7.3. Practice Questions
Ten mixed-domain questions in the exam's style. Commit to an answer before expanding the rationale.
1. A scheduled workflow defined on the release-2.0 branch with cron: '0 9 * * *' never runs, though the identical file works on main. Why?
Answer and rationale
Scheduled workflows run only from the default branch. The file's presence on release-2.0 is irrelevant — GitHub schedules from the default branch's copy. Note also that 0 9 is 09:00 UTC, not local time. §2.1.1
2. A deploy job with needs: build fails with "command not found" for a CLI that the build job installed successfully. What is the fix?
Answer and rationale
Install (or cache, or containerize) the CLI within the deploy job. needs: provides ordering and an outputs channel only — deploy runs on a fresh runner with none of build's installed software. Distractors offering needs: adjustments or artifact uploads of the binary miss the mechanism. §1.2.2, §2.2.1
3. A 12-variant matrix reports one failure and eight cancelled. Which two statements are true?
Answer and rationale
(a) fail-fast is at its default value of true, and (b) the cancelled variants tell you nothing about whether they would have passed. Set fail-fast: false to obtain a complete compatibility picture before diagnosing. §2.2.4, §4.1.3
4. A step runs echo "VERSION=1.2.3" >> $GITHUB_ENV and then echo "Building $VERSION" in the same run: block. The log shows Building. Why?
Answer and rationale
Environment files are processed between steps, so $VERSION is available only to subsequent steps. Within the same step use an ordinary shell variable, writing to $GITHUB_ENV as well if later steps need it. §2.2.2, §2.3.2
5. An organization must permit one specific third-party action while blocking all other Marketplace actions. Which configuration?
Answer and rationale
"Allow specified actions and reusable workflows" with an allowlist entry such as owner/action@* (optionally combined with the GitHub-created and verified-creator tiers). "Allow all" is too permissive; "local only" blocks the required action too. Remember the tiers are separate checkboxes, not a single ladder. §3.1.2
6. A deployment job must reach a database that accepts connections only from three fixed IP addresses, and the team wants to avoid managing servers. Which option meets both requirements?
Answer and rationale
Larger GitHub-hosted runners with a static IP range assigned. Self-hosted runners would also satisfy the IP requirement but contradict "avoid managing servers"; standard hosted runners draw from GitHub's broad, changing ranges. §3.2.1, §3.2.2
7. A workflow step fails with "Resource not accessible by integration" the morning after an organization settings change, with no commits to the repository. What happened, and what is the fix?
Answer and rationale
The organization's default GITHUB_TOKEN permissions were set to read-only, and the job needs more. Add an explicit permissions: block granting the required scope (for example contents: write) at the workflow or job level. A PAT would "work" but is the wrong answer — it escalates privilege to fix a permissions gap. §2.1.4, §4.1.2, §6.1.1
8. A team wants shared logic that runs between two existing steps of a caller's job, calls two other actions, and needs a repository secret. Which mechanism, and what must the caller do?
Answer and rationale
A composite action — it inlines into the caller's job and can include uses: steps. Because composite actions do not receive the secrets context automatically, the caller must pass the secret as a declared input. A reusable workflow cannot splice between steps. §4.3.2, §5.1.1
9. Which reference style protects against a maintainer's compromised account force-pushing a tag to malicious code?
Answer and rationale
A full 40-character commit SHA (or an immutably published action version). @v1, @v1.2.3 on an ordinary Git tag, and @main all resolve through movable references. This is precisely the tj-actions/changed-files failure mode. §5.1.2, §6.1.4
10. A workflow deploys to AWS using a stored access key pair and the security team requires eliminating long-lived cloud credentials. Describe the change.
Answer and rationale
Configure OIDC federation: add permissions: id-token: write, use aws-actions/configure-aws-credentials with role-to-assume, and create an IAM role whose trust policy validates GitHub's OIDC provider and constrains the sub claim to the repository and a specific ref or environment. No secret is stored in GitHub; credentials are minted per run and expire in minutes. Omitting id-token: write is the most common failure. §6.1.3
