GitHub Actions Certification: Half of GH-200 Is Admin Work

What does the GitHub Actions certification test?

The GitHub Actions certification, GH-200, tests whether you can automate software delivery with GitHub Actions at organisational scale. It covers authoring and maintaining workflows, consuming and troubleshooting them, building custom actions, governing Actions across an enterprise, and securing and optimising the whole arrangement. Microsoft positions it at intermediate level for the GitHub product.

Microsoft names five roles for the exam rather than one: administrator, developer, DevOps engineer, solution architect, and student. That list is unusual, and it is the first clue about what the paper actually contains. An exam written only for people who author workflows would not name administrator first.

The subject classification is DevOps and the assumed background is wider than Actions alone. Microsoft expects familiarity with continuous integration and delivery as a practice, with GitHub repositories, with GitHub Packages, and with wiring third-party services into a pipeline. Someone whose entire exposure is a single repository’s build file will find the assumed context missing rather than the syntax hard.

If the underlying practice itself is new to you, the vocabulary of continuous integration and delivery is worth settling before the exam objectives will read cleanly, because the syllabus uses those terms as given rather than defining them.

Where do the marks sit across the five domains?

GH-200 publishes five domains with banded weightings rather than fixed percentages. Author and manage workflows and Manage GitHub Actions for the enterprise are jointly the heaviest at 20 to 25 percent each. Consume and troubleshoot workflows and Author and maintain actions follow at 15 to 20 percent, and Secure and optimize automation is the lightest at 10 to 15 percent.

Banded weightings are worth pausing on. The low end of the five bands adds to 80 percent and the high end to 105, which means Microsoft is reserving room to move the mix between exam forms. Planning on the upper figure for each domain is the safe reading.

The quickest way to find out which of the five is your weak one is to work items drawn across all of them rather than to reread the objectives. The sets on the money site’s GH-200 practice exam are spread over the five domains in roughly the published proportions, which makes a lopsided profile visible in one sitting.

Half of GH-200 is administration, not authoring

Add the enterprise domain to the security domain and you get 30 to 40 percent of the paper on governing Actions rather than writing them. Add troubleshooting other people’s workflows and the share of the exam that is not greenfield authoring reaches roughly two thirds. That is the single most useful thing to know before booking.

What the enterprise domain actually asks

Three objective groups sit under it, and none of them appear in a typical developer’s week. Distributing and governing actions covers reusable components, access control within the enterprise, and organisational use policies. Managing runners at scale covers hosted and self-hosted runners, IP allow lists, runner groups, and the preinstalled software and toolcache on hosted images. Managing encrypted secrets and variables covers scoping at organisation, repository and environment level, and doing it programmatically through the REST API.

The runner objectives are the ones that surprise people most. Knowing that a job runs on ubuntu-latest is not the same as knowing which tool versions that image ships, how to install what it does not, or what happens to a queued job when a runner group’s allow list rejects the network it sits on.

Troubleshooting is a separate skill from authoring

Consume and troubleshoot workflows is written entirely from the reader’s side rather than the author’s. It asks you to infer triggers from configuration and logs, to expand YAML anchors and merged mappings when reading someone else’s file, to correlate job names back to matrix axes, and to rerun individual matrix jobs selectively.

Reading a matrix expansion backwards from a failure list is a different mental operation from writing the matrix in the first place, and it is the one the exam tests. Candidates who have only ever authored their own workflows have rarely done it.

How is the GH-200 exam delivered and scored?

GH-200 is a proctored exam of 72 questions with a 100 minute limit, scored on Microsoft’s 1000 point scale with 700 required to pass, and priced at $99 USD. It is scheduled through Pearson VUE and may include interactive components alongside standard question types.

Seventy two questions in 100 minutes is about 83 seconds each, which is tighter than it looks once interactive items are in the mix. Those take longer than a multiple choice item and cannot be answered on recognition, so banking time on the straightforward questions matters more here than on a slower paper.

One administrative detail is worth more than it sounds. Microsoft advises registering with a personal account rather than a work or school one, because exam records tied to an organisational identity are lost and cannot be recovered if you leave that organisation. People discover this years later, at the worst possible moment.

