GitHub Actions GH-200 Practice Test & Mock Exam
Practice GitHub Actions (GitHub Actions GH-200) in IT Mastery with focused sample pages, topic drills, timed mock exams, detailed explanations, and the current question bank.
Use IT Mastery for interactive practice with timed mocks, topic drills, progress tracking, and detailed explanations across web and mobile. The free-practice page previews how this exam handles workflow YAML, CI/CD behavior, action reuse, troubleshooting, permissions, security, scale, and optimization.
Practice preview
Use this page to start the web app before longer mixed practice. For a public question-style check, use the quick review and the free-practice page in this exam section; the interactive app remains the primary practice path.
- cheat sheet : Workflows, events, jobs, runners, security, reusable workflows, artifacts, caches, and common exam traps.
- Free practice exam : Try 50 free GitHub Actions (GitHub Actions GH-200) questions across the exam domains, with explanations, then continue with IT Mastery practice.
What this GH-200 practice page gives you
- a direct web entry for GitHub Actions practice in IT Mastery
- a full-length free-practice page for previewing question style
- workflow YAML, runner, reusable action, deployment, permissions, and troubleshooting drills
- a clear web preview path for previewing question style before deeper practice
- the same IT Mastery account across web and mobile
GitHub Actions snapshot
- Vendor: GitHub
- Credential name: GitHub Actions
- Microsoft Learn study-guide code: GH-200
- Level shown by Microsoft Learn: Intermediate
- Exam time shown by Microsoft Learn: 100 minutes
- IT Mastery practice modes: topic drills, mixed sets, timed mocks, detailed explanations, and progress tracking
- Current IT Mastery status: live practice available
Topic coverage for Actions practice
| Area | What to practise |
|---|---|
| Author workflows | triggers, jobs, steps, runners, matrices, environments, permissions, and reusable workflows |
| Consume and troubleshoot workflows | logs, artifacts, caching, concurrency, failures, reruns, and debugging strategy |
| Author and maintain actions | composite actions, JavaScript actions, Docker actions, inputs, outputs, versioning, and reuse |
| Enterprise management | policies, runner groups, billing awareness, organization settings, and operational governance |
| Secure and optimize automation | secrets, token permissions, dependency risk, least privilege, performance, and reliability |
GitHub Actions workflow map
Use this map to reason through most GitHub Actions questions. Start with the event, then follow the workflow into jobs, runners, permissions, secrets, and deployment controls.
flowchart LR
Event["Event trigger"] --> Workflow["Workflow file"]
Workflow --> Jobs["Jobs"]
Jobs --> Runner["Runner"]
Jobs --> Steps["Steps"]
Steps --> Actions["Actions or shell commands"]
Workflow --> Permissions["GITHUB_TOKEN permissions"]
Workflow --> Secrets["Secrets and variables"]
Jobs --> Environment["Environment gates"]
Environment --> Deployment["Deployment"]
Permissions --> Risk["Least-privilege risk check"]
Secrets --> Risk
Actions exhibit patterns to practise
GitHub Actions questions often include a short workflow, log excerpt, policy setting, or runner detail. Read the exhibit from top to bottom: identify the trigger first, then check job scope, permissions, runner context, secrets, and the artifact/cache behavior the question is testing.
| Exhibit type | What to inspect first |
|---|---|
| Workflow YAML | on, permissions, jobs, runs-on, strategy, and deployment environment |
| Failure log | first failing command, exit code, missing secret, path mismatch, or denied token scope |
| Permissions block | whether the GITHUB_TOKEN has only the scopes required for the job |
| Runner labels | whether the job is using GitHub-hosted or self-hosted infrastructure correctly |
| Cache key | whether the key changes when dependencies or the runner OS changes |
| Artifact step | whether the file is produced before upload and downloaded by the later job |
Example workflow exhibit:
on:
pull_request:
paths:
- "src/**"
permissions:
contents: read
pull-requests: write
jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- run: npm ci
- run: npm test
Best reading: this workflow is pull-request scoped, path-filtered, and uses limited token permissions. It should not be treated as a deployment workflow unless a later job adds environment gates and trusted credentials.
Example failure-log exhibit:
Run npm test
Error: Cannot find module '@acme/shared-config'
Process completed with exit code 1.
Best first check: compare the runner install step, lock file, package registry authentication, workspace path, and cache restore result before changing the test command.
