GitHub Enterprise Administrator Practice Exam

What the GitHub Enterprise Administrator exam covers

• Manage identity and access124 questions
• Deploy and license GitHub Enterprise85 questions
• Secure the enterprise195 questions
• Govern GitHub Actions156 questions
• Monitor usage and cost91 questions

Free GitHub Enterprise Administrator sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 651.

1. Question 1Manage identity and access

   What does an enterprise account provide that an organisation does not?

   • APolicy and billing that apply across every organisation in itCorrect
   • BA place to store repositories shared between teams
   • CA separate identity provider for each team of users
   • DThe ability to create teams with nested membership
   ✓ Correct answer: A

   An enterprise account exists so that settings, security policy and billing can be applied once and inherited by every organisation beneath it, which is what makes it the administrative unit rather than a larger container for content. Repositories live in organisations rather than in the enterprise itself. Identity providers are configured at enterprise or organisation level rather than per team, and nested teams are an organisation feature that predates enterprise accounts.

   Why the other options are wrong

   • BStoring repositories shared between teams describes an organisation, since repositories live there.
   • CA separate identity provider for each team is not how authentication is configured at any level.
   • DCreating teams with nested membership is an organisation feature rather than something the enterprise adds.
2. Question 2Manage identity and access

   Why should organisation owner count be kept small?

   • AOwners can change the settings that constrain everybody elseCorrect
   • BOwners consume the most expensive licence available
   • COwners receive notifications for every repository event
   • DOwners cannot be audited through the standard log
   ✓ Correct answer: A

   The role can alter security settings, membership, policy and repository visibility, so each additional owner increases the number of people able to undo protections the organisation relies on - which is why the list should be short enough for somebody to recognise every name on it. Licensing does not vary by role. Owners do not receive blanket notifications, and their actions are recorded in the audit log like anybody else's.

   Why the other options are wrong

   • BOwners consuming the most expensive licence is untrue, since licensing does not vary by administrative role.
   • COwners receiving notifications for every repository event is not a property of the role.
   • DOwners being unauditable through the standard log is wrong; their actions are recorded like any other.
3. Question 3Deploy and license GitHub Enterprise

   An organisation with a strict residency requirement is considering the cloud. What should be established?

   • AWhether residency covers every service they intend to useCorrect
   • BWhether the vendor operates a datacentre in that country
   • CWhether their identity provider supports the region
   • DWhether support staff are located in the same region
   ✓ Correct answer: A

   The commitment applies to specified data and services, and an organisation intending to use features outside that scope discovers the gap after committing - so checking coverage against the intended feature set is the step that prevents an expensive surprise. Whether a datacentre exists in a particular country is necessary and insufficient without the coverage detail. Identity provider regionality is not a constraint, and support staff location is a distinct consideration from where data resides.

   Why the other options are wrong

   • BWhether a datacentre exists in that country is necessary but insufficient without knowing what is covered.
   • CWhether the identity provider supports the region is not a meaningful constraint on residency.
   • DWhether support staff are in the same region is a separate consideration from where data is stored.
4. Question 4Deploy and license GitHub Enterprise

   What is the most common cause of a migration overrunning its window?

   • ADuration estimated from a rehearsal on smaller dataCorrect
   • BThe vendor's migration tooling failing partway through
   • CNetwork bandwidth between the two environments
   • DRepositories being locked by users during the transfer
   ✓ Correct answer: A

   Trial runs are typically performed on a subset or on staging data, and duration does not scale linearly with volume, so the real migration takes considerably longer than the rehearsal suggested - which is why measured trials should use representative volumes and carry generous margin. Tooling failure is uncommon and recoverable. Bandwidth is a real constraint that is usually identified during the trial, and user locking is prevented by making the source read-only.

   Why the other options are wrong

   • BThe migration tooling failing partway is uncommon and generally recoverable within the window.
   • CNetwork bandwidth is a genuine constraint that a representative trial run normally identifies.
   • DRepositories being locked by users is prevented by making the source read-only before cutover.
5. Question 5Secure the enterprise

   Who should hold the bypass approval role?

   • ASomebody outside the team whose push is being blockedCorrect
   • BThe repository administrator for that repository
   • CThe developer's own line manager in the organisation
   • DAny member of the team with write access
   ✓ Correct answer: A

   Somebody outside the delivery pressure of the blocked team can assess the request on its merits, whereas an approver inside the team shares the deadline and the inconvenience - which is precisely the conflict delegation exists to remove. A repository administrator is frequently inside that same team. A line manager carries the delivery pressure most directly, and any team member with write access reintroduces the conflict entirely.

   Why the other options are wrong

   • BThe repository administrator is frequently inside the same team and shares its delivery pressure.
   • CThe developer's line manager carries the delivery pressure more directly than anybody else.
   • DAny team member with write access reintroduces exactly the conflict that delegation removes.
6. Question 6Secure the enterprise

   How should dependency governance differ between a prototype and a production service?

