Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
Which files are required for a Docker container action in addition to the source code? (Choose two.)
Dockerfile: The Dockerfile is required for Docker container actions. It defines the environment for the action, specifying the base image, dependencies, and any commands to set up the action's runtime inside the container.
action.yml: The action.yml file is required for all GitHub Actions, including Docker container actions. It contains metadata about the action, including the inputs, outputs, and the runtime environment (which in this case is Docker, defined under runs.using).
As a DevOps engineer, you are developing a composite action. You have a step that needs to be executed against a subdirectory. Which code snippet should you use within the composite action to specify the directory?
For a composite action, commands are defined inside the runs.steps section of the action metadata file. When a specific command must execute from a particular folder, the correct key is working-directory, and it must be applied at the individual run step level. Option D is correct because it keeps using: 'composite' at the runs level and applies working-directory: ${{ inputs.dir }} directly to the step that runs the script. Option A is incorrect because directory is not a valid GitHub Actions run-step key. Option B incorrectly places directory at the runs level. Option C uses the right keyword but places it at the wrong level. This tests composite action metadata syntax and correct step-level execution configuration.
You are reaching your organization's storage limit for GitHub artifacts and packages. What should you do to prevent the storage limit from being reached? (Choose two.)
Deleting artifacts from repositories manually will free up storage space. Artifacts are typically stored for a limited time by default, but manual cleanup can help manage space.
Configuring the artifact and log retention period allows you to control how long artifacts and logs are retained in your repository. By shortening the retention period, you can prevent unnecessary accumulation of data and manage storage more effectively.
How can GitHub Actions encrypted secrets be used in if: conditionals within a workflow job?
GitHub Actions encrypted secrets can be accessed in workflows using the secrets context. You can directly reference the secret within an if: conditional using ${{ secrets.MySuperSecret }} to determine whether a job or step should run based on the secret's value.
What are the advantages of using a matrix strategy in a job definition? (Choose two.)
A matrix strategy allows you to define different versions of a programming language (or any other environment setting) and run tests on each version simultaneously. This is particularly useful for testing code compatibility across different versions of a language.
A matrix strategy can also be used to test code on multiple operating systems (e.g., Windows, macOS, Linux) by defining these operating systems as matrix variables. This enables cross-platform testing within the same workflow.
As a developer, how can you identify a JavaScript action on GitHub?
A JavaScript action is identified in its action metadata file by the runs.using runtime value. In older exam-style content, this is commonly shown as node16; in current GitHub documentation, supported JavaScript runtimes have moved forward, but the principle remains the same: JavaScript actions declare a Node.js runtime under runs.using and specify the main JavaScript file under runs.main. Option A is not reliable because a repository can contain package.json without being a JavaScript action. Option B is unrelated because workflow files do not define the action type. Option C is naming-based and has no technical meaning. GitHub metadata syntax defines runs.using as the runtime for JavaScript actions.
As a developer, you have a 10-MB data set that is required in a specific workflow. Which steps should you perform so the dataset is stored encrypted and can be decrypted during the workflow? (Choose three.)
First, the dataset should be encrypted before being stored. This ensures that the data is protected when stored in a repository.
The encrypted dataset can be stored in a GitHub secret, ensuring it is securely kept and not exposed publicly.
The encryption key needed to decrypt the dataset should also be stored in a GitHub secret to maintain security during the workflow, allowing access only when needed.
Exam domains verified against: Official Microsoft GH-200 exam guide, last checked October 2026.
Configure workflow triggers for scheduled, manual, webhook, and repository events. Use jobs, steps, conditional logic, and strategy/matrix to generate job variations across OS and runtime versions. Implement YAML anchors and aliases to reuse mappings, and leverage predefined contexts like github, runner, env, and secrets to access workflow metadata and prevent secret leakage in logs.
Identify workflow triggers and diagnose failed runs using logs and run history. Expand YAML anchors and interpret matrix expansions to correlate job names to matrix axes. Locate workflows, artifacts, and logs in the UI and via API, then download and manage artifacts as needed.
Sample question from this domain above: Q5
Identify and implement action types: JavaScript, Docker, and composite. Specify required files, directory structure, and metadata, then implement workflow commands within actions. Select distribution models (public, private, or marketplace) and apply versioning and release strategies.
Sample question from this domain above: Q4
Define and manage reusable components and templates. Configure and monitor GitHub-hosted and self-hosted runners, apply IP allow lists, manage runner groups, and identify preinstalled software versions. Define and scope encrypted secrets and variables at organization, repository, and environment levels, then access and manage them programmatically via REST APIs.
Use environment protections and approval gates. Identify trustworthy actions from the Marketplace and mitigate script injection through input sanitization and least-privilege permissions. Pin third-party actions to full commit SHAs, configure granular GITHUB_TOKEN permissions, and use OIDC tokens for cloud provider federation to eliminate long-lived secrets. Generate and verify artifact attestations for deployment verification.
Common questions about the exam itself
