GitHub Foundations Practice Exam

What the GitHub Foundations exam covers

• Introduction to Git and GitHub90 questions
• Working with GitHub Repositories172 questions
• Collaboration Features116 questions
• Modern Development206 questions
• Project Management103 questions
• Privacy, Security, and Administration156 questions
• Benefits of the GitHub Community120 questions

Free GitHub Foundations sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 963.

1. Question 1Introduction to Git and GitHub

   What is a Git repository?

   • AA read-only archive of a project's most recent release only
   • BA single file backed up on a shared network drive
   • CA project's version-controlled collection of files and its complete change historyCorrect
   • DA live editing session shared between collaborators in real time
   ✓ Correct answer: C

   Git is the distributed version control system that underlies GitHub. Commits represent immutable snapshots of code changes with unique SHA hashes. Branches enable parallel development lines. Understanding Git concepts is fundamental to using GitHub effectively for version control and collaboration.

   Why the other options are wrong

   • AA repository keeps the entire change history, not just the latest release snapshot.
   • BA repository is a full versioned project, not a single file on a network drive.
   • DGit repositories store committed history, not a real-time shared editing session.
2. Question 2Working with GitHub Repositories

   What is the default primary branch name for new GitHub repositories?

   • Aprod
   • BTrunk
   • CmainCorrect
   • Drelease
   ✓ Correct answer: C

   Git is the distributed version control system that underlies GitHub. Commits represent immutable snapshots of code changes with unique SHA hashes. Branches enable parallel development lines. Understanding Git concepts is fundamental to using GitHub effectively for version control and collaboration.

   Why the other options are wrong

   • Aprod is incorrect because it does not represent the appropriate GitHub feature, configuration, or best practice for this scenario.
   • BTrunk is incorrect because it does not represent the appropriate GitHub feature, configuration, or best practice for this scenario.
   • Drelease is incorrect because it does not represent the appropriate GitHub feature, configuration, or best practice for this scenario.
3. Question 3Modern DevelopmentSelect all that apply

   Which TWO mechanisms can notify a team automatically when a GitHub Actions workflow fails? (Choose TWO)

   • AAdding a status badge for the workflow to the repository README
   • BA workflow step that posts to a chat service like Slack on failureCorrect
   • CGitHub's built-in email notifications for failed runs you followCorrect
   • DMarking the workflow file as a template in repository settings
   ✓ Correct answer: B, C

   GitHub's built-in email notifications for failed workflow runs you are subscribed to. These answers correctly identify valid GitHub Actions features or patterns. Both represent correct implementations for the scenario described in the question.

   Why the other options are wrong

   • AEditing the .gitignore to add the word 'failure' is incorrect because it does not represent a valid GitHub feature or pattern.
   • DIncreasing the repository's star count is incorrect because it does not represent a valid GitHub feature or pattern.
4. Question 4Privacy, Security, and Administration

   Why is requiring an expiration date on personal access tokens a security best practice?

   • AIt reduces the number of scopes an attacker can select when creating the token
   • BIt forces the token to be encrypted at rest on GitHub's servers
   • CIt automatically restricts the token to read-only repository access
   • DIt limits the window an exposed token can be abused before it stops workingCorrect
   ✓ Correct answer: D

   GitHub Actions provides encrypted secret management integrated with the platform. Secrets are encrypted at rest and only decrypted during workflow execution within runner memory. Secrets are referenced using secrets.NAME syntax and are automatically masked from logs, preventing exposure in workflow output or logs.

   Why the other options are wrong

   • AThe expiration date is independent of scope selection and does not limit which scopes can be granted.
   • BGitHub already stores token hashes securely regardless of expiry; the expiry's benefit is time-limiting misuse, not enabling encryption.
   • CExpiration does not change a token's scopes; access level is set by the selected scopes or permissions, not by the expiry date.
5. Question 5Privacy, Security, and Administration

   Why is setting an expiration date on a personal access token considered a security best practice?

   • AIt rotates the token's value automatically once it expires
   • BIt automatically narrows the token's scopes as the expiration date approaches
   • CIt limits how long a leaked or forgotten token remains usable by an attackerCorrect
   • DIt signs each commit made with the token so authorship can be verified
   ✓ Correct answer: C

   GitHub Actions provides encrypted secret management integrated with the platform. Secrets are encrypted at rest and only decrypted during workflow execution within runner memory. Secrets are referenced using secrets.NAME syntax and are automatically masked from logs, preventing exposure in workflow output or logs.

