GH-200 — GitHub Actions (GH-200) Exam Study Plan

A practical 7-day, 14-day, 30-day, and 60/90-day study plan for the GitHub Actions (GH-200) exam.

How to use this Study Plan

This Study Plan is for candidates preparing for the GitHub GitHub Actions (GH-200) exam, code GH-200. It is built around practical workflow knowledge: reading YAML, predicting workflow behavior, choosing triggers, securing automation, troubleshooting failed runs, and understanding how GitHub Actions fits into CI/CD.

Use the plan that matches your available time. If you are close to exam day, prioritize diagnostic practice, weak-area review, and timed mocks. If you are starting earlier, build a small practice repository and test the concepts instead of only reading about them.

Which plan should you use?

Time until examBest planUse it ifMain goal
7 daysFinal review sprintYou already studied and need structureClose gaps, review missed questions, run timed practice
14 daysFocused planYou know basic GitHub Actions but are inconsistentCover high-yield areas and practice scenarios daily
30 daysBalanced planYou can study most daysLearn, lab, drill, review, and mock under time pressure
60 daysFull preparation pathYou are starting from limited Actions experienceBuild complete workflow fluency before exam review
90 daysExtended pathYou are new to CI/CD or study only a few times weeklyLearn slowly, repeat labs, and add more review cycles

What to schedule for GH-200 preparation

The GH-200 exam is about GitHub Actions, so your study time should not be only memorization. You should be able to read workflow files, reason through event behavior, identify security risks, and troubleshoot failed automation.

Skill areaWhat to practiceEvidence you are ready
Workflow structurename, on, jobs, steps, uses, run, with, envYou can explain what a workflow will do before running it
Events and triggerspush, pull_request, workflow_dispatch, schedule, workflow_call, filtersYou can predict when a workflow will or will not run
Jobs and runnersJob dependencies, needs, runner selection, GitHub-hosted and self-hosted runnersYou can choose the right runner pattern for a scenario
Actions and reuseMarketplace actions, pinned actions, reusable workflows, composite actionsYou can decide when to reuse, compose, or write workflow logic
Expressions and contexts${{ }}, contexts, functions, conditions, job outputsYou can trace values across steps and jobs
Secrets and variablesRepository, organization, environment secrets and variablesYou know what belongs in secrets, variables, and environment protection
Permissions and securityGITHUB_TOKEN, least privilege, OIDC, forked PR risk, action pinningYou can spot unsafe workflow patterns
Artifacts and cachingUpload/download artifacts, dependency caching, cache keysYou can choose between artifact storage and cache reuse
Deployment workflowsEnvironments, approvals, deployment jobs, release workflowsYou can design a controlled deployment workflow
TroubleshootingLogs, annotations, reruns, debug logging, YAML mistakesYou can identify the likely cause of a failed run
Administration and governanceRepository/org Actions settings, allowed actions, runner groupsYou understand common policy and control scenarios

Daily practice rhythm

Use the same rhythm regardless of your timeline. Adjust the length, not the sequence.

If you have 45 minutes

TimeActivity
5 minReview yesterday’s missed-question log
15 minDrill one narrow topic, such as triggers or permissions
15 minRead or edit one workflow example
10 minAnswer practice questions and record misses

If you have 90 minutes

TimeActivity
10 minRework missed questions without looking at answers
25 minStudy one objective cluster
25 minHands-on workflow practice in a test repository
20 minTimed question set
10 minUpdate weak-area list

If you have 2 hours or more

TimeActivity
15 minMissed-question review
35 minConcept review
35 minHands-on workflow build or troubleshooting lab
25 minTimed practice set
10 minSummarize rules, traps, and YAML patterns

Missed-question review method

Do not only mark questions as right or wrong. For GH-200, the important step is finding why your mental model failed.

Use this review table after every practice session.

