Microsoft Updated GH-200 Exam Questions and Answers by stevie

The most secure option listed is to use OIDC-based integration to obtain short-lived credentials from an external secrets manager or cloud provider. This avoids storing long-lived sensitive values directly in workflow YAML, repository text, or regular environment variables. Options A, B, and C are insecure because they expose or persist sensitive information in places that can be read, logged, committed, or mismanaged. With OIDC, the workflow requests a token from GitHub’s OIDC provider and exchanges it with the trusted external provider for a short-lived credential. This reduces secret sprawl and supports stronger authorization controls. GitHub documents OIDC as a way to avoid duplicating long-lived cloud credentials as GitHub secrets and to use short-lived access tokens instead.

The correct syntax for referencing a versioned action is owner/repository@ref. Therefore, to use version v1 of actions/javascript-action, the workflow step must use actions/javascript-action@v1. The @v1 portion is the ref, which can represent a tag, branch, or commit SHA depending on how the action publisher releases the action. Option A incorrectly treats the version as part of the repository path. Option B invents a separate version: key, which is not how action versions are selected. Option C changes the repository name and does not specify a ref. In GitHub Actions syntax, uses selects an action, and version selection is part of the action reference itself. GitHub examples use the uses: owner/action-name@ref form.

The GITHUB_ACTOR environment variable indicates the name of the person or app that initiated the workflow. This variable is automatically provided by GitHub in the workflow and can be used to identify the user or application triggering the workflow.

When a workflow job targets an environment that has required reviewers, the job enters a waiting state until it is approved or rejected. GitHub Actions does not allow that waiting state to remain indefinitely. If the job is not approved within the allowed period, the workflow fails automatically. The correct duration is 30 days, making option C correct. Options A, B, and D do not match the GitHub Actions environment approval behavior. This is important for deployment governance because required reviewers can block access to protected environments and environment secrets, but pending approvals still have a maximum lifetime. This exam topic aligns with protected environments, deployment approvals, required reviewers, and workflow execution control.

================