GitHub Foundations Certification (GH-900) — Questions and Answers

Question 1: What is the key difference between GitHub Packages (docker.pkg.github.com) and GitHub Container Registry (ghcr.io)?

There is no functional difference; they use different domain names only
GHCR supports only public images; GitHub Packages supports private images
GHCR is independent of repository permissions and supports granular access control; the older registry ties packages to repository access (Correct answer)
GitHub Packages supports OCI artifacts; GHCR only supports Docker images

Correct answer: GHCR is independent of repository permissions and supports granular access control; the older registry ties packages to repository access

GHCR (ghcr.io) has independent access controls from repositories and supports organization-level visibility, while the legacy docker.pkg.github.com registry was tied to repository permissions.

Question 2: Which tool helps automate checks on pull requests?

GitHub Actions (Correct answer)
GitHub Gists
GitHub Discussions
GitHub Pages

Correct answer: GitHub Actions

GitHub Actions is a powerful CI/CD platform that allows you to automate workflows directly within your GitHub repository. It can be configured to automatically run tests, lint code, build projects, and perform other checks whenever a pull request is opened or updated. This ensures code quality and consistency throughout the development lifecycle.

Question 3: Which package ecosystems does GitHub Packages natively support? (Select the most complete answer)

npm, Maven, and Docker only
npm, Docker, NuGet, and Helm only
npm, RubyGems, Maven, Gradle, Docker, NuGet, and Swift (Correct answer)
pip, npm, and Cargo only

Correct answer: npm, RubyGems, Maven, Gradle, Docker, NuGet, and Swift

GitHub Packages supports npm, RubyGems, Maven, Gradle, Docker/OCI containers, NuGet, and Swift package registries.

Question 4: What is the best practice for monitoring implementation planning systems?

Implement automated monitoring with alerting thresholds (Correct answer)
Rely on vendor notifications exclusively
Monitor only when users report problems
Check systems manually once a month

Correct answer: Implement automated monitoring with alerting thresholds

Automated monitoring with properly configured alerting thresholds enables proactive identification and resolution of issues.

Question 5: Who can approve a pull request in a protected branch?

Assigned reviewers or collaborators (Correct answer)
Any GitHub user
Pull request author
Only repository administrators

Correct answer: Assigned reviewers or collaborators

In a protected branch, specific rules are enforced to maintain code quality and stability. Approving a pull request typically requires designated individuals, such as assigned reviewers or collaborators with appropriate permissions, to sign off on the changes. This ensures that only vetted code is merged into critical branches, safeguarding the project's integrity.

Question 6: How should you document performance monitoring configurations?

Store documentation on individual workstations
Maintain up-to-date documentation in a centralized, accessible location (Correct answer)
Document only when asked by management
Keep all configuration details in personal memory

Correct answer: Maintain up-to-date documentation in a centralized, accessible location

Centralized, accessible, and current documentation is essential for troubleshooting, disaster recovery, and knowledge sharing.

Question 7: GitHub Copilot for Business differs from GitHub Copilot Individual primarily by offering what additional capability?

Support for more programming languages
Organization-wide policy management and centralized billing (Correct answer)
Offline mode for code suggestions
Faster suggestion speed

Correct answer: Organization-wide policy management and centralized billing

Copilot Business adds organization-wide policy controls, centralized seat management, and consolidated billing not available in the Individual tier.

Question 8: Which GitHub feature allows you to automate project workflows such as automatically moving items when a pull request is opened?

Repository rulesets
GitHub Projects built-in automation (workflow automations) (Correct answer)
GitHub Actions only
Branch protection rules

Correct answer: GitHub Projects built-in automation (workflow automations)

GitHub Projects includes built-in workflow automation rules that can automatically set item status (e.g., move to 'In Progress') when issues or PRs change state.

Question 9: Which file defines a GitHub Actions workflow?

main.workflow
workflow.json
action.yaml
.github/workflows/*.yml (Correct answer)

Correct answer: .github/workflows/*.yml

GitHub Actions workflows are defined in YAML files located within the `.github/workflows/` directory in your repository. These YAML files specify the events that trigger the workflow, the jobs to be executed, and the steps within each job. This structured format clearly outlines the automated process for your project.

Question 10: Which approach is recommended for implementing implementation planning changes?

Implementing changes only during peak hours
Making all changes at once without testing
Skipping documentation to save time
Following a structured change management process with testing (Correct answer)

Correct answer: Following a structured change management process with testing

A structured change management process with proper testing minimizes risk and ensures successful implementation.

Question 11: What does the `git commit` command do?

