GH-100 Practice Test

Sample GH-100 Practice Questions

10 real questions from the free GH-100bank. Pick an answer in your head, then open “Show answer” for the explanation.

1. 1. A repository has three teams attached: Team-Read with the Read role, Team-Write with the Write role, and Team-Admin with the Admin role. A user is a member of Team-Read and Team-Write, but not Team-Admin. What effective permission level does that user have on the repository?

   • A. Read, because the most restrictive team role takes precedence
   • B. Admin, because Team-Admin's role is treated as the repository's default whenever any attached team has that role
   • C. Write, because GitHub grants the highest permission level among the teams and direct access a user belongs to for that repository
   • D. No access, because the two role sources cancel each other out
   Show answer

   Correct answer: C

   GitHub resolves conflicting access by using the highest of all applicable role grants -- direct, team-based, or organization base permission -- so the user effectively has Write. Option A inverts the actual rule; the least restrictive applicable role wins, not the most restrictive. Options B and D describe behaviors GitHub does not implement -- an unrelated team's higher role does not escalate members who are not in that team, and permissions do not cancel out.

2. 2. An enterprise owner wants to restrict which enterprise owners can access and export the full enterprise audit log, since it contains sensitive information about many organizations. Which capability supports this?

   • A. Audit log access cannot be restricted; each enterprise owner has unrestricted access with no way to limit it
   • B. A custom enterprise role can be assigned to give specific owners or auditors granular audit log access, rather than granting the full enterprise owner role to everyone who needs to view it
   • C. Audit log access is tied to billing manager status
   • D. Audit log access requires re-entering the SAML SSO credential each time, which is the sole available control
   Show answer

   Correct answer: B

   GitHub supports custom enterprise roles that can be scoped to grant audit log access without the full set of enterprise owner permissions, enabling least-privilege delegation for auditors. Option A overstates the lack of control that actually exists. Option C incorrectly ties audit access to the billing manager role, which is scoped to billing, not auditing. Option D describes a repeated-authentication requirement, not an access-scoping control.

3. 3. An enterprise is migrating its identity provider from Okta to Microsoft Entra ID for GitHub SSO. What is the recommended first step before cutting over production authentication?

   • A. Configure and test the new SAML and SCIM integration with Entra ID in parallel, verifying test user sign-in before disabling the Okta integration
   • B. Disable the Okta SAML configuration immediately to force users onto Entra ID
   • C. Delete existing EMU accounts and recreate them under Entra ID
   • D. Ask users to individually reset their GitHub passwords
   Show answer

   Correct answer: A

   The safe migration pattern is to configure and validate the new IdP integration -- test SAML assertions and SCIM sync -- before cutting over, minimizing lockout risk. Option B risks locking out users with no working IdP during the gap. Option C is destructive and unnecessary -- EMU accounts can be re-mapped, not recreated. Option D is irrelevant since SSO-authenticated users do not rely on a GitHub password to sign in.

4. 4. Which statement accurately distinguishes a GitHub Enterprise Managed User (EMU) account from a standard personal GitHub.com account?

   • A. An EMU account is fully provisioned and controlled by the enterprise through its identity provider, and cannot be used to contribute to public repositories owned outside the enterprise
   • B. An EMU account can freely join any public organization on GitHub.com without enterprise approval
   • C. An EMU account uses the same username namespace as personal accounts, so no naming convention changes
   • D. An EMU account is created solely through GitHub billing configuration, independent of any identity provider
   Show answer

   Correct answer: A

   EMUs are provisioned and deprovisioned entirely via SCIM from the enterprise's IdP, and membership is restricted to enterprise resources, so an EMU user cannot interact with content outside the enterprise. Option B is wrong because EMU accounts are restricted to the enterprise's own organizations. Option C is wrong: EMU usernames are suffixed with the enterprise shortcode (e.g. user_contoso). Option D is wrong because EMU provisioning always requires an identity provider (SAML or OIDC plus SCIM), not a billing setting.

5. 5. An organization enables a ruleset requiring linear history and blocking force pushes on release/* branches, with no bypass list configured. A repository admin attempts to force-push to release/2.1 to fix a bad merge commit. What happens?

   • A. The force push succeeds by default because repository admins bypass rulesets
   • B. The force push succeeds silently and is not recorded anywhere
   • C. The force push is rejected, because without an explicit bypass entry, repository admin status alone does not exempt the actor from the ruleset
   • D. The ruleset is temporarily disabled for the duration of the force push attempt
   Show answer

   Correct answer: C

   Rulesets enforce their rules against anyone who matches the target unless they are explicitly on the ruleset's bypass list -- repository admin status alone does not grant an automatic exemption, unlike some legacy branch-protection behavior. Options A and D describe behavior the ruleset model does not have. Option B is wrong on two counts -- the action does not succeed, and a rejected attempt still generates an audit trail entry.