GH-200 (GitHub Actions Associate) tests whether you can run CI/CD automation in production, not whether you can recite workflow YAML from memory. Pass it by studying the five domains in proportion to their published weight, treating Microsoft's January 2026 objective rewrite as the current baseline — older prep material predates it — and putting your hardest hours into the security and enterprise-governance domains, where most candidates who already write workflows daily still lose points.
MSCertQuiz sells 500-question practice access for GH-200 and other Microsoft and GitHub certifications; this guide is written by the team that maintains that question bank, grounded in Microsoft's own GH-200 study guide and certification page (both checked September 7, 2026).
What Changed When Microsoft Rewrote GH-200 in January 2026
Microsoft's own change log for this exam is unusually direct: the objectives "changed significantly" in January 2026 — new topics were added, some were removed, and the rest were reworded into their current five-domain shape. That matters more than a routine yearly refresh. Candidates studying from courses, dumps, or blog posts written before that date are working from a blueprint that no longer matches what's tested.
The additions worth knowing about specifically: YAML anchors and aliases for reusing repeated mappings within one workflow file, the 2026 immutable-actions enforcement on GitHub-hosted runners and what it does (and doesn't) mean for tag pinning, artifact attestations and build provenance under the security domain, and an explicit callout of nested reusable-workflow depth limits. None of these are exotic — they're exactly the kind of detail that separates "I've used Actions" from "I can pass GH-200."
What Does GH-200 Actually Test?
GH-200 measures five skill areas, each weighted as a range rather than a fixed number — Microsoft's own study guide states these percentages directly and notes the objectives "changed significantly" in January 2026, with new topics added, some removed, and the rest reworded. Anything you studied from before that date should be treated as a rough map, not the current territory.
| Domain | Weight |
|---|---|
| Author and manage workflows | 20-25% |
| Consume and troubleshoot workflows | 15-20% |
| Author and maintain actions | 15-20% |
| Manage GitHub Actions for the enterprise | 20-25% |
| Secure and optimize automation | 10-15% |
Building workflows that don't just work once
The largest domain is about structure, not just triggers. You need to configure workflow_dispatch inputs with real types and defaults, pass those inputs into a called workflow via workflow_call, and use strategy.matrix deliberately — knowing when fail-fast is saving you compute versus hiding a second failure. Service containers, job outputs via GITHUB_OUTPUT, and GITHUB_STEP_SUMMARY Markdown reports round this domain out — all things you only learn by actually running workflows, not by reading the syntax page once.
Making sense of a workflow you didn't write
A meaningful slice of the exam hands you a broken run and asks what happened — reading logs, correlating a failed job name back to its matrix axis, and rerunning a single matrix variant instead of the whole run. The other half of this domain is knowing the difference between a starter workflow (a one-time scaffold you copy and then own) and a reusable workflow invoked through workflow_call (a live, versioned definition someone else maintains) — the exam tests this distinction directly, not just the vocabulary.
Shipping an action other teams will actually trust
This domain covers the three action types (JavaScript, Docker, composite), the metadata and file structure an action needs, and how to version and publish one to the Marketplace. Since GitHub's 2026 rollout of immutable action releases, this domain also touches what "immutable" means for consumers pinning to a tag versus a commit SHA — a detail candidates who've only consumed actions, never published one, tend to skip.
Running Actions across an org, not just one repo
Tied with the first domain for the highest weight, this is the section personal-project experience covers least. It asks about runner groups, IP allow lists, org-level action allow/deny policies, and secrets scoped at the organization, repository, or environment level — plus knowing what software ships preinstalled on a GitHub-hosted runner image versus what you install at runtime with a setup-* action.
Locking it down without breaking it
The smallest domain by weight is often where solo-project candidates lose the most points, because none of it comes up until an organization forces the question: OIDC federation to remove long-lived cloud secrets, the GITHUB_TOKENlifecycle versus a personal access token, pinning third-party actions to a full commit SHA instead of a floating tag, and generating artifact attestations for build provenance. It's a small percentage of the exam that a surprising number of candidates fail outright.
Studied the domains above?
Drill Them With Free GH-200 Questions
Scenario questions with full rationale for the right answer and every wrong one. No credit card required.
Start Free Practice →The Questions Everyone Asks Before Booking GH-200
Is GH-200 just memorizing YAML syntax?
No. The exam leans on scenarios — a broken run, a security requirement, a cost problem — and asks which YAML feature or GitHub setting solves it. Knowing that workflow_call exists matters less than knowing when to reach for it over a starter workflow.
Do I need real Docker experience to pass?
You need to know Docker actions are one of three action types and roughly how they package a container image for a step — not how to write production Dockerfiles. Custom container internals aren't the focus; recognizing when a Docker action is the right authoring choice is.
Is GH-200 secretly testing GitHub Copilot?
No — Copilot isn't in any of the five GH-200 domains. That content lives entirely under GH-300 (GitHub Copilot). GH-200 stays focused on workflows, actions, enterprise governance, and automation security.
