GitHub Administration (GH-100)

Which GitHub deployment option keeps repositories on customer-owned infrastructure that the customer patches and upgrades?

• AGitHub Enterprise Cloud
• BGitHub Enterprise Server
• CGitHub Team
• DGitHub Free for Organizations

Which GitHub Enterprise Cloud feature provisions and centrally controls every user account through your identity provider, with users existing only within your enterprise?

• ASAML SSO with linked GitHub.com accounts
• BEnterprise Managed Users (EMU)
• COAuth App authorization
• DOrganization-level 2FA enforcement

Which role can manage and pay for an organization's subscription without being granted access to repositories or code?

• AOrganization owner
• BBilling manager
• COutside collaborator
• DSecurity manager

An administrator wants to issue a token that can be scoped to a single repository, expires automatically, and requires organization owner approval. Which credential type should they use?

• AClassic personal access token
• BFine-grained personal access token
• CDeploy key
• DOAuth App user-to-server token

Which standard does GitHub Enterprise use to automatically provision and deprovision user accounts from an external identity provider?

• ASAML 2.0
• BOAuth 2.0
• CSCIM 2.0
• DOpenID Connect

An administrator wants to require code review from a specific group whenever any file under /infra changes. Which mechanism should they use?

• AA push ruleset blocking changes to /infra
• BA CODEOWNERS entry mapping /infra to the platform team
• CA required status check for an infra workflow
• DAn organization-level branch protection rule

A team wants to enforce branch protection consistently across many repositories without configuring each repository individually. Which feature should they use?

• ARepository templates
• BRepository rulesets at the organization level
• CCustom repository roles
• DGitHub Actions required workflows

Which built-in repository role is the lowest level that can manage issues and pull requests (assign, close, label) without being able to push code or change settings?

• ARead
• BTriage
• CWrite
• DMaintain

An administrator wants self-hosted runners to be available only to a specific set of repositories within an organization. Which feature should they configure?

• ARunner labels
• BRunner groups
• CAllowed actions policy
• DRunner registration tokens

Which GitHub Actions feature allows a workflow to deploy to AWS without storing long-lived AWS access keys as secrets?

• AGITHUB_TOKEN with workflow permissions
• BOpenID Connect (OIDC) federated identity
• CAn encrypted environment secret
• DA self-hosted runner with an instance role

Which Actions feature lets administrators require manual approval before a deployment job runs, scoped to a named target like 'production'?

• ARepository secrets
• BEnvironments with required reviewers
• CRunner groups
• DConcurrency groups

Which target is supported by GitHub Enterprise audit log streaming?

• AGitHub Issues
• BAzure Event Hubs
• CSlack via webhook
• DJira Service Management

An administrator wants new organization members to be added automatically to a team based on their group membership in the IdP. Which feature should they enable?

• ATeam sync
• BOutside collaborator invitations
• COrganization base permissions
• DGitHub Connect

Which GitHub feature lets an organization restrict access so that a repository can be cloned and authentication can occur only from a defined set of source IP ranges?

• ABranch protection rules
• BIP allow lists
• COAuth App restrictions
• DRepository visibility settings

Which command-line tool is GitHub's recommended interface for scripting administrative tasks such as creating repositories and managing pull requests?

• Agit
• Bgh (GitHub CLI)
• Chub
• Dgha

Which container registry is GitHub's preferred replacement for the legacy docker.pkg.github.com Docker registry?

• ADocker Hub
• BGitHub Container Registry (ghcr.io)
• CAmazon ECR
• DGitHub Packages npm

Which migration tool does GitHub recommend for moving organizations and their repositories from another GitHub product (such as GHES) into GitHub Enterprise Cloud?

• Aghe-migrator on GHES
• BGitHub Enterprise Importer (GEI)
• Cgit-svn
• DBFG Repo-Cleaner

Which utility is bundled with GitHub Enterprise Server for taking and restoring instance-level backups from a separate backup host?

• Aghe-backup-utils
• Brsync-snapshot
• Cghe-importer
• Dghe-snapshot-cli

Which repository visibility option is available only to organizations on GitHub Enterprise Cloud or Enterprise Server and makes a repository visible to all enterprise members?

• APublic
• BPrivate
• CInternal
• DLimited

Which feature lets an organization centrally provide an Actions workflow that selected repositories must run on every push or pull request?

• ARequired workflows in repository rulesets
• BRepository templates
• CComposite actions
• DIssue templates

Where should an organization secret be stored so that all repositories in the org may use it in workflows without each repository owner re-entering the value?

• AEnvironment secret in each repository
• BOrganization-level Actions secret
• CRepository secret in a shared 'secrets' repository
• DGitHub App private key

Which credential type does GitHub recommend for granting an automated system fine-grained, repository-scoped access that does not consume a user license?

• AClassic personal access token from a service account
• BDeploy key with read/write
• CGitHub App installation access token
• DOAuth App user token

Which protection rule, when enabled in a repository ruleset, ensures that all commits merged into the default branch are cryptographically signed by a verified key?

• ARequire linear history
• BRequire signed commits
• CRequire status checks to pass
• DRestrict pushes that create matching refs

Which feature serializes pull request merges into the default branch so that each is rebased and re-tested against the latest base before merging?

• AAuto-merge
• BMerge queue
• CSquash merge
• DRequired status checks

Where should an administrator look first to investigate which user added a deploy key to a repository and when?

