Trigger Your GitHub Actions Knowledge Before Exam Day

Take on 25 practice questions across five GitHub Actions domains
Start Free Practice
No Credit Card Required
HOW TO PREPARE

Everything You Need to Know First

Warm-up topics before the test.
  • Git and GitHub Fundamentals: Working knowledge of repositories, branches, commits, and pull requests.
  • YAML Basics: Comfort reading and writing YAML, since every workflow file is written in it.
  • CI/CD Concepts: General understanding of how build, test, and deploy pipelines fit together.
PRACTICE TEST

Put Your Knowledge to the Test

25 multiple-choice questions, including ones built around command output
A workflow must access a cloud role without storing long-lived cloud access keys. Which permission must the workflow grant to request an OIDC identity token?
A long-lived administrator access key in a repository variable.
A rule that trusts every repository without checking identity claims.
Permission for the job to request an OIDC token, using id-token: write.
A public repository containing the cloud role's private key.
C
OIDC exchanges workflow identity for short-lived cloud credentials. id-token: write permits the job to request that identity token, though it does not itself grant cloud access - a cloud-side trust configuration must also be set up to accept the intended GitHub OIDC claims.
Secure and optimize automation
23
Select One
Production deployment requires approval before a job can use production environment secrets. Which configuration is required for this protection to apply?
Add production to the job's display name without referencing an environment.
Put the production secret in a public workflow variable.
Make the deployment job reference the production environment.
Upload the production secret as a build artifact.
C
Environment protection rules, including required reviewers, only take effect once a job references that environment. Environment secrets are then withheld until the required protections pass. Plan availability and bypass settings must match the intended policy.
Manage GitHub Actions for the enterprise
20
Select One
Which statement describes JavaScript actions?
They specify a supported Node.js runtime and an entry-point script in their metadata.
They are limited to Linux because every JavaScript action runs in a Docker container.
They must always include a Dockerfile.
Their implementation must be written as Kubernetes YAML.
A
JavaScript actions run through a supported Node runtime on the runner, declared in the action's metadata alongside its entry-point script. They are not limited to Docker or Linux, portability depends on the action's own code and dependencies, and a Dockerfile is not required.
Author and maintain actions
15
Select One
Dependency installation is repeated across many workflow runs with the same lockfile. Which choice is central to effective dependency caching?
Use a release artifact's name as proof a dependency cache always exists.
Use a cache key that includes relevant environment information and a dependency-lockfile hash.
Make the entire workflow fail whenever a cache is absent.
Assume a cache is a permanent archival copy of a release binary.
B
A meaningful cache key, built from relevant environment details and a lockfile hash, is what makes a cache hit meaningful instead of accidental. The workflow should still install normally on a cache miss - caching accelerates reusable inputs, while artifacts preserve workflow outputs for a different purpose.
Consume and troubleshoot workflows
9
Select One
A workflow currently interpolates a pull-request title directly into a Bash run script. The title is controlled by an external contributor. Which change reduces script-injection risk when printing it?
Run the generated script with sudo.
Place the same expression inside double quotes in the generated script and assume it is safe.
Pass the title through an environment variable and print it as quoted data, without eval.
Grant contents: write to every workflow.
C
Untrusted expressions embedded in script source can become executable syntax. Passing the value through an environment variable and using safe quoting keeps it as data; do not evaluate it as shell code.
Secure and optimize automation
25
Select One
A team wants a third-party action reference to identify an exact reviewed commit rather than a movable branch or tag. Which reference should it use?
The action's display name.
The full commit SHA.
The main branch.
A floating v1 tag only.
B
A full commit SHA identifies the reviewed revision. Pinning limits unexpected revision changes, but does not establish that the action's code is safe.
Secure and optimize automation
24
Select One
A workflow relies on a particular compiler version, but the preinstalled compiler changes when the GitHub-hosted runner image updates. What is the most appropriate fix?
Rename the job to the compiler version.
Assume ubuntu-latest always provides an immutable software image.
Increase artifact retention so the old compiler stays on future runners.
Explicitly install or select the required compiler version in the workflow using supported setup tooling.
D
Hosted images evolve. Explicit tool setup makes the required version clear and reduces reliance on changing defaults. Artifact retention does not pin runner software.
Manage GitHub Actions for the enterprise
22
Select One
An organization wants to restrict workflows to approved actions and reusable workflows. Which control should an administrator configure?
A README listing preferred actions, with no policy.
A naming convention for workflow files.
Only an action's Marketplace star count.
The organization's GitHub Actions usage policy for allowed actions and reusable workflows.
D
Organization Actions policies can restrict what actions and reusable workflows may run. Documentation and popularity are not enforcement controls.
Manage GitHub Actions for the enterprise
21
Select One
An organization-level secret should be available to only three private repositories. Which configuration directly expresses this scope?
An organization secret with a selected-repositories access policy.
A repository topic matching the secret name.
A public repository variable containing the secret value.
A secret pasted into a shared workflow's YAML.
A
Organization secrets support repository access policies, subject to plan capabilities. Variables and YAML literals are not substitutes for secret storage.
Manage GitHub Actions for the enterprise
19
Select One
A job requests runs-on: [self-hosted, linux, x64, gpu]. Which runner can receive the job, assuming repository access is allowed?
Any self-hosted runner that matches at least one label.
A runner selected solely because its name contains gpu.
An available runner that matches all four labels.
Any GitHub-hosted Ubuntu runner.
C
A label array applies cumulatively: the runner must match all specified labels. Access restrictions and availability also apply.
Manage GitHub Actions for the enterprise
18
Select One
An organization has sensitive self-hosted runners that only selected repositories should use. Which feature directly controls repository access to that runner collection?
A workflow display name.
A runner group with an appropriate repository access policy.
A descriptive runner label alone.
An artifact retention setting.
B
Runner groups govern access to runner collections. Labels select eligible runners but do not by themselves establish repository authorization.