Records changes in the repository (Correct answer)
Pushes changes to remote
Deletes previous commits
Saves changes to the cloud

Correct answer: Records changes in the repository

The `git commit` command takes the changes that have been staged (added to the staging area using `git add`) and permanently records them as a new snapshot in the repository's history. Each commit includes a unique ID and a commit message describing the changes. This creates a point to which you can revert if needed, preserving the project's evolution.

Question 12: What is the base URL for authenticating with the GitHub Container Registry (GHCR)?

registry.github.com
packages.github.com
docker.pkg.github.com
ghcr.io (Correct answer)

Correct answer: ghcr.io

GitHub Container Registry uses ghcr.io as its base URL for authentication and image pulls/pushes.

Question 13: Which GitHub feature allows team members to comment on code during a pull request?

GitHub Actions
Issue Tracker
GitHub Pages
Code Review (Correct answer)

Correct answer: Code Review

GitHub's Code Review feature, integral to pull requests, allows team members to examine proposed code changes, add comments, suggest improvements, and discuss modifications directly within the pull request interface. This collaborative process helps ensure code quality, catch bugs, and share knowledge among developers. It's a cornerstone of collaborative development.

Question 14: What GitHub Actions step snippet correctly authenticates Docker with GHCR using the built-in token?

uses: docker/login-action@v3 with registry: ghcr.io, username: ${{ github.actor }}, password: ${{ secrets.GITHUB_TOKEN }} (Correct answer)
uses: actions/setup-docker@v1 with token: ${{ secrets.GITHUB_TOKEN }}
run: gh auth configure-docker ghcr.io
run: docker login ghcr.io --username actions --password auto

Correct answer: uses: docker/login-action@v3 with registry: ghcr.io, username: ${{ github.actor }}, password: ${{ secrets.GITHUB_TOKEN }}

The docker/login-action with registry ghcr.io, github.actor as username, and GITHUB_TOKEN as password is the standard approach for GHCR authentication in Actions.

Question 15: What is the best practice for monitoring troubleshooting methods systems?

Check systems manually once a month
Monitor only when users report problems
Rely on vendor notifications exclusively
Implement automated monitoring with alerting thresholds (Correct answer)

Correct answer: Implement automated monitoring with alerting thresholds

Automated monitoring with properly configured alerting thresholds enables proactive identification and resolution of issues.

Question 16: What is the main purpose of a pull request in GitHub?

To delete outdated code
To clone a repository
To propose and review changes before merging (Correct answer)
To push changes to remote

Correct answer: To propose and review changes before merging

A pull request (PR) is a mechanism in GitHub for developers to propose changes to a repository and request that maintainers review and merge them. It facilitates code review, discussion, and collaboration, ensuring code quality and preventing errors before integrating new features into the main branch. This is crucial for maintaining project integrity.

Question 17: What is a common best practice before creating a pull request?

Open an issue
Reset branch to origin
Sync with the base branch (Correct answer)
Create a new fork

Correct answer: Sync with the base branch

Before creating a pull request, it's a best practice to sync your feature branch with the latest changes from the base branch (e.g., `main`). This helps identify and resolve potential merge conflicts early, ensuring your proposed changes are based on the most current version of the project. This makes the review process smoother and reduces integration issues.

Question 18: Which Gradle configuration correctly sets up publishing to GitHub Packages?

Add a github {} block in settings.gradle with the repository name
Configure a maven repository in the publishing block with url = uri('https://maven.pkg.github.com/OWNER/REPO') and credentials using github username and token (Correct answer)
Set GRADLE_REGISTRY=github in the environment and run gradle publish
Use the gradle-github-plugin with githubToken property

Correct answer: Configure a maven repository in the publishing block with url = uri('https://maven.pkg.github.com/OWNER/REPO') and credentials using github username and token

Gradle uses the maven-publish plugin with a repository URL pointing to GitHub Packages and credentials provided via environment variables or gradle.properties.

Question 19: What should you do when troubleshooting a compliance standards issue?

Escalate everything without investigation
Make random changes until the problem goes away
Follow a systematic approach: identify, research, test, implement, verify (Correct answer)
Immediately restart all systems

Correct answer: Follow a systematic approach: identify, research, test, implement, verify

A systematic troubleshooting approach ensures the root cause is identified and the fix is verified without creating new issues.

Question 20: How does linking a GitHub Issue to a pull request benefit the development workflow?

It triggers a Dependabot security scan
It prevents the issue from being assigned to other contributors
It grants the PR author write access to the issue thread
It provides traceability between the reported problem and the code change that resolves it, and can auto-close the issue on merge (Correct answer)

Correct answer: It provides traceability between the reported problem and the code change that resolves it, and can auto-close the issue on merge

Linking issues to pull requests creates a traceable connection between the problem and its fix, and using closing keywords will automatically close the issue when the PR is merged.

