Start your Free GitHub GH-100 Practice Test (2026- 200 Updated Questions)

Microsoft GH-100 Practice Test

Preparing for Microsoft GH-100 requires more than memorizing GitHub settings. Students must understand how identity, permissions, security controls, GitHub Actions, enterprise deployment, licensing, monitoring, and support decisions work together. A current GH-100 practice test helps you turn those topics into realistic administration scenarios and identify what to review before exam day. You can also explore our IT certification practice tests when building a broader certification study plan.

Quick Answer: What Is the Microsoft GH-100 Exam?

GH-100 is the exam for the GitHub Administration certification. It is designed for administrators, DevOps engineers, technology managers, application administrators, developers, and IT professionals who manage GitHub Enterprise environments.

The exam tests whether you can manage users and access, administer GitHub Enterprise, apply security and compliance controls, manage GitHub Actions, and monitor usage. It includes both GitHub Enterprise Cloud and GitHub Enterprise Server concepts.

According to the current GitHub Administration certification page on Microsoft Learn, GH-100 is an intermediate-level, proctored exam with 100 minutes of testing time. It is currently offered in English and scheduled through Pearson VUE. Pricing depends on the country or region where the exam is proctored.

The official GH-100 study guide says candidates need a score of 700 or higher to pass. The guide also states that the exam changed significantly in July 2026. Current preparation should therefore follow the new five-domain blueprint, not older study pages that show six domains and outdated percentages.

What Does a GH-100 Practice Test Measure?

A useful Microsoft GH-100 practice test should measure administration judgment, not only product vocabulary. Many questions should place you in the role of an enterprise administrator and ask you to choose the most secure, scalable, or supportable option.

For example, you may need to decide:

• Whether access should be controlled through a personal account model or Enterprise Managed Users
• Whether a user problem can be solved by an administrator or requires GitHub Support
• Which role gives a person the minimum access needed
• How to enforce security settings across multiple organizations
• Which security feature detects a leaked credential or a vulnerable dependency
• Whether an integration should use a personal access token, GitHub App, or OAuth App
• Which repositories can use a runner group
• How to find the source of an administrative change in the audit log
• How to reduce unused licenses or metered-product costs

A practice test also helps students become comfortable with wording such as organization, enterprise, repository, managed user, identity provider, ruleset, runner group, and metered usage. These words point to different scopes and responsibilities.

Who Should Prepare for GH-100?

GH-100 is suitable for learners who want to validate intermediate GitHub Enterprise administration skills. The official audience includes people who work across development, security, and operations teams.

The exam is especially useful for:

• GitHub organization and enterprise administrators
• System and application administrators
• DevOps and platform engineers
• IT professionals supporting developer tools
• Security professionals applying repository controls
• Developers who are moving into administration or governance roles
• Students preparing for enterprise DevOps work
• Technology managers responsible for GitHub adoption and cost

The exam is not limited to someone with the job title “GitHub administrator.” However, you should understand the decisions an enterprise owner or organization owner makes, including identity, access, governance, security, runners, audit data, licensing, and escalation.

If you are comparing GH-100 with other credentials, View all Microsoft practice tests and select the exam that best matches your current experience and career goal.

Are There Prerequisites for GH-100?

GitHub states that its certification exams have no formal prerequisites. However, it recommends working knowledge of GitHub and the related Microsoft Learn modules.

Before starting full-length GH-100 practice tests, you should be able to:

• Navigate repositories, organizations, and enterprise settings
• Explain members, outside collaborators, teams, and owners
• Understand repositories, branches, pull requests, reviews, and releases
• Explain authentication compared with authorization
• Recognize single sign-on, two-factor authentication, and identity providers
• Understand basic GitHub Actions workflows and runners
• Recognize audit logs, security alerts, and repository policies
• Read a simple permissions or governance scenario

You do not need to memorize every menu location. You do need to know which level controls a setting and which administrator is responsible for it.

Current GH-100 Exam Domains and Weights

The official July 2026 blueprint contains five domains:

Domain 1: Manage GitHub Identities and Access (15–20%)

This domain asks who a user is, how the user signs in, and what the user is allowed to do. Students should clearly separate authentication from authorization:

• Authentication confirms identity.
• Authorization determines access and permitted actions.

Managed users and personal accounts

GitHub Enterprise Cloud can use personal accounts or Enterprise Managed Users. With personal accounts, people use their existing GitHub.com accounts and may link them to enterprise identity through SAML single sign-on. With Enterprise Managed Users, accounts are provisioned and controlled through the enterprise’s identity provider.

GitHub’s enterprise IAM overview explains that an enterprise can invite existing personal accounts and optionally enable SAML SSO, or use Enterprise Managed Users to create and control member accounts.

Practice questions may ask which model provides stronger centralized control, how a user is deprovisioned, or where account lifecycle changes are made. In an Enterprise Managed Users environment, identity lifecycle actions are generally controlled through the identity provider rather than performed as ordinary account changes on GitHub.

SAML SSO and two-factor authentication

SAML single sign-on lets an identity provider control access to enterprise resources. Two-factor authentication adds another verification factor to sign-in.