Manage GitHub Actions for the enterprise
17
Select One
A custom action declares an input as required in action.yml. What additional step should the author take if absence of that input must fail the action?
Rename the input to GITHUB_TOKEN.
Assume required: true automatically fails execution in every case.
Validate the input in the action implementation and fail with a clear error if it is absent.
Remove the metadata file.
C
GitHub documents that required: true does not automatically cause an error when an input is omitted. The implementation must enforce a genuinely mandatory input.
Author and maintain actions
16
Select One
A custom Docker container action must execute on a compatible runner. Which runner environment is required?
A Linux runner with Docker available.
Any Windows runner without Docker.
A macOS runner with no container support.
Any runner, because container actions do not use a container engine.
A
Docker container actions require Linux and Docker. A self-hosted runner must supply the required container environment.
Author and maintain actions
14
Select One
A team wants to package several existing shell and action steps so callers can invoke them as one step. Which action type fits?
An environment protection rule.
Composite action.
A runner group.
A reusable workflow invoked inside a run shell command.
B
Composite actions package step logic and are invoked as a step. Reusable workflows are invoked at the job level and can contain multiple jobs.
Author and maintain actions
13
Select One
A team creates a custom action. Which file declares its metadata, inputs, outputs, and execution configuration?
action.yml or action.yaml
package.json in every action type
workflow.lock
CODEOWNERS
A
The action metadata file describes the action interface and its runs configuration. JavaScript actions may also use package.json, but that is not the common metadata file for all action types.
Author and maintain actions
12
Select One
A public repository runs pull_request workflows for contributions from forks. Under the normal default security behavior, a deployment secret is unavailable to the run. Why?
Secrets are unavailable to every pull_request run, including branches in the same repository.
Secrets are available only on Windows runners.
The name of every deployment secret must start with GITHUB_.
Repository secrets, apart from the special GITHUB_TOKEN behavior, are not passed to fork-triggered pull_request runs.
D
Fork PR runs are treated as untrusted, and ordinary secrets are withheld by default. Do not work around this by executing untrusted code in a privileged workflow context.
Consume and troubleshoot workflows
11
Select One
A repository created a workflow from an organization starter workflow. The organization later edits the starter. What should the repository maintainer expect?
The existing copied workflow remains independent and is not automatically rewritten.
All previous workflow runs are deleted.
Its workflow becomes a reusable workflow automatically.
Every copy is automatically replaced on the next push.
A
Starter workflows are scaffolding copied into repositories. Reusable workflows are centrally defined workflows invoked by callers; the two reuse mechanisms behave differently.
Consume and troubleshoot workflows
10
Select One
A workflow fails during npm install. Which action provides the most direct evidence about the failing command?
Open the failed run, select the job, and inspect the failing step's logs.
Delete the workflow file immediately.
Change the runner group before looking at any execution output.
Inspect only the repository's star count.
A
Workflow logs expose job and step output and are the first direct source for diagnosing the failing install. Configuration changes should follow the evidence.
Consume and troubleshoot workflows
8
Select One
The test job fails. The deploy job has needs: test and no condition overriding the normal success requirement. What normally happens to deploy?
It runs because needs affects order but never success.
It runs on the same runner with test's permissions.
It is skipped.
It retries test automatically until test succeeds.
C
Dependent jobs normally require their needed jobs to succeed. An explicit condition can change this behavior, but none is present in the scenario.
Consume and troubleshoot workflows
7
Select One
A Bash step writes APP_MODE=test to the file identified by GITHUB_ENV. What is the intended effect?
Subsequent steps in the same job receive APP_MODE as an environment variable.
The current shell automatically receives APP_MODE without setting it there.
All jobs in all repositories receive APP_MODE.
APP_MODE becomes a repository secret.
A
GITHUB_ENV passes environment values to subsequent steps in the same job. Writing the file does not retroactively set the variable in the writing shell or create a secret.
Author and manage workflows
6
Select One
A build job produces a ZIP file. A later job on a different GitHub-hosted runner needs the exact file from that workflow run. Which approach is appropriate?
Assume both runners share the same working directory.
Write the ZIP's local path to GITHUB_ENV and expect the second runner to read it.
Use a dependency cache as the only guaranteed delivery channel for the release file.
Upload the ZIP as a workflow artifact and download that artifact in the later job.
D
Artifacts persist files from a workflow run and can transfer them between jobs. Separate hosted runners do not share local filesystems, and dependency caches have a different purpose.
Author and manage workflows
5
Select One
A build job exposes a job output named version. A deploy job declares needs: build. Which expression reads that output inside deploy?
${{ github.outputs.version }}
${{ env.build.outputs.version }}
${{ needs.build.outputs.version }}
${{ jobs.build.steps.version }}
C
A dependent job reads a declared upstream job output through needs.<job_id>.outputs.<name>. Merely setting an environment variable in the build job does not create this output.
Author and manage workflows
4
Select One
How many job combinations does this matrix create? strategy: matrix: os: [ubuntu-latest, windows-latest] node: [20, 22, 24] exclude: - os: windows-latest node: 20
6
5
3
4
B
The Cartesian product has 2 x 3 = 6 combinations. The exclusion removes one, leaving five. These values illustrate matrix expansion, not a recommendation of runtime versions.
Author and manage workflows
3
Select One
A team wants users to start a workflow manually and choose a deployment environment through a declared input. Which event supports this?
workflow_call only
workflow_dispatch
status only
pull_request_review only
B
workflow_dispatch supports manual execution and typed inputs. The workflow must meet GitHub's requirements, including being present on the default branch for this trigger.
Author and manage workflows
2
Select One
A workflow defines three jobs with no needs relationships or other ordering constraints. How are they eligible to execute?
In alphabetical order by job ID.
Only one job can execute in each workflow run.
Always sequentially in their YAML order.
Independently and in parallel, subject to runner availability and concurrency limits.
D
Jobs run in parallel by default. That does not guarantee simultaneous start times; available runners and concurrency constraints still apply.
Author and manage workflows
1
Select One
DOMAIN Question 01/00

