Domain 2: Authentication, Authorization & Security

GitHub Administration · 74 questions

• What SAML attribute is required in the SAML assertion when configuring SAML SSO for a GitHub organization?
• When a GitHub organization enables SAML SSO, what happens to members who have not yet authenticated via SAML?
• What is the difference between OAuth Apps and GitHub Apps when accessing GitHub resources?
• What is the purpose of configuring an IP allow list for a GitHub organization or enterprise?
• Which type of token should an administrator use to authenticate GitHub Actions workflows with fine-grained, repository-scoped permissions?
• What is the primary security benefit of using GitHub's secret scanning feature in an organization?
• An organization uses LDAP for authentication. What is the function of LDAP group sync in GitHub Enterprise Server?
• What is Enterprise Managed Users (EMU) in GitHub Enterprise Cloud?
• Which permission level in GitHub allows a user to push to protected branches and manage repository settings?
• What is the purpose of a GitHub Deploy Key?
• What does enabling 'Require two-factor authentication' at the organization level do to members who don't have 2FA enabled?
• Which GitHub feature allows you to define which individuals or teams must review a pull request before it can be merged?
• What is the function of GitHub's code scanning feature?
• What is the difference between organization-level SAML SSO and enterprise-level SAML SSO in GitHub?
• What is SCIM, and how is it used with GitHub Enterprise Cloud?
• What is the purpose of a fine-grained Personal Access Token (PAT) in GitHub?
• How can an organization owner verify that all organization members are using SAML SSO?
• What is the security risk of using a Personal Access Token with 'repo' scope for GitHub API access?
• What are 'protected tags' in GitHub, and what do they prevent?
• What is the purpose of GitHub's 'Verified domains' feature for organizations?
• What does GitHub's 'Dependabot security updates' feature do when it detects a vulnerability?
• What GitHub feature allows you to restrict which OAuth Apps can access your organization's data?
• What is the purpose of an 'allowlist' for GitHub Actions in an organization?
• In GitHub, what is a 'Security policy' (SECURITY.md file) and what is its purpose?
• What is GitHub's private vulnerability reporting feature?
• What is the 'bypass list' feature in GitHub repository rulesets?
• What GitHub security feature automatically enables two-factor authentication for all members when an enterprise requires it?
• What is the difference between 'authentication' and 'authorization' in the context of GitHub access control?
• What is the GitHub 'Codespaces' security consideration for enterprises, and what policies can admins configure?
• What is the purpose of GitHub's 'token scanning' feature for GitHub Apps and OAuth tokens?
• Which GitHub branch protection setting prevents repository administrators from bypassing required status checks?
• What is 'organization-owned' versus 'user-owned' for GitHub Apps?
• What is GitHub Enterprise's 'private mode' setting in GitHub Enterprise Server?
• What does it mean to 'verify' a commit signature in GitHub?
• What is the GitHub 'Dependabot version updates' configuration file and where is it placed?
• What is the 'secret scanning' custom patterns feature in GitHub Advanced Security?
• What is the purpose of a GitHub 'machine user' account for automation?
• How does GitHub handle SSH key management for GHES instances where users must use corporate SSH keys only?
• What is the 'user provisioning' aspect of SCIM in GitHub Enterprise Cloud?
• What is the GitHub 'security policy' file (SECURITY.md) and what does it do?
• What does GitHub's 'push protection' for secret scanning do, and how can it be bypassed?
• What is a GitHub 'fine-grained personal access token' and how does it differ from classic PATs?
• What is the 'Verified & Approved' designation for GitHub Actions in an enterprise?
• What is 'IP allow listing' at the GitHub Enterprise Cloud level and what does it restrict?
• What is 'conditional access' in the context of GitHub Enterprise Managed Users?
• What is the difference between GitHub organization 'base permissions' and team permissions?
• What happens to a GitHub Actions workflow's permissions when it accesses a repository from a fork PR?
• What is 'security hardening' for GitHub Actions self-hosted runners?
• What is 'OpenID Connect (OIDC)' in GitHub Actions and what problem does it solve?
• What are 'deploy keys' in GitHub repositories and when should they be used?
• How do Enterprise Managed Users (EMU) typically differ from ordinary GitHub.com users regarding collaboration outside the enterprise?
• An enterprise wants to use OpenID Connect (OIDC) for enterprise SSO instead of SAML. What is a primary administrative characteristic of OIDC enterprise SSO on GitHub?
• When a member creates a fine-grained personal access token that targets organization resources, what enterprise/organization control commonly applies before the token can access those resources?
• An enterprise enables an IP allow list. Which two statements correctly describe common interactions with GitHub Apps and automation? (Choose two)
• What is a security benefit of enterprise policies that restrict or disable classic personal access tokens in favor of fine-grained PATs?
• What does uploading an SSH certificate authority (CA) to a GitHub organization enable administrators to do?
• When SAML single sign-on is enforced for an organization, what additional step may users face when performing sensitive account or organization actions?
• In an EMU environment using SCIM, what is the expected outcome when a user is deprovisioned in the identity provider?
• What are GitHub organization-level code security configurations primarily used for?
• An organization requires approval for GitHub App installations. What does this control achieve?
• What do secret scanning validity checks help security teams understand when a secret is detected?
• What is the main administrative purpose of synchronizing IdP groups to GitHub teams (team synchronization)?
• How does just-in-time (JIT) SAML provisioning differ from SCIM-based user provisioning for GitHub Enterprise Cloud organizations?
• In an Enterprise Managed Users (EMU) environment, what is the role of IdP conditional access policies (CAP) relative to GitHub access?
• Why might an enterprise administrator shorten SAML-authorized session lifetime for members accessing GitHub Enterprise Cloud with SSO?
• Which two controls help an enterprise reduce risk from credentials used on unmanaged endpoints? (Choose two.)
• What does an organization policy that restricts the invitation of outside collaborators primarily control?
• An organization enables OAuth App access restrictions. What is the immediate administrative effect?
• What advantage do SSH certificate authorities configured for a GitHub Enterprise offer compared with unmanaged long-lived user SSH keys alone?
• When an enterprise enables an IP allow list, which additional consideration is important for installed GitHub Apps and integrations?
• An organization requires two-factor authentication. What should administrators ensure members understand about 2FA recovery codes?
• How does the enterprise billing manager role differ from the enterprise owner role on GitHub Enterprise Cloud?
• Why are fine-grained GitHub App installation permissions preferred over a single classic PAT with broad repo scope for organization automation?
• After SAML SSO is enforced for an organization, what must a member typically do before using a personal access token or SSH key against organization resources that require SSO authorization?