FieldWhat to write
TopicExample: reusable workflows, pull_request, environments, caching
Question typeSyntax, security, troubleshooting, scenario choice, trigger behavior
Why I missed itMisread YAML, forgot context, confused artifact/cache, guessed
Correct ruleOne sentence in your own words
ProofLink to your lab result, notes, or corrected workflow example
Retest date2 to 4 days later

Common missed-question causes:

CauseFix
Memorized syntax but cannot trace executionDraw job order and dependencies before answering
Confused similar featuresMake compare tables: cache vs artifact, secret vs variable, composite vs reusable workflow
Ignored security contextAlways check event type, token permissions, secrets exposure, and fork behavior
Overlooked conditionsTrace if, needs, job outputs, and matrix expansion
Read the answer too quicklyExplain why each wrong option is wrong

Baseline diagnostic before you start

Before choosing daily topics, take a short diagnostic set or one small timed quiz.

Do not use the diagnostic to judge whether you are “ready.” Use it to decide where to spend time.

Diagnostic resultWhat it meansFirst adjustment
Weak on YAML structureYou need workflow-reading practiceBuild and annotate simple workflows
Weak on eventsYou need trigger scenario drillsCompare push, pull_request, manual, schedule, and reusable triggers
Weak on securityYou need focused security reviewStudy permissions, secrets, OIDC, forks, and action pinning
Weak on troubleshootingYou need log and failure practiceBreak workflows intentionally and fix them
Weak across all areasUse the 30-day or 60/90-day pathAvoid rushing straight to full mocks

7-day final review sprint

Use this plan if your exam is one week away. It assumes you have already studied GitHub Actions and now need structured review.

Stop adding large new topics after Day 5. Days 6 and 7 are for review, confidence, timing, and error reduction.

DayFocusStudy actionsOutput
1Diagnostic and triageTake a timed diagnostic set. Review every missed question. Sort misses by topic.Ranked weak-area list
2Workflow syntax and triggersReview on, filters, manual triggers, schedules, and reusable workflow triggers. Read several YAML examples.Trigger comparison notes
3Jobs, runners, matrices, and reuseDrill needs, matrix strategy, job outputs, reusable workflows, and composite actions.Job-flow diagrams
4Security and permissionsReview GITHUB_TOKEN, permissions, secrets, variables, OIDC, environments, forked PR risks, and action pinning.Security checklist
5Troubleshooting, artifacts, cache, deploymentsPractice logs, reruns, failed steps, cache/artifact decisions, environment protection, and deployment patterns.Error-pattern list
6Timed mock and deep reviewTake a full timed mock or the longest available timed set. Spend longer reviewing than testing.Final weak-area sprint list
7Light final reviewRework missed questions. Review notes, compare tables, and high-risk YAML patterns. Stop heavy studying early.Exam-day checklist

7-day priority order

If time is very limited, study in this order:

  1. Security and permissions.
  2. Trigger behavior and workflow events.
  3. Jobs, dependencies, matrices, and reusable workflows.
  4. Secrets, variables, environments, and deployments.
  5. Artifacts, caching, and troubleshooting.
  6. Administration and governance scenarios.

14-day focused plan

Use this plan if you have two weeks and can study most days. The goal is to cover the core GH-200 skills, run targeted labs, and complete at least one timed mock review cycle.

DayMain topicPractice task
1DiagnosticTake a baseline quiz. Create a weak-area tracker.
2Workflow anatomyRead and write workflows with on, jobs, steps, uses, run, with, and env.
3Events and filtersPractice trigger scenarios: branch filters, path filters, manual runs, schedules, and PR events.
4Jobs and dependenciesPractice needs, job-level conditions, step-level conditions, and job outputs.
5RunnersCompare GitHub-hosted and self-hosted runner scenarios, labels, groups, and security implications.
6Actions and reuseReview marketplace actions, version pinning, composite actions, and reusable workflows.
7Timed checkpointTake a timed set. Review misses fully. Do not skip explanations for correct guesses.
8Contexts and expressionsDrill ${{ }}, contexts, functions, status checks, environment variables, and outputs.
9Secrets, variables, and environmentsPractice deciding where data belongs and how environment protection affects deployment.
10Permissions and secure automationReview permissions, GITHUB_TOKEN, OIDC, forked PRs, and safe third-party action use.
11Artifacts, cache, and packages/release workflowsCompare artifact retention use cases, dependency caching, and build output movement.
12TroubleshootingReview logs, annotations, reruns, debug options, skipped jobs, and common YAML failures.
13Full timed mock or long timed setSimulate exam timing. Flag uncertain answers. Review by topic.
14Final reviewRework all missed questions. Review checklists. Stop adding new material.