Question 21: Which Git command creates a new branch?

git init
git branch (Correct answer)
git checkout
git create

Correct answer: git branch

The `git branch <branch-name>` command is used to create a new branch in your local repository. This command simply creates a new pointer to the current commit, allowing you to switch to this new branch and start making isolated changes. It's the first step in creating a separate line of development.

Question 22: Which GitHub Actions permission block setting is required to allow a workflow to write packages to GitHub Packages?

permissions: packages: read
permissions: packages: write (Correct answer)
permissions: contents: write
permissions: deployments: write

Correct answer: permissions: packages: write

Setting permissions: packages: write in the workflow YAML grants the GITHUB_TOKEN the ability to publish packages.

Question 23: What is the difference between a repository-level project and an organization-level project in GitHub?

Organization projects require a paid plan; repository projects are always free
There is no functional difference between the two
Organization projects can aggregate issues and PRs from multiple repositories; repository projects are limited to one repo (Correct answer)
Repository projects can include issues from multiple repos; organization projects cannot

Correct answer: Organization projects can aggregate issues and PRs from multiple repositories; repository projects are limited to one repo

Organization-level projects can pull in issues and pull requests from any repository within the organization, enabling cross-repo tracking.

Question 24: What does 'merging a pull request' mean?

Copying repository to local
Running automated tests
Publishing changes to GitHub Pages
Applying changes from one branch to another (Correct answer)

Correct answer: Applying changes from one branch to another

Merging a pull request means integrating the proposed changes from a feature branch into the base branch (e.g., `main` or `develop`). This action combines the commit history and code modifications, making the changes a permanent part of the target branch. It signifies the completion and acceptance of a feature or fix.

Question 25: What does `git merge` do?

Stages untracked files
Deletes a branch
Combines changes from one branch into another (Correct answer)
Creates a new repository

Correct answer: Combines changes from one branch into another

The `git merge` command integrates changes from a specified branch into your current branch. It combines the commit histories of two branches, creating a new merge commit that incorporates all the changes from both lines of development. This is how features developed in isolation are brought back into the main project.

Question 26: What should you do when troubleshooting a network configuration issue?

Escalate everything without investigation
Make random changes until the problem goes away
Immediately restart all systems
Follow a systematic approach: identify, research, test, implement, verify (Correct answer)

Correct answer: Follow a systematic approach: identify, research, test, implement, verify

A systematic troubleshooting approach ensures the root cause is identified and the fix is verified without creating new issues.

Question 27: How do you install a NuGet package hosted on GitHub Packages in a .NET project?

nuget install MyPackage --source github
Add GitHub as a NuGet feed in Visual Studio and use the Package Manager UI only
dotnet github install MyPackage
dotnet add package MyPackage --source https://nuget.pkg.github.com/OWNER/index.json (Correct answer)

Correct answer: dotnet add package MyPackage --source https://nuget.pkg.github.com/OWNER/index.json

The dotnet add package command accepts a --source flag pointing to the GitHub Packages NuGet feed URL for the owner.

Question 28: What is a repository in GitHub used for?

Encrypting user data
Storing project files and version history (Correct answer)
Running CI/CD pipelines
Hosting websites

Correct answer: Storing project files and version history

A GitHub repository serves as a central location to store all project files, including code, documentation, and assets. Crucially, it also maintains the complete version history of these files, allowing users to track changes, revert to previous states, and collaborate effectively. It's the core unit for project management on GitHub.

Question 29: Which approach is recommended for implementing security fundamentals changes?

Skipping documentation to save time
Implementing changes only during peak hours
Making all changes at once without testing
Following a structured change management process with testing (Correct answer)

Correct answer: Following a structured change management process with testing

A structured change management process with proper testing minimizes risk and ensures successful implementation.

Question 30: How do you tag and push a Docker image to GitHub Container Registry for the user 'octocat' and image 'myapp'?

docker upload ghcr.io/octocat/myapp:latest
gh package push --image myapp --registry ghcr.io
docker push octocat/myapp:latest to ghcr.io
docker tag myapp ghcr.io/octocat/myapp:latest && docker push ghcr.io/octocat/myapp:latest (Correct answer)

Correct answer: docker tag myapp ghcr.io/octocat/myapp:latest && docker push ghcr.io/octocat/myapp:latest

You must tag the image with the full ghcr.io path including namespace before pushing with docker push.

GitHub Foundations Certification (GH-900)

The GitHub Foundations certification validates foundational knowledge of GitHub including Git basics, collaboration features, modern development workflows with Actions and Copilot, project management, security administration, and open source community practices. It is delivered via Pearson VUE as a proctored assessment.

Questions

40 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds