[Jun 14, 2026] New Microsoft GH-100 Dumps with Test Engine and PDF (New Questions)
Pass Your GH-100 Exam Easily - Real GH-100 Practice Dump Updated
NEW QUESTION # 28
You are planning GitHub account management for a healthcare organization with strict compliance requirements. Which THREE of the following statements accurately describe GitHub Enterprise Managed Users (EMU) accounts? (Choose three.)
- A. EMU accounts are managed through an identity provider such as Azure AD.
- B. EMU accounts restrict users to enterprise-related activities only
- C. EMU accounts are created and managed by individual users.
- D. EMU accounts are owned by the organization and cannot be unlinked.
- E. EMU accounts can be used for both personal and enterprise repositories.
- F. EMU accounts allow users to create and manage their own credentials.
Answer: A,B,D
Explanation:
Enterprise Managed User accounts are provisioned and authenticated exclusively through your identity provider (for example, AzureAD), so the IdP handles their creation, attribute updates, and deprovisioning.
Managed user accounts cannot create public content or interact with repositories outside your enterprise; they're confined to private and internal repos within the enterprise.
EMU accounts are owned and controlled by the enterprise (via the IdP) and cannot be converted into or unlinked as personal accounts outside that enterprise.
NEW QUESTION # 29
When comparing Group SCIM to Team Sync for identity management in GitHub Enterprise, which statement is Correct?
- A. Group SCIM enables centralized user and group management through the IdP.
- B. Team Sync provides more automated user deprovisioning than Group SCIM.
- C. Group SCIM requires less initial configuration than Team Sync.
- D. Team Sync supports more identity providers than Group SCIM.
Answer: A
Explanation:
GroupSCIM lets you manage both user accounts and group memberships centrally in your identity provider - automatically provisioning, updating, and deprovisioning users and groups in GitHub - whereas TeamSync only mirrors IdP group membership into existing GitHub teams.
NEW QUESTION # 30
How is CodeQL different from other static analysis tools?
- A. It runs analysis only after a security breach.
- B. It removes insecure code automatically
- C. It allows querying of code semantics using a database-like language.
- D. It only works for open-source projects.
Answer: C
Explanation:
CodeQL differs from traditional static analysis tools by ingesting your code into a queryable database and letting you write QL queries - its own database-style language - to express semantic checks and find patterns across the codebase.
NEW QUESTION # 31
Which of the following is the responsibility of an Organization Owner in GitHub? (Choose three.)
- A. Create repositories without approval from other members.
- B. Access repositories only if explicitly granted by a team maintainer.
- C. View and manage organization billing information.
- D. Manage organization settings, such as configuration and default permissions.
Answer: A,C,D
Explanation:
Organization owners can view and edit billing information for the organization.
Organization owners may create new repositories in the organization without needing approval from other members.
Organization owners have full administrative control over organization settings, including configuring default repository permissions.
NEW QUESTION # 32
When a token is used to perform actions across different GitHub resources, how is this reflected in audit logs?
- A. Only the first repository accessed is recorded
- B. The audit log stores only the token name and not its actions
- C. Each API action made with the token generates a separate audit log entry
- D. GitHub creates a ZIP archive of all token activity
Answer: C
Explanation:
Each API call authenticated with a token generates its own audit-log event, so you'll see a distinct entry for every action performed across different resources, each annotated with the token's hashed ID, actor, and source IP.
NEW QUESTION # 33
What is the potential consequence of enabling multiple rulesets that apply to the same branch in a repository?
- A. Rulesets will override each other, leading to unpredictable behavior
- B. Only organization-level rulesets are enforced over repository-level ones
- C. Only the most recently created ruleset will be enforced
- D. All applicable rulesets will be evaluated, and their combined rules enforced
Answer: D
Explanation:
If you enable multiple rulesets that target the same branch, GitHub will evaluateevery matching ruleset and enforce the aggregate of their rules - so all constraints from all applicable rulesets apply.
NEW QUESTION # 34
What makes GitHub Apps a more secure choice for automation over OAuth Apps?
- A. GitHub Apps are limited to read-only access and cannot write to repositories.
- B. GitHub Apps can only be installed by organization owners.
- C. GitHub Apps authenticate as an app with fine-grained permissions, not as a user.
- D. GitHub Apps always require two-factor authentication.