Microsoft also publishes an interactive sandbox that reproduces the exam interface and question types, reachable from the official credential page. Spending twenty minutes in it removes the whole category of surprise about how interactive items behave under time pressure.

Which authoring details does the syllabus name explicitly?

The authoring domain is unusually specific about mechanisms rather than concepts. It names workflow_dispatch input types and defaults, workflow_call input and secret mapping, service containers with ports and health checks, strategy matrices with include, exclude, fail-fast and max-parallel, YAML anchors and merge keys, and the full list of predefined contexts.

That specificity is a gift for planning, because it tells you exactly where recognition will not be enough.

• Expressions are split into static evaluation at workflow parse time and runtime evaluation, and the objective explicitly pairs that distinction with preventing secret leakage into logs.
• Data passing is enumerated rather than generalised: artifacts, step outputs, environment files through GITHUB_ENV and GITHUB_OUTPUT, and reusable workflow outputs.
• GITHUB_STEP_SUMMARY appears as its own objective for generating Markdown job summaries with test results and coverage.
• Retention policies for logs, artifacts and workflow runs are to be applied through the REST API at organisation and repository level, not through the interface.

There is also a boundary question the syllabus asks in two separate places: the difference between a starter workflow, a reusable workflow and a composite action. A starter workflow is a scaffold that is copied and then lives independently. A reusable workflow is a central versioned definition invoked through workflow_call. A composite action encapsulates step logic. Confusing the three is the most predictable way to lose marks in two domains at once.

Candidates who have prepared a Microsoft DevOps credential before will recognise the pattern of naming mechanisms rather than outcomes. The Azure DevOps Engineer exam is built the same way, and the study habits transfer even though the tooling does not.

What did the syllabus add on security?

The security domain is the lightest by weight at 10 to 15 percent, but it carries the most recently added material on the whole syllabus. Immutable actions, OIDC federation to cloud providers, commit SHA pinning of third-party actions, and artifact attestation with build provenance all appear as named objectives.

Tokens, and getting rid of them

Two objectives deal with credentials and they point in the same direction. The first asks you to understand the GITHUB_TOKEN lifecycle, that it is ephemeral and scoped, how to configure granular permissions on it, and how it contrasts with a personal access token. The second asks you to use OIDC cloud federation with the id-token permission specifically to eliminate long-lived cloud secrets.

Read together, they describe a direction of travel rather than two techniques: short-lived, narrowly scoped, exchanged at run time. Answers that reach for a stored secret are usually the distractor.

Trusting what you did not write

Supply chain material runs through several objectives. Pinning third-party actions to full commit SHAs rather than a floating tag, aligning with immutable actions enforcement on hosted runners, enforcing allow and deny lists at organisation level, requiring reviewers for unverified actions, and generating and verifying artifact attestations that a deployment step then checks.

The attestation objective names provenance formats directly, and the ecosystem work behind them sits with the open source security foundation rather than with GitHub alone. Understanding what an attestation asserts, and what verifying one actually proves, is more useful here than memorising a command.

Script injection rounds the domain out and is the most practical item on it: sanitising inputs, least-privilege permissions, keeping untrusted data out of run steps, correct shell quoting, and preferring vetted actions over inline scripts.

How long does a GitHub certification last?

GitHub certifications are valid for two years, not three. That distinction matters because the three year figure is widely repeated and is one of the more common searches around these exams, and planning a renewal a year late is an expensive mistake to make on a credential you have already paid for.

There is a transitional arrangement in place at the moment. GitHub is moving its certifications onto Microsoft’s recertification process, which will let holders maintain a credential without resitting the full exam. Until that process is available, any GitHub certification that would expire before it launches is extended by six months automatically.

Anyone whose certification has already lapsed is not stuck either. GitHub’s stated position is that expired holders can contact its learning team and be issued a voucher to resit at no cost, which is a more generous arrangement than most vendors offer.

For readers weighing GH-200 against another Microsoft credential on validity and renewal grounds, the comparison of two Azure certification paths works through the same decision for the Azure line, where renewal runs on Microsoft’s annual online assessment instead.

How should a workflow author prepare for the admin half?

