9.2. Next Steps and Confidence Checklist
Build something before you sit the exam. The single highest-return preparation is a repository containing a workflow that uses a matrix, passes data between jobs via outputs and artifacts, calls a reusable workflow, invokes a composite action you wrote, and deploys through an environment with a required reviewer. Break it deliberately: remove a permissions: scope and read the 403, mis-key a cache and watch the hit rate, write to $GITHUB_ENV and read it in the same step. Failures you have seen are failures you recognize instantly on an exam.
Then drill the gaps. Use the flashcards and question bank built alongside this guide, focusing on whichever domain sits lowest. Re-read §7.2 the morning of the exam.
Confidence checklist — you are ready when you can, without notes:
- Recite the execution chain and place any feature on it
- Write an
on:block using activity types, branch filters, and path filters correctly - Distinguish
workflow_dispatchandworkflow_callinput types, and map secrets both ways - Explain what
needs:does and does not provide, and pick the right status function for a cleanup job - State
fail-fast's default and explainincludevs.exclude - Explain why anchors can't cross files, and what reuse mechanism to use instead
- Choose between cache, artifact, step output, and job output for a given piece of data
- Order the policy layers and the secret precedence tiers, and say why environments are special
- Say when self-hosted runners are inappropriate, and diagnose a permanently queued job
- Pick an action type given OS, language, and cleanup requirements
- Explain immutable actions and why SHA pinning is the current baseline
- Rewrite a script-injection-vulnerable step safely and explain the ordering that makes it work
- Configure OIDC end to end, including the permission everyone forgets
- Name three optimizations and the one that must not be applied to deployments
Resources worth keeping open: the official skills-measured page (re-check it before booking — the blueprint changed in January 2026), GitHub Actions documentation, the security hardening guide, and the runner-images repository for what's actually preinstalled.
Good luck. You have the model; the exam is just asking you to apply it, item after item, across 100 minutes.