Answer: C
Explanation:
GitHub Apps authenticate as themselves with fine-grained, installation-scoped permissions and short-lived tokens - rather than inheriting a user's broad OAuth scopes - minimizing blast radius and aligning with least-privilege principles.
NEW QUESTION # 35
A token was used to access an organization's resource via API. What fields in the audit log help determine who used it?
- A. The token expiration date
- B. The GitHub Actions runner name
- C. The token's permissions and the geographic region of access
- D. The token ID, requesting IP address, and associated user
Answer: D
Explanation:
The audit log records the token's identifier (the hashed_token value), the source IP address of the request, and the actor (the user or app) associated with that token, allowing you to trace exactly who used it.
NEW QUESTION # 36
Your organization wants to reduce costs. Which of the following actions should you take?
- A. Regularly audit for inactive users
- B. Grant all users admin permissions
- C. Disable SAML SSO for members
- D. Remove all outside collaborators
Answer: A
Explanation:
Regularly auditing for inactive (dormant) users lets you suspend or remove accounts that aren't consuming seats - freeing up licenses and directly lowering your per-user subscription costs.
NEW QUESTION # 37
How does Dependabot determine which security update PRs to open?
- A. It uses the dependency graph and Dependabot alerts to open PRs for patched versions.
- B. It waits for manual triage of all CVEs.
- C. It compares your codebase to the GitHub Trending list.
- D. It reads the GitHub Issues and automatically suggests fixes.
Answer: A
Explanation:
Dependabot relies on your repository's enabled Dependency Graph and Dependabot Alerts to identify vulnerable dependencies; it then automatically opens pull requests to update to the patched versions that resolve those alerts.
NEW QUESTION # 38
What is a key characteristic of GitHub Enterprise Server (GHES) compared to GitHub Enterprise Cloud (GHEC)?
- A. GHES is hosted by GitHub and offers automatic scaling, while GHEC requires self-hosting.
- B. GHEC offers data residency options in regions that GHES does not support.
- C. GHES allows enterprises to have complete control over their hosting environment, including data storage and network security policies.
- D. GHES users cannot integrate with external identity providers for authentication.
Answer: C
Explanation:
GitHub Enterprise Server is a self-hosted product you install and manage on your own infrastructure - giving you full control over data storage, network security policies, and the underlying environment.
NEW QUESTION # 39
Which events from the audit log are exposed by the GraphQL API? Each answer presents a complete solution. (Choose three.)
- A. changes in permissions
- B. pushes to repositories
- C. changes to permissions of a GitHub App
- D. cloning of repositories
- E. promoting users to administrators
Answer: A,C,E
Explanation:
The GraphQL Audit Log API surfaces entries whenever repository or organization permissions are changed ("Changes permissions").
It records when users are elevated to administrative roles ("Promotes users to admin").
It logs alterations to a GitHub App's granted permissions ("Changes permissions of a GitHub App").
NEW QUESTION # 40
In a GitHub repository using Dependabot, which of the following best describes the purpose of the .github/dependabot.yml file?
- A. It lists commit SHAs to exclude from automatic pull requests.
- B. It configures scheduling, package ecosystems, and target directories for update checks.
- C. It encrypts dependency versions before storing them in the repo.
- D. It enables GitHub to scan for secrets in dependency files.
Answer: B
Explanation:
The .github/dependabot.yml file defines Dependabot's package-ecosystem, the directories to inspect, and the update schedule (daily/weekly/monthly), controlling when and where Dependabot checks for new versions.
NEW QUESTION # 41
Which of the following is a key benefit of using GitHub Marketplace Apps in an enterprise?
- A. Apps eliminate the need for GitHub Actions entirely
- B. They guarantee no downtime during enterprise GitHub maintenance windows
- C. All apps come pre-approved by GitHub's internal security team
- D. They often include integrations with external services, reducing the need for custom code
Answer: D
Explanation:
GitHub Marketplace Apps come with built-in integrations to external services - so you can plug in things like CI servers, code-quality scanners, or deployment tools without writing and maintaining custom connectors.
NEW QUESTION # 42
Which of the following GitHub token types supports fine-grained repository permissions AND is recommended for CI/CD automation?
