GHA-SEC Practice Test

GHA-SEC practice test: what's covered

• OIDC
• Secrets
• Permissions
• Reusable Workflows
• Supply Chain
• Branch Protection

Free GHA-SEC sample questions

1. A security engineer needs to stop pull requests from untrusted forks from exfiltrating secrets during a controlled production rollout. Which response is the BEST fit?

   • A. use appropriate trigger choices, environment protections, and secret availability rules for fork PRs — with change evidence recorded
   • B. expose all repository secrets to pull_request_target from forks by default — with change evidence recorded
   • C. disable all CI checks for external contributors — with change evidence recorded
   • D. store production cloud keys in workflow source as plain text — with change evidence recorded
   Show answer

   Correct: A. use appropriate trigger choices, environment protections, and secret availability rules for fork PRs — with change evidence recorded is the best answer because fork PR trust boundaries prevent secret theft via malicious workflows. The other choices are not the best fit because they either address the wrong layer, broaden access unnecessarily, or skip validation. Useful evidence includes trigger type, secret context, and environment gate.

2. An administrator must stop pull requests from untrusted forks from exfiltrating secrets while investigating an urgent support case. Which action should be taken first?

   • A. use appropriate trigger choices, environment protections, and secret availability rules for fork PRs — after confirming scope and ownership
   • B. expose all repository secrets to pull_request_target from forks by default — after confirming scope and ownership
   • C. disable all CI checks for external contributors — after confirming scope and ownership
   • D. store production cloud keys in workflow source as plain text — after confirming scope and ownership
   Show answer

   Correct: A. use appropriate trigger choices, environment protections, and secret availability rules for fork PRs — after confirming scope and ownership is the best answer because fork PR trust boundaries prevent secret theft via malicious workflows. The other choices are not the best fit because they either address the wrong layer, broaden access unnecessarily, or skip validation. Useful evidence includes trigger type, secret context, and environment gate.

3. A company plans to stop pull requests from untrusted forks from exfiltrating secrets during an audit-readiness review. Which design best meets the requirement?

   • A. use appropriate trigger choices, environment protections, and secret availability rules for fork PRs — using the vendor-supported workflow
   • B. expose all repository secrets to pull_request_target from forks by default — using the vendor-supported workflow
   • C. disable all CI checks for external contributors — using the vendor-supported workflow
   • D. store production cloud keys in workflow source as plain text — using the vendor-supported workflow
   Show answer

   Correct: A. use appropriate trigger choices, environment protections, and secret availability rules for fork PRs — using the vendor-supported workflow is the best answer because fork PR trust boundaries prevent secret theft via malicious workflows. The other choices are not the best fit because they either address the wrong layer, broaden access unnecessarily, or skip validation. Useful evidence includes trigger type, secret context, and environment gate.

4. During troubleshooting, the team must stop pull requests from untrusted forks from exfiltrating secrets after a regional service change. Which next step is most defensible?

   • A. use appropriate trigger choices, environment protections, and secret availability rules for fork PRs — with least privilege preserved
   • B. expose all repository secrets to pull_request_target from forks by default — with least privilege preserved
   • C. disable all CI checks for external contributors — with least privilege preserved
   • D. store production cloud keys in workflow source as plain text — with least privilege preserved
   Show answer

   Correct: A. use appropriate trigger choices, environment protections, and secret availability rules for fork PRs — with least privilege preserved is the best answer because fork PR trust boundaries prevent secret theft via malicious workflows. The other choices are not the best fit because they either address the wrong layer, broaden access unnecessarily, or skip validation. Useful evidence includes trigger type, secret context, and environment gate.

5. An administrator needs to stop pull requests from untrusted forks from exfiltrating secrets before approving a high-risk release. Which TWO actions provide the strongest implementation and verification? (Choose TWO)

   • A. use appropriate trigger choices, environment protections, and secret availability rules for fork PRs — with monitoring and rollback defined
   • B. verify the result using trigger type, secret context, and environment gate — with monitoring and rollback defined
   • C. expose all repository secrets to pull_request_target from forks by default — with monitoring and rollback defined
   • D. disable all CI checks for external contributors — with monitoring and rollback defined
   • E. store production cloud keys in workflow source as plain text — with monitoring and rollback defined
   Show answer

   Correct: A and B. use appropriate trigger choices, environment protections, and secret availability rules for fork PRs — with monitoring and rollback defined and verify the result using trigger type, secret context, and environment gate — with monitoring and rollback defined are correct because fork PR trust boundaries prevent secret theft via malicious workflows. The other options are not appropriate: they weaken scope, skip a required control, or do not provide reliable evidence for this GitHub Actions Security scenario.

Last updated: 2026-10-19

GHA-SEC practice test FAQ