30-day balanced plan

Use this plan if you have about one month. It gives you enough time to learn, lab, review, and improve timing.

Week 1: Build the foundation

DayFocusActions
1DiagnosticTake a baseline quiz and set up your missed-question log.
2Workflow basicsWrite simple workflows with multiple jobs and steps.
3EventsPractice common triggers and filters. Predict whether workflows run.
4YAML readingAnnotate workflows line by line. Identify job order and conditions.
5RunnersStudy GitHub-hosted vs self-hosted runners and runner selection.
6Mini-labBuild a workflow that tests, builds, and uploads an artifact.
7ReviewTimed quiz plus review of all misses from the week.

Week 2: Control flow, reuse, and data movement

DayFocusActions
8DependenciesPractice needs, job outputs, and conditional jobs.
9Matrix strategyBuild a matrix workflow and reason through expansion behavior.
10ContextsDrill GitHub, job, steps, runner, matrix, inputs, and secrets contexts.
11ExpressionsPractice if, status functions, string checks, and expression syntax.
12Reusable workflowsPractice workflow_call, inputs, secrets, and outputs.
13Composite actionsCompare composite actions with reusable workflows.
14CheckpointTimed set and detailed review. Update weak-area ranking.

Week 3: Security, deployments, and governance

DayFocusActions
15Secrets and variablesCompare repository, organization, and environment-level data use.
16Token permissionsPractice least-privilege permissions blocks and risky defaults.
17OIDC and cloud auth conceptsUnderstand when OIDC is preferable to long-lived secrets.
18Forks and PR securityReview pull_request, pull_request_target, secret exposure, and untrusted code.
19EnvironmentsPractice deployment jobs, required reviewers, and environment secrets.
20GovernanceReview allowed actions, policy settings, runner controls, and audit-style scenarios.
21Mock exam 1Take a timed mock. Review every miss and every guess.

Week 4: Troubleshooting and final readiness

DayFocusActions
22Logs and rerunsPractice reading failed runs, rerunning jobs, and locating failure causes.
23Artifacts and cacheCompare use cases, keys, restore behavior, and build output handling.
24Deployment/release scenariosTrace CI/CD workflows from commit to deployment.
25Weak-area sprint 1Study your two weakest topics only.
26Weak-area sprint 2Rework missed questions and rebuild failed labs.
27Mock exam 2Take another timed mock or long timed set.
28Mock reviewCategorize misses and update final notes.
29Final consolidationReview compare tables, security checklist, and trigger behavior.
30Light reviewNo large new topics. Rework misses and prepare exam-day routine.

60/90-day full preparation path

Use this path if you are starting early, are new to GitHub Actions, or need more hands-on practice.

60-day version

PhaseDaysGoalWhat to do
Foundation1-10Understand workflow structureLearn YAML anatomy, triggers, jobs, steps, and runners
Core workflow behavior11-20Predict executionPractice events, filters, conditions, dependencies, matrix jobs, and outputs
Reuse and maintainability21-28Organize automationStudy marketplace actions, pinned versions, reusable workflows, and composite actions
Security and deployment29-40Secure CI/CDReview permissions, secrets, variables, environments, OIDC, and forked PR risks
Troubleshooting and governance41-48Diagnose and administerPractice logs, reruns, skipped jobs, policy settings, runner controls, artifacts, and cache
Exam practice49-56Convert knowledge into exam performanceTimed question sets, mock exam, missed-question review
Final review57-60StabilizeRework misses, review checklists, stop adding new material

90-day version

For a 90-day schedule, stretch the 60-day path and add review loops.