- A. GitHub App Installation Access Tokens
- B. OAuth tokens
- C. Device Tokens
- D. Personal Access Tokens (PATs)
Answer: A
Explanation:
GitHub App Installation Access Tokens are privileged to the exact permissions you grant the App - down to individual repositories - and rotate automatically, making them the recommended choice for CI/CD automation workflows that demand least-privilege, fine-grained access.
NEW QUESTION # 43
An organization wants to share a single API key required for their Actions workflows. They need to restrict its use to only a subset of repositories. Where should they configure the secrets to minimize maintenance?
- A. Environment secrets
- B. Organization secrets
- C. Repository secrets
- D. Development environment secrets
Answer: B
Explanation:
By defining the API key as an organization secret, you centralize management and can grant access only to the subset of repositories you choose - eliminating per-repo duplication while enforcing the desired scope.
NEW QUESTION # 44
Why would someone choose to configure a security policy?
- A. To provide information on an open source repository for open source collaborators and researchers that may need to report and disclose sensitive security findings to maintainers securely.
- B. To communicate corporate security and compliance policies for end users on a private repository.
- C. To define which open source packages are permitted for use as part of that repository.
- D. To prevent anyone from pushing to the repository without approval.
Answer: A
Explanation:
A security policy (the SECURITY.md file) lets maintainers of an open source repository provide clear, private instructions for collaborators and external researchers on how to report and disclose security vulnerabilities responsibly.
NEW QUESTION # 45
Our organization is updating its enterprise policies. Which of the following steps should you take to ensure alignment with security requirements?
- A. Maintain clear documentation of existing policies and policy changes.
- B. Regularly assess and adjust policies based on evolving risks.
- C. Implement changes without consulting stakeholders.
- D. Implement the new enterprise policies across the organization first and then consult with the security team to identify- any necessary adjustments or retrofits
Answer: A,D
NEW QUESTION # 46
What distinguishes Enterprise Managed Users (EMUs) from standard GitHub accounts?
- A. EMUs are fully controlled by an IdP and cannot log in with personal credentials
- B. EMUs are managed in GitHub and use GitHub authentication
- C. EMUs can only be created using email invites
- D. EMUs are only available for GitHub Enterprise Server
Answer: A
Explanation:
EMU accounts are provisioned and authenticated exclusively through your identity provider - users sign in via the IdP and cannot use or manage GitHub-native credentials.
NEW QUESTION # 47
Which of the following correctly describes the difference between controlling actions at the enterprise level versus the organization level in GitHub?
- A. Enterprise policies apply only to public repositories, while organization policies apply to public, internal, and private repositories.
- B. Enterprise policies configure mandatory settings for organizations.
- C. Enterprise policies can block specific actions, while organization policies can only enable or disable actions entirely.
- D. Enterprise policies and organization policies are independent, with organization policies taking precedence for repositories within the organization.
Answer: B
Explanation:
Enterprise policies let you define and enforce mandatory settings across all member organizations - organization-level policies then operate within the options that the enterprise policy exposes.
NEW QUESTION # 48
Which of the following is a benefit of creating a new GitHub organization?
- A. Clear separation of reggs, projects, teams, billing, and organization-specific policies.
- B. Simplified collaboration across all organizations.
- C. Automatic inheritance of policies from other organizations.
- D. Reduced administrative overhead.
Answer: A
Explanation:
Creating a new organization gives you a dedicated container for your shared work, letting you isolate repositories, projects, teams, billing settings, and policy configurations on an organization-by-organization basis.
NEW QUESTION # 49
Which of the following actions can a user with Write permissions perform in a GitHub repository?
- A. Push code to non-protected branches.
- B. Manage repository settings, such as labels and GitHub Pages.
- C. Configure branch protection rules.
- D. Delete the repository.
Answer: A
Explanation:
Users granted Write permission can push commits to non-protected branches, allowing them to update code without needing administrative rights.
NEW QUESTION # 50
Which product's usage is not included in GitHub Enterprise Cloud's monthly metered billing report?
- A. GitHub Actions minutes
- B. Git LFS bandwidth
- C. GitHub Packages storage
- D. GitHub Discussions engagement
Answer: D
Explanation:
GitHubDiscussions engagement isn't a metered product and doesn't appear in the "Product billing" list, so its usage isn't included in the monthly metered billing report.
NEW QUESTION # 51
......
Actual4dump just published the Microsoft GH-100 exam dumps!: https://pass4sure.actual4dump.com/Microsoft/GH-100-actualtests-dumps.html