Study these ideas:

• Enabling and enforcing SAML SSO
• Enterprise-level compared with organization-level configuration
• Choosing an identity provider
• Understanding linked identities and authorized credentials
• Planning recovery when the identity provider is unavailable
• Applying two-factor authentication requirements

Do not assume SAML and SCIM do the same job. SAML mainly supports authentication, while SCIM supports provisioning and lifecycle management.

SCIM and team synchronization

SCIM can create, update, suspend, and deprovision accounts based on identity-provider data. Team synchronization connects identity-provider groups with GitHub teams.

GitHub’s team synchronization guidance makes an important distinction: team synchronization is not normally a user-provisioning service. A person generally needs to be an organization member before team sync adds that person to a team. For Enterprise Managed Users, group and team membership is managed through the SCIM configuration.

Roles, teams, and least privilege

Learn how enterprise, organization, repository, and team roles differ. A good administration answer usually gives a user enough access to complete the job without unnecessary privileges.

Practice these decisions:

• Owner or member at organization level
• Repository read, triage, write, maintain, or admin access
• Direct repository access compared with access through a team
• Base permissions for an organization
• Enterprise teams and organization teams
• Custom roles where supported
• Reviewing and auditing access

Use teams when access should follow job function. Direct permission can be suitable for an exception, but it becomes harder to manage at scale.

Policies, settings, and rulesets

Know where control is applied. An enterprise policy can govern organizations, an organization setting can govern its repositories, and a repository rule can control activity within one repository. Rulesets help administrators apply consistent requirements to branches, tags, and other repository activity.

In scenario questions, look for scope words such as all organizations, selected repositories, one team, or one protected branch.

Domain 2: Administer GitHub Enterprise Environment (10–15%)

This domain covers day-to-day support, developer standards, deployment choices, licensing, and billing.

Administrator issue or GitHub Support issue?

An administrator should solve issues that fall within accessible settings, policies, permissions, identity configuration, runner management, and documented troubleshooting. GitHub Support may be needed for service-side problems, platform defects, inaccessible system behavior, or cases requiring internal investigation.

A strong troubleshooting process is:

1. Confirm who is affected and when the issue began.
2. Determine whether the problem affects one repository, one organization, or the enterprise.
3. Check configuration, access, audit events, and service status.
4. Reproduce the problem if safe.
5. Collect diagnostics without exposing secrets.
6. Escalate with clear evidence if the problem requires GitHub Support.

Support bundles and diagnostics

Support bundles collect technical information that can help diagnose GitHub Enterprise Server problems. Practice questions may ask what evidence should accompany a support request or which diagnostic method is suitable for a deployment issue.

Avoid sharing secrets, tokens, unnecessary personal data, or sensitive repository content. Collect the specific evidence needed and follow organizational security procedures.

Developer process standards

Enterprise administrators often help teams use GitHub consistently. The blueprint includes standards for:

• Branching and collaboration models
• Pull request reviews
• Required approvals
• Protected branches and rulesets
• Release processes
• Reusable workflows
• Automation and deployment

The goal is not to force every team into an identical process. It is to provide secure, maintainable standards and approved exceptions.

GitHub Enterprise deployment choices

The current exam guide lists these deployment scenarios:

• GitHub Enterprise Cloud with Enterprise Managed Users
• GitHub Enterprise Cloud with data residency and Enterprise Managed Users
• GitHub Enterprise Cloud with personal accounts
• GitHub Enterprise Server

At a student-friendly level, think about control, hosting responsibility, data location, identity model, connectivity, maintenance, upgrades, and feature availability.

GitHub Enterprise Cloud is operated by GitHub. GitHub Enterprise Server is deployed in infrastructure the customer controls, which creates additional responsibilities for updates, backups, availability, monitoring, and recovery.

Licensing, billing, and consumption

Study how user licenses and metered products are different. User access may affect license counts, while services such as Actions or other metered products may create usage-based charges.

An administrator should be able to:

• Review license consumption
• Identify inactive or unnecessary access
• Understand which products generate metered usage
• Interpret usage reports
• Recommend changes without harming required access or service quality

Do not rely on a memorized price. Prices, allowances, and billing rules can change. Learn how to locate and interpret the current report.

Domain 3: Implement Secure Software Development and Compliance (25–30%)

This is the largest GH-100 domain. It connects governance, repository security, auditability, applications, and incident response.

Enterprise policies and rulesets

Policies reduce risk and create consistent expectations. GitHub’s enterprise policy documentation covers repository management, authentication, security settings, GitHub Actions, personal access tokens, code governance, and rulesets.

Common controls include:

• Requiring pull request reviews
• Restricting force pushes and deletions
• Requiring status checks before a merge
• Controlling repository creation and visibility
• Restricting personal access tokens
• Limiting unapproved applications and actions
• Applying code security configurations
• Protecting sensitive branches and tags

Choose the lowest scope that meets the requirement while maintaining consistent governance. An enterprise-wide restriction may be appropriate for a mandatory security rule but excessive for a single project need.

