Pass the Microsoft GitHub Administrator GH-200 Questions and answers with Dumpstech

GitHub ' s REST API provides a dedicated Download workflow run logs endpoint. The request uses the HTTP GET method and the path /repos/{owner}/{repo}/actions/runs/{run_id}/logs. GitHub responds with a redirect to an archive containing the log files for that workflow run. The endpoint requires the repository owner, repository name, and workflow run ID. For private repositories, the caller must authenticate with appropriate repository or Actions read permissions. A POST request is not used because retrieving logs is a read operation. The artifacts endpoint manages workflow artifacts rather than workflow execution logs. Therefore, option A exactly matches the current GitHub REST API endpoint documented for downloading the log archive associated with a workflow run.

================

When a workflow job targets an environment that has required reviewers, the job enters a waiting state until it is approved or rejected. GitHub Actions does not allow that waiting state to remain indefinitely. If the job is not approved within the allowed period, the workflow fails automatically. The correct duration is 30 days, making option C correct. Options A, B, and D do not match the GitHub Actions environment approval behavior. This is important for deployment governance because required reviewers can block access to protected environments and environment secrets, but pending approvals still have a maximum lifetime. This exam topic aligns with protected environments, deployment approvals, required reviewers, and workflow execution control.

================

The pull_request event supports activity-type filtering, including the labeled activity, so a workflow can respond when a label is added to a pull request. The branches filter limits execution according to the pull request ' s target or base branch, while the paths filter limits execution according to changed files. GitHub also states that when branch and path filters are both configured, both conditions must be satisfied . Therefore, a pull request targeting releases, containing a change beneath apps/**, and receiving a label matches option C. pull_request_review concerns review activity rather than labeling, and pull_request_label is not a GitHub Actions workflow event. Option B also uses filters that do not accurately represent the stated exact branch and folder requirement.

================

GitHub secrets are defined at different levels: organization, repository, and sometimes at the workflow level. If a secret is defined at both the organization level and the repository level, the repository-level secret will take precedence. So, if the value of the secret differs between these levels, the workflow will use the value from the repository level instead of the organization level.

GitHub Enterprise Cloud can share actions and reusable workflows stored in an internal repository with workflows in other internal or private repositories. Access can be configured for repositories within the same organization or, where enterprise access is selected, repositories in organizations owned by the enterprise. Public repositories are deliberately excluded from this internal-action sharing model. GitHub explicitly states that actions and reusable workflows stored in internal repositories cannot be used by public repositories. The repository containing the action must also have its Actions Access setting configured appropriately; internal visibility alone does not automatically override that access control. Therefore, internal repositories and private repositories within the permitted organization or enterprise are the valid consumers, while both public-repository choices are incorrect.

================

For a JavaScript action using the official @actions/core toolkit, core.setFailed(error.message) is the documented method for reporting an exception and marking the action as failed. setFailed() logs the supplied message and sets a failing exit code so GitHub records the action and associated check run as unsuccessful. Neither core.setException() nor core.action.setException() exists in the supported @actions/core API, and action.setError() is likewise not the documented error-handling method. The source PDF visibly contains the first three choices but crops the final distractor; the missing fourth choice was reconstructed from the matching public GH-200 question listing, while the correct answer itself was independently verified against GitHub ' s official documentation. GitHub ' s JavaScript-action example uses this exact catch pattern.

================

A reusable workflow stored in another repository must be referenced using the repository owner, repository name, required .github/workflows/ directory, workflow filename, and a ref. GitHub documents the syntax as {owner}/{repo}/.github/workflows/{filename}@{ref}. Option B exactly follows this structure: octo-org identifies the owner, another-repo identifies the repository, the workflow resides under .github/workflows, and v1 supplies the branch, tag, or other valid ref. Options A and C omit the required .github/workflows path. Option D includes that directory but omits the repository owner, so it is not a valid cross-repository reference. Reusable workflows are invoked with jobs. < job_id > .uses, rather than through an ordinary step-level action reference. Therefore, option B is the only correctly formed external reusable workflow reference.

================

JavaScript action metadata supports the runs.pre property for specifying a script that executes before the action ' s main entry point. The optional runs.pre-if property controls whether that pre-script executes. Therefore, option B uses the correct metadata structure: pre identifies start.js, pre-if supplies the condition, and main identifies the principal action code. GitHub does not define start, start-if, before, or before-if metadata properties. Current GitHub documentation lists newer supported Node.js runtimes, such as Node.js 20 and Node.js 24, rather than the historical node16 shown in this exam item; however, the tested metadata structure remains pre, pre-if, and main. Thus, among the supplied options, B is structurally correct.

In a Docker container action, the action.yml file includes the runs.using field, which is set to docker to specify that the action runs inside a Docker container. This is the key indicator that the action is a Docker container action.

The most secure option listed is to use OIDC-based integration to obtain short-lived credentials from an external secrets manager or cloud provider. This avoids storing long-lived sensitive values directly in workflow YAML, repository text, or regular environment variables. Options A, B, and C are insecure because they expose or persist sensitive information in places that can be read, logged, committed, or mismanaged. With OIDC, the workflow requests a token from GitHub’s OIDC provider and exchanges it with the trusted external provider for a short-lived credential. This reduces secret sprawl and supports stronger authorization controls. GitHub documents OIDC as a way to avoid duplicating long-lived cloud credentials as GitHub secrets and to use short-lived access tokens instead.