13

How does GitHub support compliance requirements for enterprises?

A. GitHub provides configurable controls such as an audit log, SAML authentication, and enterprise rulesets.
B. GitHub disables all external collaboration features.
C. GitHub only allows those with repository owner (admin) permissions to write changes to repositories.
D. GitHub automatically encrypts user passwords in plaintext for quick access.

Answer : A

Question 14

You discover that a secret (e.g., a token or password) was accidentally committed to a GitHub repository. What is the first step you should take to mitigate the risk?

A. Contact GitHub Support to remove the secret from all forks and clones of the repository.
B. Revoke and/or rotate the secret to render it unusable, then assess whether history rewriting is necessary.
C. Rewrite the repository history using git filter-repo or BFG Repo-Cleaner to remove the secret from all commits.
D. Delete the repository and create a new one to ensure the secret is no longer accessible.

Answer : B

Question 15

Why would someone choose to configure a security policy?

A. To communicate corporate security and compliance policies for end users on a private repository.
B. To provide information on an open source repository for open source collaborators and researchers that may need to report and disclose sensitive security findings to maintainers securely.
C. To prevent anyone from pushing to the repository without approval.
D. To define which open source packages are permitted for use as part of that repository.

Answer : B

GitHub Administration v1.0

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Talk to us!