• AThe repository's Insights tab
• BThe organization's audit log
• CThe repository's network graph
• DThe user's contributions calendar

Which feature lets an administrator require a specific personal access token policy across an entire enterprise on GitHub Enterprise Cloud?

• AEnterprise-level personal access token policies
• BRepository templates
• CGitHub Apps
• DOAuth App restrictions

Which workflow permission setting would you choose to give the GITHUB_TOKEN read-only access by default and require workflows to explicitly opt in to write?

• APermissive: read and write
• BRestricted: read-only by default
• CAllow only local actions
• DDisable Actions for the organization

An organization wants to allow only actions from verified creators plus a small list of specific third-party actions. Which Actions setting should they configure?

• AAllowed actions and reusable workflows policy
• BRunner labels
• CGITHUB_TOKEN permissions
• DBranch protection rules

Which GitHub Enterprise Cloud option allows a customer to keep repository content, issues, pull requests, and most metadata stored in the European Union?

• AGHEC EU data residency on ghe.com
• BEMU on github.com
• CGitHub Enterprise Server with EU IP allow lists
• DSetting the user's profile timezone to Europe

Which of the following is a valid registry type natively supported by GitHub Packages?

• AHelm chart registry
• BMaven registry
• CPyPI registry
• DCargo registry

An organization wants Codespaces to be created only from a defined list of base machine sizes and to charge usage to a single shared organization account. Which combination of settings should an administrator configure?

• APer-user spending limits and personal Codespaces
• BOrganization Codespaces policies for machine types and an organization-paid Codespaces bi…
• CA self-hosted runner group
• DA repository ruleset

What does setting an organization's base permission to 'Read' do?

• AGrants every member read access to all of the organization's repositories
• BGrants every member read access to public repositories only
• CRemoves write permissions from existing teams
• DForces every repository to be public

Which authentication mechanism is required to access a private repository via the Git protocol over HTTPS when using a service account that has 2FA enforced?

• AThe user's password
• BA personal access token used as the password
• CAn SSH key
• DA SAML assertion

Which combination of features lets an administrator restrict who can publish releases on a repository and require external review before each release deploys?

• AA repository ruleset with restricted tag creation, plus an environment with required revi…
• BBranch protection on main and CODEOWNERS
• CRepository visibility set to internal
• DDisabling the Releases tab

Which of the following best describes a GitHub App's installation access token?

• AA long-lived token issued to a user that can be reused indefinitely
• BA short-lived token (about one hour) generated from the App's private key for a specific…
• CA device-flow code displayed to the user
• DA SAML assertion forwarded by the IdP

Which webhook configuration practice does GitHub recommend to ensure that a receiver can verify that a payload actually came from GitHub?

• ARestrict the webhook URL to a specific IP
• BConfigure a secret on the webhook and validate the X-Hub-Signature-256 HMAC
• CEncrypt the payload body in JSON Web Token format
• DSend only over HTTP

An admin sees 'failed' deliveries for an organization webhook. Which action will most directly help diagnose and recover from intermittent receiver downtime?

• ADelete and recreate the webhook
• BUse the Recent Deliveries view to inspect headers/payloads and use Redeliver
• CLower the secret length
• DSwitch from HTTPS to HTTP

Which capability of GitHub Connect enables a GHES instance to consume content like GitHub-hosted Marketplace actions and the official action.yml from GitHub.com?

• AGitHub Connect 'Server-to-Server replication'
• BGitHub Connect 'GitHub Actions' content sharing
• CRepository transfers
• DOIDC trust

Which administrative role in an organization can manage security alerts (Dependabot, code scanning, secret scanning) across all repositories without being an organization owner?

• ATriage
• BSecurity manager
• COutside collaborator
• DBilling manager

Which command starts an authenticated session for the GitHub CLI in a CI environment using a personal access token?

• Agh login --token TOKEN
• Bgh auth login --with-token < token.txt
• Cgh authenticate TOKEN
• Dgh init

Which feature lets an administrator define a child team that automatically inherits its parent team's repository access?

• ANested teams
• BOutside collaborator groups
• CTeam mentions
• DDiscussions categories

Which scope of a fine-grained personal access token controls reading and writing of repository contents?

• ARepository permission: 'Contents'
• BRepository permission: 'Metadata'
• CAccount permission: 'Email addresses'
• DRepository permission: 'Actions'

Which Actions setting controls whether GitHub-hosted larger runners may be used by the workflows in an organization?

• ARepository visibility
• BLarger runners settings under organization Actions runners
• CCustom repository roles
• DGHES backup schedule

Which two tools together let an organization migrate from Bitbucket Server into GitHub Enterprise Cloud?

• AGitHub Enterprise Importer (GEI) and the bbs-exporter
• Bghe-backup-utils and rsync
• CBFG Repo-Cleaner and gh-pages
• Dgit-svn and git-tfs

Which Actions feature can prevent two deployment workflows from running concurrently against the same environment?

• AJob matrix strategy
• BConcurrency group
• CCache key
• DComposite action

Which of these is a key reason to prefer GitHub Apps over OAuth Apps for organization integrations?

• AGitHub Apps require less configuration in the IdP
• BGitHub Apps have fine-grained, installation-scoped permissions and act with their own ide…
• COAuth Apps cannot use HTTPS
• DOAuth Apps are deprecated and will be removed in 2027

An administrator wants every workflow run to write logs to an external SIEM in near real time. Which is the most appropriate solution?

• APeriodically scrape the GitHub UI
• BConfigure audit log streaming to Splunk or Datadog
• CEmail logs to the SIEM team
• DUse GitHub Pages