1500 Questions | GitHub Actions 2026

Develop and Implement Automation Workflows (30%): Creating custom actions, managing workflow dependencies, environment variables, and complex triggers.

Plan and Implement Security and Compliance (20%): Securing workflows with secret management, access control, and ensuring organizational compliance.

B. needs

C. dependencies

D. if: success()

E. outputs

F. external-trigger

Correct Answer: B

Explanation:

A (Incorrect): runs-on defines the type of runner (e.g., ubuntu-latest) the job will execute on.

C (Incorrect): dependencies is not a valid top-level key for a job in GitHub Actions workflow syntax.

D (Incorrect): While if: success() is a status check, it doesn't establish the job-to-job relationship that needs provides.

E (Incorrect): outputs are used to pass data between jobs, not to define execution order.

F (Incorrect): external-trigger is not a standard workflow key for job sequencing.

Question 2: Which method is the most secure way to handle a sensitive API key within a GitHub Actions workflow?

B. Store the key as a "Secret" in the repository settings and reference it via ${{ secrets.API_KEY }}.

C. Save the key in a public text file within the repository.

D. Pass the key as a plain-text environment variable in the workflow_dispatch trigger.

E. Print the key to the console logs using echo for debugging purposes.

F. Use a "Var" instead of a "Secret" to ensure it stays unencrypted.

Correct Answer: B

Explanation:

A (Incorrect): Hardcoding secrets is a major security risk as they are visible to anyone with repository access.

C (Incorrect): Public files are entirely insecure and expose your credentials to the world.

D (Incorrect): Plain-text variables in dispatch triggers can be logged and viewed in the workflow run history.

E (Incorrect): Printing secrets to logs is a critical compliance failure; GitHub tries to mask them, but it should never be intentional.

F (Incorrect): GitHub Variables are for non-sensitive data; Secrets are specifically for encrypted information.

Question 3: A team wants to trigger a workflow only when a pull request is opened or synchronized against the 'main' branch. How should the trigger be configured?

B. on: pull_request: branches: [main]

C. on: fork: main

D. on: schedule: cron: '0 0 * * *'

E. on: deployment

F. on: release: types: [created]

Correct Answer: B

Explanation:

A (Incorrect): push triggers the workflow when code is committed directly, not necessarily during a pull request lifecycle.

C (Incorrect): There is no fork trigger that filters by a specific branch in this manner.

D (Incorrect): This is a scheduled trigger based on time, not repository events.

E (Incorrect): The deployment trigger is for tracking deployment status, not pull request activity.

F (Incorrect): This triggers when a GitHub Release is created, which happens much later in the development cycle.

This is a huge original question bank

You get support from instructors if you have questions

Each question has a detailed explanation

Mobile-compatible with the Udemy app

30-days money-back guarantee if you're not satisfied