Can I pass using prep material written before 2026?
Risky. Microsoft's own change log states the objectives were reworded and restructured in January 2026 — YAML anchors/aliases, immutable action releases, and artifact attestations are newer additions that older courses and dumps won't cover.
Is GH-200 harder than GH-900?
They're not really comparable — GH-900 (GitHub Foundations) is a breadth exam over the whole platform; GH-200 goes deep on one capability (Actions) at production scale. Candidates who've only used Actions for basic CI, never runner groups or OIDC, find GH-200 the harder of the two.
Is 100 minutes enough time?
Most candidates report time isn't the constraint — the questions describe a scenario and ask for the mechanism that solves it, which is quick to answer once you recognize the pattern. The candidates who run short are usually re-reading YAML syntax they never actually practiced writing, not running out of raw minutes.
What a GH-200 Question Actually Looks Like
A platform team maintains one CI definition that 15 application repositories all need, and wants a single edit to that definition to update every repository's pipeline the next time it runs. Which approach fits?
The answer is a reusable workflow invoked from each of the 15 repos via workflow_call — not a starter workflow. A starter workflow only looks similar on the surface: it's copied once from the Actions template gallery and immediately becomes an independent file with no ongoing link back, so editing the "source" later does nothing for the 15 repos that already copied it. That distinction — copied-once versus centrally invoked — is exactly the kind of surface-similar pair GH-200 tests directly rather than testing YAML syntax in isolation.
Microsoft Learn vs. GitHub Docs vs. MSCertQuiz
None of these three replaces the other two — they cover different gaps.
| Resource | Best for | Weak spot |
|---|---|---|
| Microsoft Learn training path ("Automate your workflow with GitHub Actions") | Structured, self-paced modules mapped to the actual exam objectives | Thin on enterprise-scale governance topics |
| GitHub's own documentation (docs.github.com/actions) | The authoritative source for every YAML key, context, and permission | Reference-organized, not exam-organized — hard to know what's in scope |
| MSCertQuiz practice questions | Scenario recognition and finding domain-specific weak spots before exam day | Not a substitute for hands-on YAML authoring |
A workable order: read the Microsoft Learn modules for structure, keep GitHub's docs open while you actually write workflows in a scratch repo, then use 500 GH-200 practice questions to find which domain still trips you up before you book the exam.
How Many Study Hours Each Domain Actually Needs
This 30-hour baseline assumes you already write and run GitHub Actions workflows at work — proportioned to the midpoint of each domain's published weight range. Candidates newer to Actions should roughly double every number, which lines up with Microsoft's own "3-5 weeks experienced, 6-8 weeks newer" framing.
| Domain | Weight | Baseline hours |
|---|---|---|
| Author and manage workflows | 20-25% | 7 hrs |
| Manage GitHub Actions for the enterprise | 20-25% | 7 hrs |
| Consume and troubleshoot workflows | 15-20% | 5.5 hrs |
| Author and maintain actions | 15-20% | 5.5 hrs |
| Secure and optimize automation | 10-15% | 5 hrs |
Total: ~30 hours. Spend the last 2-3 hours entirely on timed practice questions, not new material.
MSCertQuiz sells practice-exam access for GH-200 and other GitHub and Microsoft certifications; this study guide is written by the same team that builds and maintains that question bank.
Related Resources
Every task mapped to the YAML key or setting that solves it, plus an "if the question says X" pattern table.
15 scenario questions split into Easy, Medium, and Hard tiers.
Starting from zero on GitHub? The Foundations exam is the natural prerequisite.
Ready to go broader? AZ-400 covers DevOps practices across the whole toolchain, not just GitHub Actions.
Frequently Asked Questions
Do I need a GitHub Enterprise environment to study for GH-200?
No. Most GH-200 content — triggers, matrix strategy, reusable workflows, OIDC — can be practiced on any free personal GitHub account. Only runner-group and org-level policy topics need an organization, and GitHub Free organizations support enough of that to practice the concepts.
Is the GH-200 exam multiple-choice, or are there hands-on labs?
It's multiple-choice, proctored remotely through Pearson VUE — there is no live lab environment. Microsoft's free exam sandbox (GHCertDemo.starttest.com) shows the exact interface and question types before you sit the real thing.
Does the GH-200 certification expire?
Yes. Like other Microsoft associate certifications, it's valid for one year and renews through a free online assessment on Microsoft Learn — not a full retake of the exam.
What happens if I fail GH-200?
You can retake it 24 hours after a first failed attempt. The wait grows for later retakes — Microsoft's published retake policy has the current intervals.
Is GH-200 recognized the same way as an Azure exam like AZ-400?
It's a separate credential under the GitHub certification track rather than the Azure track, but both sit inside Microsoft's certification program and both typically count toward Microsoft Partner competency requirements.
Can I take GH-200 in a language other than English?
Yes — English, Spanish, Portuguese (Brazil), Korean, and Japanese are currently supported. Non-English versions typically lag about eight weeks behind an English-version update.