0 of 0 answered

A Course Built Around Your Needs

GitHub Actions

Beginner
Associate
Professional
11.00
Hours
Play icon
Learn GitHub Actions for CI/CD automation: core concepts, reusable workflows, custom actions, self-hosted runners, Kubernetes deployments, and security hardening.
Barahalikar Siddharth
Details
WHY HANDS-ON PRACTICE

Knowledge, Earned by Doing

The GitHub Actions exam rewards workflow fluency, not memorized YAML.

Build Real Exam Speed

You get 100 minutes for the full exam. Repeated practice trains you to read a workflow file fast, so you're not tracing triggers and jobs under time pressure.

Know Your Weak Domains

Review every question you missed and spot the topics that need more work. Better to find them here than on exam day.

‍

Realistic Scenario Questions

Exam-style questions, in the multiple-choice format that are a mix of workflow syntax and enterprise-governance items.

Reduce Exam-Day Anxiety

Familiarity with multiple-choice format removes surprises, so nerves don't cost you marks.

‍

Reinforce Through Repetition

Spaced repetition on frequently tested concepts, like triggers, runners, and reusable workflows, moves them from look it up to just know it.

Benchmark Against a Passing Score

Compare your score with Github’s 700/1000 passing threshold and identify topics to review before exam-day.