   Why the other options are wrong

   • AAn expired token simply stops working and must be replaced manually; expiration does not auto-generate a new token value.
   • BExpiration does not change a token's scopes over time; scopes are fixed at creation and the expiry only sets when it stops working.
   • DAn expiration date does not sign commits; commit verification comes from GPG, SSH, or S/MIME signing keys, not token expiry.
6. Question 6Working with GitHub Repositories

   On a repository's code view, pressing the keyboard shortcut 't' activates which navigation feature?

   • AThe file finder, which lets you fuzzy-search file paths in the repositoryCorrect
   • BThe branch switcher, which opens a menu to change the active branch
   • CThe blame viewer, which shows who last changed each line of a file
   • DThe commit tagger, which attaches a version tag to the current commit
   ✓ Correct answer: A

   Pressing t on a repository's code view opens the file finder, which fuzzy-searches file paths so you can jump to a file by typing part of its name.

   Why the other options are wrong

   • BSwitching branches uses the branch dropdown, not the t shortcut.
   • CBlame is opened from a file's toolbar, not by pressing t.
   • DPressing t opens the file finder; it does not tag commits.
7. Question 7Collaboration Features

   What does adding a reaction (such as a thumbs-up emoji) to an issue, comment, or discussion allow community members to do?

   • AMerge the pull request that is associated with the issue the reaction was added to
   • BPermanently lock the thread so that no member can add any further comments to it
   • CExpress agreement or sentiment quickly without adding noise through repetitive '+1' commentsCorrect
   • DAutomatically assign the issue to whichever user added the reaction to the item
   ✓ Correct answer: C

   Actions are reusable automation units that encapsulate common tasks in workflows. They can be implemented as JavaScript-based actions, Docker container actions, or composite actions that combine multiple steps. The GitHub Actions marketplace provides thousands of pre-built actions for common tasks like checkout, caching, and deployment.

   Why the other options are wrong

   • AReactions cannot merge a pull request.
   • BReactions express sentiment; they do not lock a thread.
   • DAdding a reaction does not assign the issue to anyone.
8. Question 8Privacy, Security, and Administration

   A maintainer receives a private vulnerability report and wants to collaborate on a fix in a confidential space before disclosing it publicly. Which GitHub feature supports this?

   • AA pull request comment
   • BA repository security advisoryCorrect
   • CA gist
   • DA public issue
   ✓ Correct answer: B

   Git is the distributed version control system that underlies GitHub. Commits represent immutable snapshots of code changes with unique SHA hashes. Branches enable parallel development lines. Understanding Git concepts is fundamental to using GitHub effectively for version control and collaboration.

   Why the other options are wrong

   • AA pull request comment is incorrect because it does not represent the appropriate GitHub feature, configuration, or best practice for this scenario.
   • CA gist is incorrect because README files are documentation artifacts, gists are code snippets, stars are social features for marking favorite repositories, and printers are hardware devices - none are GitHub Actions or Git functionality.
   • DA public issue is incorrect because it does not represent the appropriate GitHub feature, configuration, or best practice for this scenario.
9. Question 9Project Management

   You want a view to show only open items labeled 'bug'. Which feature do you use?

   • AA filter like is:open label:bugCorrect
   • BA new single-select field
   • CThe roadmap zoom control
   • DA saved insights chart
   ✓ Correct answer: A

   A view's filter accepts a query such as is:open label:bug so only items matching those conditions are shown, without changing the underlying items.

   Why the other options are wrong

   • BAdding a field defines new data but does not narrow which items appear.
   • CRoadmap zoom changes the timeline scale, not which items are shown.
   • DAn insights chart summarizes data and does not filter the item list.
10. Question 10Benefits of the GitHub Community

    A developer wants to evaluate a library before adding it as a dependency. What advantage does an open-source project on GitHub give them?

    • AThe library will never introduce breaking changes between versions
    • BThey can read the source code and issue history to judge qualityCorrect
    • CGitHub certifies every open-source library as production ready
    • DThe maintainers include a paid support contract by default
    ✓ Correct answer: B

    Because the source, commits, and issues are public, a developer can assess code quality, activity, and how problems are handled before trusting the project.

    Why the other options are wrong

    • AOpen-source libraries can and do make breaking changes; being open does not freeze the API.
    • CGitHub does not certify libraries as production ready; quality varies and must be assessed.
    • DOpen-source projects usually come with no support contract; support is not provided by default.

Related GitHub resources

• GitHub Foundations study guideKey concepts
• GitHub practice examsAll GitHub
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• GitHub Actions practice examRelated
• GitHub Copilot practice examRelated
• GitHub Advanced Security practice examRelated

GitHub Foundations practice exam FAQ