Example deployment-control exhibit:
| Setting | Why it matters |
|---|---|
environment: production | can require reviewers and expose production-scoped secrets only after approval |
concurrency.group: production | prevents overlapping production deployment runs |
cancel-in-progress: false | avoids canceling an already-started production deployment automatically |
permissions.contents: read | avoids broad repository write access unless a deployment step truly needs it |
GH-200 decision filters
Use these filters when a workflow answer looks correct but incomplete:
- Trigger and scope: inspect
on, branch filters, path filters, and event context before changing jobs or steps. - Job boundary: separate job-level permissions, runner labels, matrices, dependencies, environments, and artifacts from step-level commands.
- Reuse mechanism: distinguish reusable workflows, composite actions, JavaScript actions, Docker actions, and shared shell snippets.
- Security baseline: check
GITHUB_TOKENpermissions, secrets, OIDC, environment protection, dependency risk, and untrusted pull request behavior. - Troubleshooting evidence: read logs, exit codes, file paths, cache keys, artifact names, and runner context before rewriting workflow logic.
Final 7-day GH-200 practice sequence
| Day | Practice focus |
|---|---|
| 7 | Open the web app for a timed mixed set, then use the public diagnostic page if you need to tag misses as authoring, troubleshooting, actions, enterprise, or security. |
| 6 | Drill workflow syntax, triggers, jobs, matrices, reusable workflows, environments, and permissions. |
| 5 | Drill logs, cache behavior, artifacts, concurrency, reruns, runner labels, and failure analysis. |
| 4 | Drill custom actions, inputs, outputs, versioning, and when to use composite, JavaScript, or Docker actions. |
| 3 | Drill secrets, OIDC, token permissions, untrusted PRs, branch protection, and secure deployment controls. |
| 2 | Complete a timed mixed set and explain which workflow boundary drove each miss. |
| 1 | Review weak YAML patterns and exhibit-reading mistakes; avoid late memorization of random syntax. |
When GH-200 practice is enough
Use varied mixed attempts to identify weak topics, correct guesses and answers you recognize. A practice percentage is not a validated prediction of passing; compare your work with the current official outline and use the study and review guidance to plan the next step. More practice should improve workflow reasoning, not make you memorize repeated YAML snippets.
Free study resources
Use this IT Mastery page for live practice, topic drills, timed mocks, explanations, and app access.
Web preview and premium practice
- Web/public preview: the free-practice page and web app entry so you can validate the question style and explanation depth.
- Premium: interactive web-app practice with focused drills, mixed sets, timed mock exams, detailed explanations, and progress tracking across web and mobile.
Mini Glossary
- Action: A reusable unit of automation used inside a workflow step.
- Artifact: A file or bundle uploaded from a workflow run for later jobs, review, or download.
- Cache: Reused dependency or build data intended to speed up future runs.
- Environment: A deployment target that can have reviewers, wait timers, and scoped secrets.
- Job: A set of steps that run on the same runner.
- Matrix: A strategy that expands a job across combinations such as operating systems or language versions.
- Reusable workflow: A workflow called by another workflow at the job level.
- Runner: The machine that executes workflow jobs, either GitHub-hosted or self-hosted.
- Secret: Encrypted sensitive value exposed to workflows only under allowed contexts.
- Workflow: A YAML automation file stored under
.github/workflows/.
Good related routes
- GitHub Foundations if you need GitHub basics first
- Terraform Associate if your DevOps path includes infrastructure automation
Official sources
In this section
- GH-200 — GitHub Actions Cheat SheetCompact GitHub Actions (GH-200) Cheat sheet for workflow syntax, triggers, runners, security, reuse, artifacts, caching, and troubleshooting.
- GH-200 — GitHub Actions (GH-200) Exam Study PlanA practical 7-day, 14-day, 30-day, and 60/90-day study plan for the GitHub Actions (GH-200) exam.
- GH-200 — GitHub Actions (GH-200) Exam BlueprintPractical exam blueprint for GitHub Actions (GH-200), including workflow authoring, actions, security, runners, governance, and final-review readiness prompts.
- GH-200 — GitHub Actions (GH-200) Exam Scenario Practice GuidePractice reading GitHub Actions scenarios, finding constraints, and choosing defensible workflow, runner, security, and CI/CD answers.
- Free GitHub Actions GH-200 Practice Exam: GitHub ActionsTry 50 free GitHub Actions (GitHub Actions GH-200) questions across the exam domains, with explanations, then continue with IT Mastery practice.
- GH-200 — GitHub Actions (GH-200) Exam Official ResourcesFind what to verify for the GH-200 GitHub Actions exam and how to use official GitHub resources with independent practice.