Assume your authoring is already close and spend the preparation time on the two thirds of the exam that is not authoring. The sequence below works outward from what a developer already does toward what an organisation administrator does, which is the direction most candidates need to travel.

1. Audit your own experience against the five domains honestly, marking each objective as done in anger, read about, or never seen.
2. Read three workflows you did not write and predict their trigger behaviour from the configuration alone before checking the run history.
3. Force a matrix failure deliberately, then correlate the failed job names back to their matrix axes and rerun only the failing variants.
4. Build one of each action type, a JavaScript action, a Docker action and a composite action, so the metadata and directory differences stop being abstract.
5. Scope a secret at organisation level, then at repository level, then at environment level, and observe which workflow can read which.
6. Register a self-hosted runner, put it in a runner group, and restrict that group, because runner administration is the objective group developers have least exposure to.
7. Replace a stored cloud credential with OIDC federation using the id-token permission, then pin every third-party action in that workflow to a full commit SHA.
8. Spend twenty minutes in the published exam sandbox so interactive question types cost you no thinking time on the day.
9. Finish with timed sets of 72 questions in 100 minutes, tracking your score per domain rather than overall.

The audit in step one is the step people skip and the one that saves the most time. GH-200 is a cheap exam with a wide scope, and the cost of failing it is mostly the fortnight, not the fee.

Frequently Asked Questions

How many questions are on the GH-200 exam?

GH-200 has 72 questions with a 100 minute limit, roughly 83 seconds each. Some items are interactive rather than multiple choice, and those take longer, so pace matters more than the raw average suggests.

What score do you need to pass GH-200?

700 out of 1000 on Microsoft’s scaled scoring. That is not a straight 70 percent of questions, because the scale weights items rather than counting them, but it is the figure the score report is measured against.

How much does the GitHub Actions certification cost?

$99 USD, which makes it one of the cheapest credentials Microsoft offers. The exact charge varies with the country or region the exam is proctored in, and training is a separate optional cost.

Are GitHub certifications valid for three years?

No, they are valid for two years. The three year figure circulates widely and is wrong. GitHub is currently extending certifications that expire before its new recertification process launches by an extra six months.

Which GH-200 domain is the heaviest?

Two domains tie at 20 to 25 percent: authoring and managing workflows, and managing GitHub Actions for the enterprise. The enterprise domain is the one candidates consistently underestimate because it sits outside a typical developer’s daily work.

Do you need self-hosted runner experience for GH-200?

The syllabus names runner administration directly, including runner groups, IP allow lists, hosted image toolcache contents, and troubleshooting. You can pass without production experience, but not without having configured and restricted a runner at least once.

What is the difference between a reusable workflow and a starter workflow?

A starter workflow is a scaffold you copy into a repository, after which it lives independently. A reusable workflow is a central versioned definition invoked through workflow_call. The syllabus asks you to distinguish both from composite actions as well.

Is GH-200 harder than AZ-400?

They are different rather than ranked. AZ-400 spans a wider toolchain across the Azure DevOps platform, while GH-200 goes deeper into one product and names specific mechanisms rather than outcomes. GH-200 is classified intermediate; AZ-400 is expert level.

What languages is the GH-200 exam offered in?

English, Spanish, Portuguese for Brazil, Korean and Japanese. That is a narrower set than most Microsoft role-based exams, which is worth checking before booking if English is not your first language.

Can you retake GH-200 immediately after failing?

Not immediately, but soon. A first retake is allowed 24 hours after the failed attempt. Waiting periods lengthen for subsequent retakes, so the second attempt is the one to prepare properly for.

Conclusion

GH-200 is priced like a fundamentals exam and scoped like a role-based one. The gap between those two facts is where candidates come unstuck: the fee suggests a quick win, while the syllabus quietly asks about runner groups, organisation policies, secret scoping and provenance verification alongside the workflow syntax everyone expects.

Treat the enterprise domain as the centre of your preparation rather than an afterthought, and the rest of the paper follows. Authoring skill you already have; reading someone else’s matrix expansion and restricting a runner group are the things worth practising deliberately before you book.

When your workflow authoring feels solid and the administration half still does not, timed practice across all five domains is the fastest way to see how far apart the two halves really are.