Home › GitHub Actions › Domain 4: Security & Secrets Management

Settings

Theme

Font Size

Quiz 6 Question 19 of 20

When does a GITHUB_TOKEN expire?

Select an answer to reveal the explanation.

Motivation

Short Explanation and Infographic

GITHUB_TOKEN is tied to the job lifecycle — it's born when the job starts and dies when the job ends.

Full explanation below image

Educational infographic 1024x768 showing GITHUBTOKEN lifecycle. Timeline: Job starts -> GITHUBTOKEN created (fresh, unique token). Job executes (token valid, used for API calls). Job ends -> GITHUBTOKEN expires and is revoked. Contrast with PAT: created manually, configurable expiry (days/months/years). Security benefit: short-lived = small window for misuse. Token clock icon showing duration = job duration.

Full Explanation

The GITHUB_TOKEN is automatically created at the start of each workflow job and expires when the job completes (either successfully or with failure). It does not persist across jobs — each job gets its own token. The token is a GitHub App installation token with a maximum lifespan set to the job duration, with a hard maximum of a few hours for very long-running jobs. This is different from personal access tokens (PATs) which have user-configurable expiration. After the job ends, the token is immediately revoked. This short-lived nature is a security feature — compromise of the token can only be exploited during the job run.

← Previous Quiz 6 · Q19/20 Next Question →

Original, similar-concept practice questions — not real exam questions and not brain-dump content.

All vendor and certification names are trademarks of their respective owners. This site is independent and not affiliated with, endorsed by, or sponsored by any certification vendor.