Added timeHow to use it
Extra 10 daysBuild more workflows from scratch instead of only reading examples
Extra 10 daysRepeat weak topics after a one-week delay to improve retention
Extra 5 daysAdd troubleshooting labs by intentionally breaking workflows
Extra 5 daysAdd an additional timed mock and review cycle

A 90-day candidate should still use the final 14 days as a focused exam-prep block. Do not let the longer timeline delay timed practice.

Hands-on practice checklist

Create a small private practice repository and build workflows that cover the common GH-200 scenarios. Keep each lab short and write down what happened.

LabWhat to buildWhat to learn
Basic CI workflowRun tests on push and pull requestWorkflow structure and trigger behavior
Branch/path filtersTrigger only for selected branches or changed pathsEvent filtering and skipped workflow causes
Matrix buildTest across multiple versions or configurationsMatrix expansion and failure behavior
Job dependency workflowBuild, test, then deploy using needsJob order, outputs, and conditions
Artifact workflowUpload build output and download it in another jobArtifact use cases
Cache workflowCache dependencies with a sensible keyCache vs artifact decisions
Reusable workflowCall a workflow with inputs and secretsworkflow_call behavior
Composite actionMove repeated shell steps into an actionComposite action purpose and limitations
Deployment environmentUse an environment with secrets and protectionControlled deployments
Least-privilege workflowSet explicit permissionsSecure GITHUB_TOKEN usage
OIDC concept labReview token-based cloud authentication flowWhy short-lived credentials matter
Troubleshooting labBreak YAML, permissions, cache, or dependenciesLog reading and failure isolation

Compact workflow example to study

Use small examples like this to practice reading workflow behavior. Do not memorize this file; explain each line.

name: ci

on:
  pull_request:
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version: [18, 20]
    steps:
      - uses: actions/checkout@v4

      - name: Set up Node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Run tests
        run: npm test

Questions to ask when reviewing any workflow:

  1. What event starts it?
  2. Are branch or path filters involved?
  3. What token permissions are granted?
  4. What jobs run in parallel?
  5. What jobs depend on other jobs?
  6. Which values come from contexts, inputs, variables, or secrets?
  7. Could this expose secrets to untrusted code?
  8. What artifact, cache, or deployment state is created?
  9. What would you check first if it failed?

High-yield comparison tables

Cache vs artifact

FeatureCacheArtifact
Primary purposeReuse dependencies or generated data between runsPreserve and share files from a workflow run
Common usePackage manager dependenciesBuild output, reports, logs
Key decisionIs this reusable acceleration data?Is this an output someone or another job needs?
Exam trapTreating cache as permanent storageUsing artifacts for dependency speedup

Secret vs variable

FeatureSecretVariable
Use forSensitive valuesNon-sensitive configuration
ExampleToken, password, private keyRegion name, feature flag, environment label
Exam trapPutting sensitive data in variablesUsing secrets for ordinary configuration

Composite action vs reusable workflow

FeatureComposite actionReusable workflow
Best forReusing step logicReusing job or workflow patterns
Called withuses as a stepworkflow_call from a workflow
ScopeStepsJobs/workflow
Exam trapExpecting a composite action to replace full workflow orchestrationUsing reusable workflows for small repeated shell steps

pull_request vs pull_request_target

EventRuns in context ofSecurity note
pull_requestPull request code and event contextSafer default for untrusted contributions, but secrets may be limited
pull_request_targetBase repository contextRequires caution because it can access more privileged context

For exam scenarios, always ask whether code is trusted before choosing an event or granting secrets.

Timed mock exam strategy

Timed practice should start earlier than the final week. Waiting too long hides pacing and question-reading problems.

