Domain 4: Security & Secrets Management

GitHub Actions · 47 questions

• What is GITHUBTOKEN and how is it made available in a GitHub Actions workflow?
• At which levels can secrets be defined in GitHub for use in Actions?
• What happens if a secret value accidentally appears in workflow step output?
• What is the main advantage of using OIDC tokens to authenticate with cloud providers like AWS instead of storing long-lived credentials as secrets?
• Which workflow permission is required to request an OIDC JWT token from GitHub?
• What does GitHub Secret Scanning's 'push protection' feature do when a secret is detected?
• Which environment protection rule requires a specific team member to approve a deployment before it proceeds?
• Which GitHub Actions event trigger is recommended for CodeQL analysis to scan code on every PR?
• How do you configure Dependabot to automatically update GitHub Actions versions in your workflows?
• What is the default permission level of GITHUBTOKEN when the repository's 'Workflow permissions' setting is set to 'Read and write permissions'?
• What hostname do you use to push Docker images to GitHub Container Registry?
• Which workflow best practice reduces the risk of injection attacks through untrusted user input in 'run:' steps?
• Which of these is a recommended security hardening practice for GitHub Actions workflows?
• What GitHub Actions permission scope allows a workflow to approve pull requests?
• By default, when a pullrequest workflow runs from a forked repository, are secrets available?
• When configuring AWS to trust GitHub Actions OIDC tokens, the 'sub' claim can filter which workflows can assume the role. Which is an example of a valid sub claim for a specific branch?
• Which permission allows a workflow to create and update check runs on a pull request?
• When does a GITHUBTOKEN expire?
• In a dependabot.yml configuration for GitHub Actions, which key groups multiple action updates into a single PR?
• GitHub recommends setting 'Workflow permissions' to what default for new repositories?
• A security audit identifies that a workflow uses 'uses: third-party/action@v2'. What is the security concern and recommended fix?
• Can GITHUBTOKEN bypass branch protection rules to push directly to a protected branch?
• How do you pass a specific secret to a reusable workflow without using 'secrets: inherit'?
• Which authentication approach lets a GitHub Actions workflow obtain short-lived cloud credentials from AWS, Azure, or GCP without storing long-lived cloud access keys as GitHub secrets?
• A public repository receives a pull request from a fork. For the pullrequest event, what is the default availability of repository secrets to the workflow run?
• A workflow only needs to read repository contents and packages; it must not write to issues or pull requests. Which permissions block best follows least privilege for GITHUBTOKEN?
• Which two controls can be configured on a GitHub Actions environment to harden production deployments? (Choose two)
• Why is it a bad practice (and often ineffective) to branch on secret values using an if: condition like secrets.FEATUREFLAG == 'true'?
• Which permissions scope must be granted for a job that requests a GitHub Actions OIDC JWT for cloud federation?
• A secret named 'DEPLOYKEY' exists both as a repository secret and as a secret on the 'production' environment with different values. A job sets 'environment: production'. Which value does secrets.DEPLOYKEY resolve to?
• By default, when a workflow uses GITHUBTOKEN to create a commit or open a pull request, what happens regarding additional workflow runs?
• A workflow only needs to read repository contents and write packages. Which permissions block best follows least privilege?
• When configuring a cloud provider to trust GitHub's OIDC tokens, why might you customize the token's subject (sub) claim format?
• The 'production' environment has a wait timer of 15 minutes and required reviewers. When does the deploy job that references environment: production start its steps?
• A pull request originates from a fork of a public repository. The workflow runs on pullrequest. Which statement about secrets is correct by default?
• Which two practices most improve security when consuming third-party Actions? (Choose two.)
• Attackers often try to merge malicious workflow changes. Which control requires designated owners to approve changes under '.github/workflows'?
• A job requests a cloud OIDC token with actions/oidc or cloud login actions. Which permission must be granted?
• Repository secret 'APIURL' is https://staging.example.com. Environment 'production' defines secret 'APIURL' as https://api.example.com. A job sets environment: production. Which value does secrets.APIURL resolve to?
• When configuring OpenID Connect between GitHub Actions and a cloud provider, what is the role of the token audience (aud) claim?
• What does the dependency-review-action (dependency review) primarily enforce on pull requests?
• A workflow runs on pullrequest and includes run: echo "PR title is ${{ github.event.pullrequest.title }}". Why is this dangerous?
• Why must workflows using pullrequesttarget be extremely careful with actions/checkout and secrets?
• Maintainers want outside contributors’ workflows from forks to run only after someone with write access approves the run. Which GitHub Actions security control addresses first-time contributors from forks?
• A production deploy job uses OIDC to assume a cloud role. Which combination best limits which workflow runs may obtain that privileged cloud access?
• Which two practices harden GitHub Actions against secret exposure and untrusted automation? (Choose two.)
• A custom linter produces SARIF. Which Actions-oriented approach publishes those results to GitHub code scanning alerts?