‍

HEAR FROM OUR LEARNERS

Real Learners. Real Results

Alhamdulillah 🙏! Thrilled to announce that I am now officially a Certified Kubernetes Administrator (CKA)! While Kubernetes, cluster orchestration, and container security are already central to my daily DevSecOps work, earning this certification is a great validation of those hands-on skills.Thanks to Mumshad Mannambeth and the KodeKloud team—their course and hands-on labs helped me a lot in preparing for this exam.The learning never stops! 🚀

Read Full Post
Imtiaz Ali
DevOps | SRE | Multi-Cloud | DevSecOps

Freshly certified: Certified Kubernetes Administrator (CKA)! 🚀Passing this hands-on, live-terminal exam was a great challenge. Paired with my AWS Certified DevOps Engineer – Professional, it reinforces my focus on bridging enterprise multi-account cloud governance with production-grade Kubernetes runtime operations.A special shoutout and big thank you to Mumshad Mannambeth, the KodeKloud team, and the Cloud Native Computing Foundation (CNCF) and Kubernetes (Official) community. The Certified Kubernetes Administrator (CKA) course was hands-down the best preparation for the live terminal environment! 🛠️Next stop: continuing to build resilient, developer-first platform foundations!

Read Full Post
Gaurav Dubey
Cloud Architect | Platform Engineer | AWS DevOps Pro | CKA

Cherishing one of my dreams - CKS Certified! ✨Last year, in October, when I cracked my CKA, my colleagues asked, “When is CKS?” 😂And I was like… bro. 😅Because it felt so much bigger. I also knew it wasn’t just Kubernetes anymore, but Kubernetes with a special layer of security - yeah, tightened Kubernetes.Back then, I used to look up to CKS like a child gazing at one of the stars in the sky.⭐Now, fast forward to today - I cleared it last week and officially became a Certified Kubernetes Security Specialist (CKS), thanks to the Cloud Native Computing Foundation (CNCF), The Linux Foundation and my company Aivar Innovations. 🎉That moment felt so special, and I’m incredibly grateful to all my colleagues, friends, and family for all the support. ❤️A mention of the resources I used: KodeKloud by Mumshad Mannambeth and Kim Wüstkamp’s CKS courses. I also had my colleagues supporting me with my doubts and anxieties before the exam. 😂Looking forward to applying everything I’ve learned in my work and continuing to grow in the Cloud Native and Kubernetes space. 🚀So, cheers to everyone who dreams, aspires, and inspires. Keep going and keep up the good work! 🥂And as I always say - God, keep it coming!! ✨

Read Full Post
Rima Sidique
DevOps Engineer | AI & DevOps Enthusiast

I've successfully passed CKA certification. Shout-out to Mumshad Mannambeth for his great CKA course and labs and to Omkar Shelke Killercoda CKA scenarios. Links: - https://lnkd.in/eZPVHJeR- https://lnkd.in/eEVyZdaZ

Read Full Post
Gabriel Rodríguez
DevSecOps Engineer

🎉 The Kubernetes journey continues… and this time, happy to say I’m officially a Kubestronaut! 🧑🚀🚀🎖️ 1 out of 242 in France and 1 out of 4217 worldwide!⏳✈️ It’s been quite a journey. From my early days working with Kubernetes, thanks to the opportunity Prof. Timur Friedman gave me to contribute to the EdgeNet project, to securing my internship as a DevOps Engineer at Sonos, Inc. — and fast-forward five years, here I am today, a Senior DevOps Engineer at Sonos, Inc. working extensively with Kubernetes everyday.💌 A special thank you to Jose Alfredo Alvarez Aldana for your support, guidance, and for everything you taught me along the way. I was really lucky to have the opportunity to work alongside you early in my journey. 🙏💯 A big thank you to Mumshad Mannambeth for building KodeKloud! The platform has been incredibly helpful throughout this journey, both for learning and preparing for the exams.And of course, shout out to all the people who supported, challenged, and inspired me along the way. ❤️Never give up 💪Keep smiling 😃

Read Full Post
Rima Sidique
DevOps Engineer | AI & DevOps Enthusiast

Alhamdulillah 🙏! Thrilled to announce that I am now officially a Certified Kubernetes Administrator (CKA)! While Kubernetes, cluster orchestration, and container security are already central to my daily DevSecOps work, earning this certification is a great validation of those hands-on skills.Thanks to Mumshad Mannambeth and the KodeKloud team—their course and hands-on labs helped me a lot in preparing for this exam.The learning never stops! 🚀

Read Full Post
Imtiaz Ali
DevOps | SRE | Multi-Cloud | DevSecOps

Freshly certified: Certified Kubernetes Administrator (CKA)! 🚀Passing this hands-on, live-terminal exam was a great challenge. Paired with my AWS Certified DevOps Engineer – Professional, it reinforces my focus on bridging enterprise multi-account cloud governance with production-grade Kubernetes runtime operations.A special shoutout and big thank you to Mumshad Mannambeth, the KodeKloud team, and the Cloud Native Computing Foundation (CNCF) and Kubernetes (Official) community. The Certified Kubernetes Administrator (CKA) course was hands-down the best preparation for the live terminal environment! 🛠️Next stop: continuing to build resilient, developer-first platform foundations!