TimelineWhen to use timed mocksHow to review
7-day planDay 1 diagnostic and Day 6 mockSpend more time reviewing than testing
14-day planDay 7 checkpoint and Day 13 mockTrack misses by topic and cause
30-day planDays 21 and 27, with shorter timed sets weeklyCompare first-mock and second-mock weak areas
60/90-day planAfter core content, then weekly near the endUse mocks to guide final sprints

During a timed mock:

  1. Answer easier questions first if the platform allows navigation.
  2. Flag questions where two options seem plausible.
  3. Do not change answers unless you find a specific reason.
  4. After the mock, review:
    • wrong answers,
    • correct guesses,
    • slow questions,
    • questions missed because of wording.

Troubleshooting review checklist

GH-200 candidates should be comfortable diagnosing why a workflow did not behave as expected.

SymptomWhat to check
Workflow did not startEvent name, branch filters, path filters, workflow file location, disabled workflow
Job skippedif condition, needs result, event context, matrix include/exclude
Step failedCommand exit code, missing dependency, working directory, permissions
Secret unavailableEvent type, fork behavior, environment protection, secret scope
Permission deniedpermissions block, token scope, repository settings, organization policy
Cache missCache key, restore keys, dependency file changes, OS differences
Artifact missingUpload step result, artifact name, job boundary, retention assumptions
Reusable workflow failedInputs, secrets mapping, caller/callee permissions, output references
Deployment blockedEnvironment rules, required reviewers, branch restrictions, secret availability

Useful GitHub CLI commands for hands-on review, if you use the GitHub CLI:

gh workflow list
gh workflow run ci.yml
gh run list
gh run view --log
gh run rerun

Security review checklist

Security is a major practical theme in GitHub Actions preparation. Review it repeatedly.

AreaQuestions to ask
Token permissionsIs GITHUB_TOKEN limited to the permissions the job needs?
Third-party actionsIs the action from a trusted source and pinned appropriately?
SecretsAre secrets only available to trusted workflows and environments?
Forked pull requestsCould untrusted code access sensitive data or privileged tokens?
OIDCCould short-lived identity-based credentials replace stored cloud secrets?
Self-hosted runnersCould untrusted code persist or access sensitive resources on the runner?
EnvironmentsAre approvals and environment-specific secrets used for deployments?
LogsCould scripts accidentally print secrets or sensitive values?

When to stop adding new material

Time leftRule
14+ daysYou can still add new topics, but test them with practice questions
7 daysAdd only high-yield topics tied to missed questions
3 daysStop broad new learning; focus on weak-area repair
24 hoursLight review only; no full new labs or deep documentation dives

The final days should improve accuracy, not create new confusion.

Final-week rules

Use these rules during the last week for any timeline.

  1. Review missed questions every day.
  2. Rework questions before reading the explanation.
  3. Keep a one-page list of:
    • trigger rules,
    • security traps,
    • reusable workflow patterns,
    • cache vs artifact differences,
    • troubleshooting checks.
  4. Do at least one timed session under realistic conditions.
  5. Do not judge readiness only by raw score; inspect whether misses are repeated or isolated.
  6. Sleep and pacing matter. Avoid a late-night cram session before the exam.

Exam-readiness checks

You are in a good position for the GitHub Actions (GH-200) exam when you can do the following without relying on notes.

Readiness checkYes/No
I can read a workflow YAML file and predict when it runs.
I can explain job order, needs, conditions, and matrix behavior.
I can compare artifacts, caches, variables, secrets, and environments.
I can identify risky use of secrets, tokens, fork events, and third-party actions.
I can choose between composite actions and reusable workflows.
I can troubleshoot common workflow failures from logs and symptoms.
I can answer timed scenario questions without rushing or rereading excessively.
My missed-question log shows fewer repeated errors in my weakest topics.

Practical next step

Choose the schedule that matches your exam date, take a diagnostic practice set, and build your weak-area list today. Then study in short daily cycles: review misses, practice one GitHub Actions topic, complete hands-on workflow work, and finish with timed questions.

Browse Certification Practice Tests by Exam Family