Microsoft GH-900 Practice Exam Questions & Answers

GitHub automatically subscribes users to conversations when their direct involvement indicates they may need future notifications. Being at-mentioned in a thread subscribes the mentioned user because GitHub treats the mention as a direct request for attention. Opening a pull request also subscribes the author because they own the proposed change and need updates about reviews, comments, checks, and merge activity. Commenting on an issue or pull request subscribes the commenter because they have participated in the conversation and may need follow-up notifications. Deleting a branch does not represent participation in a specific conversation, and changing repository visibility is an administrative repository action rather than a conversation-level activity. Automatic subscriptions help users stay informed about discussions relevant to them.

In GitHub, when viewing the list of projects for an organization, a user can identify a GitHub Projects template by selecting the Templates tab. This tab specifically lists available templates that can be used to create new projects based on predefined structures and workflows.

GitHub Sponsors is a program designed to provide a platform for developers and companies to financially support open-source projects and their maintainers.

Financial Support for Open Source Projects:

Option D is correct because the main purpose of GitHub Sponsors is to allow members of the developer community, including individuals and organizations, to financially support open-source projects and maintainers. This helps sustain open-source development by providing developers with the resources they need to continue their work.

Incorrect Options:

Option A is incorrect because GitHub Sponsors is not based on project popularity (e.g., stars); it is based on voluntary contributions.

Option B is incorrect because while GitHub provides the platform, the purpose of GitHub Sponsors is not for GitHub itself to fund projects, but to enable the broader community to do so.

Option C is incorrect because GitHub Sponsors is not a marketplace for purchasing software but a platform for supporting developers.

GitHub Docs: GitHub Sponsors

The primary purpose of creating a security policy in a GitHub repository is to guide users and contributors on how to report security vulnerabilities in a responsible and secure manner. This policy outlines the preferred method of communication, timelines, and any other pertinent information related to handling security issues.

Security Policy:

Option C is correct because a security policy provides guidelines for responsibly disclosing security vulnerabilities. This helps maintainers respond to and address security concerns promptly and securely, thereby protecting the project and its users.

Incorrect Options:

Option A is incorrect because ensuring peer code review is a best practice for code quality, but it is not the primary purpose of a security policy.

Option B is incorrect because push protection for secrets is managed through repository settings, not the security policy.

Option D is incorrect because customizing Dependabot configuration is related to dependency management, not directly to security policies.

GitHub Docs: Adding a Security Policy to Your Repository

To locate an existing GitHub Action provided by a GitHub-approved vendor, you can use the following methods:

Verification Badge:

Option C is correct because actions provided by GitHub-approved vendors will typically have a verification badge. This badge indicates that the action is from a trusted source, giving users confidence in its security and reliability.

Search the GitHub Marketplace:

Option F is correct because GitHub Marketplace is the official location to find and install actions, including those provided by third-party vendors. You can search for actions by the vendor's name to find the specific one you need.

Incorrect Options:

Option A is not necessary to locate an existing action; creating a workflow file is for implementing the action, not locating it.

Option B is incorrect because searching the vendor's website for a github.yaml index is not a standard practice for finding actions.

Option D is incorrect because installing a GitHub App is unrelated to finding an existing action.

Option E is incorrect because adding a vendor as an allowed Actions Source is a configuration step for using the action, not for locating it.

GitHub Marketplace: Verified Actions