How hard is the GitHub Actions (GH-200) exam?
The GitHub Actions exam (GH-200) is a moderately hard, intermediate-level exam: straightforward for people who write and maintain Actions workflows, and hard for anyone who has only copied a starter workflow. Microsoft’s audience profile expects expertise in automating workflows with GitHub Actions, including managing it at scale for organisations and enterprises. Many questions show workflow YAML or a log and ask what it will do or why it failed, and a large part of the outline covers runners, secrets, governance and security that individual developers rarely set up.
Why GH-200 questions are hard
GH-200 is about one product, but it goes deep. Questions are specific: which trigger runs a workflow in a given situation, which context holds a value, what an expression evaluates to, how a matrix expands, or where a secret is visible. Reading YAML quickly and accurately is the core skill, and a single wrong keyword or indentation level changes the answer.
The enterprise and security domains add a second kind of difficulty. They ask how Actions should be governed across an organisation — runner groups, allow lists, secret scopes, token permissions — which is knowledge that usually sits with a platform team.
The topics that trip people up
Most wrong answers on GH-200 come from these areas:
- Contexts and expressions: which context (github, env, vars, secrets, inputs, matrix, needs, steps) holds a value, and what is evaluated when the workflow is parsed versus at run time.
- Passing data: job and step outputs, GITHUB_OUTPUT and GITHUB_ENV, artifacts versus caches, and outputs from reusable workflows.
- Reuse: starter workflows versus reusable workflows versus composite actions, and how inputs and secrets are passed with workflow_call.
- Runners and governance: GitHub-hosted versus self-hosted runners, runner groups, organisation policies, and secrets and variables at organisation, repository and environment level.
- Security: least-privilege GITHUB_TOKEN permissions versus personal access tokens, OIDC federation to cloud providers, pinning actions to full commit SHAs, and script injection through untrusted input.
How long it takes to prepare
If you maintain Actions workflows at work, three to five weeks is usually enough to cover the enterprise, custom-action and security objectives you do not use daily. If you have only used existing workflows, allow six to ten weeks, and build workflows in a test repository as you go — matrices, reusable workflows, a custom action and a self-hosted runner — because reading about them is not enough for this exam.
Microsoft notes that commonly used preview features can appear, so study from the current GitHub documentation rather than older notes.
Who finds it hardest
Developers who use Actions only for one repository find the enterprise domain hardest: runner groups, organisation policies and secret scoping never come up for them. People who know another CI/CD tool well understand pipelines but trip on Actions-specific syntax, contexts and expression rules. Candidates who learned Actions a few years ago can be caught out by newer outline items such as immutable actions, YAML anchors and artifact attestations.
How to tell you are ready
Take workflow files you have not seen and predict what will run, in what order, with which values, before checking. When you can do that reliably, explain why each wrong option in a practice question is wrong, and pass timed mixed practice consistently, you are ready to book.
Plan your prep
Questions, answered
Source
Exam facts in this guide come from the vendor's published exam guide. Vendors revise these — check the source for the current version before you book.