   • ABy what is enforced at merge, not by what is detectedCorrect
   • BDetection should be disabled on prototype repositories
   • CPrototypes should use a separate package registry
   • DProduction services should update on a slower cadence
   ✓ Correct answer: A

   Keeping visibility across everything costs little and means a prototype that becomes a product is already understood, while reserving blocking checks for repositories that deploy avoids obstructing exploratory work - the difference belongs in enforcement rather than in what is looked at. Disabling detection on prototypes creates the blind spot that matters when a prototype ships. A separate registry adds administration without addressing risk, and slower production updates inverts the appropriate urgency.

   Why the other options are wrong

   • BDisabling detection on prototypes creates exactly the blind spot that matters when a prototype ships.
   • CA separate registry for prototypes adds administrative overhead without reducing any risk.
   • DProduction services updating on a slower cadence inverts where urgency actually belongs.
7. Question 7Secure the enterprise

   What should an enterprise establish immediately after a credential compromise?

   • AWhat that credential could reach and whether it was usedCorrect
   • BWhich policy failed to prevent the credential being committed
   • CWhether the developer received the appropriate training
   • DHow many other repositories contain similar credentials
   ✓ Correct answer: A

   Knowing what the credential granted and examining the logs of the system it reached determines whether this is a near miss or an active incident, which governs every subsequent decision about escalation and notification. Which policy failed belongs in the review afterwards. Developer training is a remediation question, and searching for similar credentials elsewhere is valuable follow-up rather than the immediate priority.

   Why the other options are wrong

   • BWhich policy failed to prevent it belongs in the review after the immediate response has concluded.
   • CWhether the developer received training is a remediation question rather than an immediate one.
   • DSearching for similar credentials elsewhere is valuable follow-up rather than the first priority.
8. Question 8Govern GitHub Actions

   A team argues a required workflow slows their pipeline. What is the right response?

   • AEstablish whether the check is genuinely needed everywhereCorrect
   • BExempt that team so their pipeline runs faster
   • CRemove the required workflow from the organisation
   • DTell the team that policy is not open to discussion
   ✓ Correct answer: A

   Asking whether the check earns its cost in every repository is the honest question, because a control applied without justification accumulates exemptions until it protects nothing - if it is needed, the answer is to make it faster rather than optional. Exempting one team creates the precedent that speed overrides the control. Removing it entirely discards the protection, and refusing to discuss it guarantees the requirement is worked around.

   Why the other options are wrong

   • BExempting that team so their pipeline runs faster sets a precedent that speed overrides the control.
   • CRemoving the required workflow from the organisation discards protection rather than examining it.
   • DTelling the team that policy is closed to discussion guarantees the requirement is quietly evaded.
9. Question 9Govern GitHub Actions

   What is the effect of allowing Actions only in selected repositories?

   • AWorkflows are limited to the repositories that genuinely need themCorrect
   • BThe selected repositories receive additional runner minutes
   • CUnselected repositories lose their existing workflow history
   • DThe selected repositories are exempt from the token policy
   ✓ Correct answer: A

   Restricting to named repositories means Actions is available where builds happen and unavailable in the many repositories that hold documentation, configuration or abandoned code - which reduces both cost and the number of places a workflow could be introduced quietly. No extra minutes are granted. History is preserved in unselected repositories, and the token policy applies to selected ones like any other.

   Why the other options are wrong

   • BThe selected repositories receiving additional runner minutes is not an effect this restriction has.
   • CUnselected repositories losing their existing workflow history is untrue; history remains in place.
   • DThe selected repositories being exempt from the token policy is wrong; that policy still applies.
10. Question 10Monitor usage and cost

    Why does an enterprise review consumed seats regularly?

    • ADeparted and dormant members keep occupying paid seatsCorrect
    • BSeat counts reset automatically at the end of each quarter
    • CUnreviewed seats are converted into metered consumption
    • DReviewing seats increases the number available to allocate
    ✓ Correct answer: A

    Contractors whose engagement ended, staff who moved to another function and accounts created for a project long finished all continue to hold seats until somebody looks, and the reclaimed figure is usually significant in a large estate. Seat counts do not reset on a schedule. Unreviewed seats are not converted to anything, and reviewing does not create additional capacity.

    Why the other options are wrong

    • BSeat counts resetting automatically each quarter is untrue; they persist until membership changes.
    • CUnreviewed seats being converted into metered consumption is not how licensing behaves.
    • DReviewing seats increasing the number available to allocate confuses review with purchasing.

Who this GitHub Enterprise Administrator practice exam is for

This practice set is for anyone preparing for the GitHub Enterprise Administrator exam at the intermediate level - from first-time candidates building a foundation to experienced GitHub practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this GitHub Enterprise Administrator practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real GitHub Enterprise Administrator exam.

Related GitHub resources

• GitHub practice examsAll GitHub
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• GitHub Foundations practice examRelated
• GitHub Actions practice examRelated
• GitHub Copilot practice examRelated

GitHub Enterprise Administrator practice exam FAQ