Pass the Microsoft GitHub Administrator GH-900 Questions and answers with CertsForce

GitHub Secret Scanning helps protect repositories by detecting committed credentials and other sensitive values that should not be exposed in source code. SSH private keys are sensitive because they can allow unauthorized access to servers or repositories. API keys are also critical because they can grant access to external services, cloud platforms, or applications. Database connection strings may expose usernames, passwords, hosts, or database endpoints, making them dangerous if leaked. Secret Scanning is designed to identify these kinds of credential patterns and alert repository maintainers or security teams. Hardcoded email addresses are usually not treated as secrets, and code formatting issues are handled by linters or code quality tools, not Secret Scanning.

In GitHub Actions workflows, actions can be referenced from various sources depending on the needs of the workflow.

Any Public Repository:

Option A is correct. Actions can be referenced from any public GitHub repository, allowing the reuse of shared actions across multiple projects.

The Same Repository as Your Workflow File:

Option B is correct. Actions stored in the same repository as the workflow file can be referenced directly, which is common for custom actions specific to that project.

A Published Docker Container Image on Docker Hub:

Option E is correct. Workflows can reference actions that are provided as Docker container images hosted on Docker Hub, allowing integration of complex tools and environments.

Incorrect Options:

Option C (GitHub Packages) is incorrect as it is more commonly used for storing and managing dependencies, not actions.

Option D (An enterprise marketplace) is incorrect because GitHub Actions are not directly referenced from an enterprise marketplace but rather from public repositories or Docker images.

GitHub provides repository admins with a feature called " Insights " where they can view various pre-built visualizations and analytics related to the repository.

Insights:

Option C is correct because the " Insights " tab in a GitHub repository offers various pre-built visualizations, including contributions, traffic, code frequency, dependency graphs, and more. This helps admins and maintainers track the project ' s activity and health.

Other Options:

Option A (Settings) is incorrect because the Settings tab is where you configure repository settings, permissions, and integrations, but it does not provide visualizations of repository data.

Option B (Issues) is incorrect because the Issues tab is used for tracking bugs, enhancements, and other tasks but does not provide data visualizations.

Option D (Charts) is incorrect as there is no " Charts " tab or section in GitHub. The correct location for data visualizations is under " Insights. "

Secret gists on GitHub are " unlisted " gists, meaning they are not publicly discoverable but can be viewed by anyone who has the URL.

Visibility of Secret Gists:

Option A is correct because secret gists can be viewed by anyone who has the direct URL, making them accessible yet unlisted.

Incorrect Options:

Option B is incorrect because secret gists do not require GitHub Enterprise; they are available on all GitHub accounts.

Option C is incorrect because secret gists do not appear on the gist Discover page.

Option D is incorrect because secret gists do not have an " assigned access " feature; access is determined by sharing the URL.

Organization owners on GitHub have control over how GitHub Actions can be used within their organization. They can enforce restrictions to ensure security and compliance with organizational policies.

Allow Actions That Use Self-Hosted Runners:

Option A is correct because organization owners can configure the usage of self-hosted runners, allowing greater control over the environment where actions are run.

Allow Specified Actions:

Option C is correct because organization owners can allow only specific actions to run, adding a layer of security by limiting actions to those that have been vetted.

Allow Actions by Marketplace Verified Creators:

Option D is correct because organization owners can choose to allow actions created by GitHub Marketplace verified creators, ensuring that only trusted actions are used.

Incorrect Options:

Option B is incorrect because GitHub Actions are not designed to be run directly from a Codespace; Codespaces are for development environments.

Option E is a valid choice, but since the prompt asks for only three answers, it is not included in this response.

As mentioned in the answer to Question no. 66, GitHub Actions workflows can reference actions from a variety of sources:

Any Public Repository:

Option A is correct. Actions can be sourced from any public GitHub repository.

The Same Repository as Your Workflow File:

Option B is correct. Actions within the same repository as the workflow file can be referenced directly.

A Published Docker Container Image on Docker Hub:

Option E is correct. Workflows can also use actions provided as Docker container images from Docker Hub.

Incorrect Options:

Option C and D are not relevant for directly referencing actions in workflows.