Read Full Post
Gaurav Dubey
Cloud Architect | Platform Engineer | AWS DevOps Pro | CKA

Cherishing one of my dreams - CKS Certified! ✨Last year, in October, when I cracked my CKA, my colleagues asked, “When is CKS?” 😂And I was like… bro. 😅Because it felt so much bigger. I also knew it wasn’t just Kubernetes anymore, but Kubernetes with a special layer of security - yeah, tightened Kubernetes.Back then, I used to look up to CKS like a child gazing at one of the stars in the sky.⭐Now, fast forward to today - I cleared it last week and officially became a Certified Kubernetes Security Specialist (CKS), thanks to the Cloud Native Computing Foundation (CNCF), The Linux Foundation and my company Aivar Innovations. 🎉That moment felt so special, and I’m incredibly grateful to all my colleagues, friends, and family for all the support. ❤️A mention of the resources I used: KodeKloud by Mumshad Mannambeth and Kim Wüstkamp’s CKS courses. I also had my colleagues supporting me with my doubts and anxieties before the exam. 😂Looking forward to applying everything I’ve learned in my work and continuing to grow in the Cloud Native and Kubernetes space. 🚀So, cheers to everyone who dreams, aspires, and inspires. Keep going and keep up the good work! 🥂And as I always say - God, keep it coming!! ✨

Read Full Post
Rima Sidique
DevOps Engineer | AI & DevOps Enthusiast

I've successfully passed CKA certification. Shout-out to Mumshad Mannambeth for his great CKA course and labs and to Omkar Shelke Killercoda CKA scenarios. Links: - https://lnkd.in/eZPVHJeR- https://lnkd.in/eEVyZdaZ

Read Full Post
Gabriel Rodríguez
DevSecOps Engineer

🎉 The Kubernetes journey continues… and this time, happy to say I’m officially a Kubestronaut! 🧑🚀🚀🎖️ 1 out of 242 in France and 1 out of 4217 worldwide!⏳✈️ It’s been quite a journey. From my early days working with Kubernetes, thanks to the opportunity Prof. Timur Friedman gave me to contribute to the EdgeNet project, to securing my internship as a DevOps Engineer at Sonos, Inc. — and fast-forward five years, here I am today, a Senior DevOps Engineer at Sonos, Inc. working extensively with Kubernetes everyday.💌 A special thank you to Jose Alfredo Alvarez Aldana for your support, guidance, and for everything you taught me along the way. I was really lucky to have the opportunity to work alongside you early in my journey. 🙏💯 A big thank you to Mumshad Mannambeth for building KodeKloud! The platform has been incredibly helpful throughout this journey, both for learning and preparing for the exams.And of course, shout out to all the people who supported, challenged, and inspired me along the way. ❤️Never give up 💪Keep smiling 😃

Read Full Post
Rima Sidique
DevOps Engineer | AI & DevOps Enthusiast
FAQs

Frequently Asked Questions

Is this practice test free ? 

Yes! This practice test is completely free. You can take it as many times as you like to practice and assess your knowledge.

Do I need to install anything ? 

No. You don’t need to install anything. The practice test is completely browser-based, so you can start practicing directly online. 

What if I'm new to this domain?

That's completely fine , mock tests aren't just for the final week before your exam. Taking one early gives you a baseline: you'll see which topics you already grasp, which ones you've never encountered, and how the real exam frames its questions. Every attempt comes with detailed explanations for each answer, so even the questions you get wrong become a study guide. We'd suggest starting with one full mock test, reviewing the explanations carefully, then working through the linked learning material before attempting the next one. 

How closely does this mock test match the real exam?

The question style and pattern closely mirror the real certification exam, the way scenarios are framed, the answer options, and the level of reasoning required are all modelled on it. The main difference is length: this mock has 25 sample questions, while the actual exam typically presents 50-60 questions of this type. So treat this as a representative sample rather than a full-length simulation. The style will feel familiar on exam day; the stamina and time pressure of a longer paper is something you'll want to prepare for separately.