Audit logging and reporting

Audit logs answer questions such as who changed a setting, which token performed an action, when membership changed, or how an application was authorized.

GitHub’s enterprise audit-log documentation explains that administrators can search, export, stream, and access audit data through an API. Practice filtering by actor, action, organization, repository, date, and token identity.

Remember that audit data supports investigations and compliance, but it must be protected. Export or stream it to approved systems with suitable access and retention controls.

Secret scanning

Secret scanning looks for credentials and other sensitive values committed to repositories. Push protection can block supported secrets before they are pushed.

When a secret is exposed, deleting the visible line is not enough. A sound response usually includes:

1. Revoke or rotate the credential.
2. Assess whether it was used.
3. Remove sensitive data from current content and, where required, history.
4. Review access and audit information.
5. Add prevention such as push protection or a custom pattern.

GitHub’s security feature overview explains which capabilities are generally available and which belong to GitHub Secret Protection or GitHub Code Security. Availability can depend on repository visibility and the organization’s plan.

Code scanning and CodeQL

Code scanning finds potential vulnerabilities and coding errors. CodeQL is GitHub’s semantic code analysis engine and can run through default setup, advanced setup, or external analysis followed by result upload.

For GH-100, focus on administration decisions:

• Enabling code scanning at the correct scope
• Applying a security configuration to repositories
• Selecting a suitable setup method
• Reviewing coverage and alert status
• Governing which repositories require scanning
• Planning response and remediation ownership

You are not expected to become a CodeQL query-language expert solely for administration, but you should understand the purpose and configuration choices.

Dependabot and security advisories

Dependabot features address dependency risk and maintenance:

• The dependency graph records project dependencies.
• Dependabot alerts identify known vulnerable dependencies.
• Security updates can create pull requests to update vulnerable packages.
• Version updates help keep dependencies current.
• Repository security advisories support private discussion and coordinated fixes for vulnerabilities.

Practice distinguishing notification, remediation, and routine maintenance. An alert tells you about risk; an update pull request helps fix it; an advisory supports coordinated disclosure.

Security response planning

A security response plan should define:

• Alert ownership and triage
• Severity and priority rules
• Credential revocation steps
• Developer and security-team responsibilities
• Escalation and communication paths
• Evidence preservation
• Remediation validation
• Post-incident review

The best exam answer is often the one that reduces exposure first, preserves useful evidence, and follows an approved process.

Personal access tokens

Personal access tokens, or PATs, allow authenticated API or Git operations. Fine-grained PATs support more limited repository access and permissions than broad classic tokens in many situations.

Study how enterprises can govern PAT use, approval, lifetime, and access. Apply least privilege and avoid tokens tied to a person’s account for long-lived organization automation when a GitHub App is the better design.

GitHub Apps and OAuth Apps

These application types are not interchangeable:

GitHub Apps usually provide a stronger enterprise automation model because permissions can be granular and installations can be limited. Practice choosing, approving, denying, and reviewing applications according to enterprise policy.

API rate limits

Rate limits protect GitHub services. The exact limit can depend on authentication and integration type. The exam may ask how to avoid unnecessary requests, interpret rate-limit responses, authenticate appropriately, or use a GitHub App for scalable integration.

Focus on design rather than memorizing one number. Cache suitable responses, avoid polling too frequently, use webhooks where appropriate, and respect retry information.

Domain 4: Manage GitHub Actions (20–25%)

This domain tests GitHub Actions from the administrator’s viewpoint. You should understand how to govern automation, share approved components, manage runners, protect networks, and control secrets.

Actions and reusable workflows

An action packages reusable step-level automation. A reusable workflow is called by another workflow and can contain complete jobs. Enterprise administrators can make approved automation available from controlled repositories and restrict what outside actions are allowed.

Practice scenarios such as:

• Make one approved deployment workflow available to many repositories.
• Permit actions created by GitHub and verified creators only.
• Allow a specific internal action while blocking other external actions.
• Require reusable workflows from a controlled repository.
• Determine why a repository cannot access a private reusable workflow.

GitHub Actions policies

Policies can control whether Actions is enabled, which actions and reusable workflows may run, and how workflow permissions behave. Think about policy inheritance: enterprise choices can limit organization choices, while organizations can further limit repository behavior where allowed.

A secure policy should support required development work while reducing unreviewed code execution. Avoid allowing every third-party action merely because it is convenient.

GitHub-hosted and self-hosted runners

GitHub-hosted runners are managed by GitHub and normally start with a clean environment. Self-hosted runners are installed and maintained by the organization.

Self-hosted runners require patching, isolation, monitoring, capacity planning, credential protection, and cleanup. They can be dangerous when untrusted code is allowed to run. GitHub recommends particular caution with public repositories because a malicious pull request may attempt to execute code on the runner.

Runner groups

Runner groups organize runners and create an access boundary. GitHub’s runner group documentation explains that groups can restrict which organizations, repositories, and workflows can use particular runners. They can also support concurrency controls.

For exam scenarios, match valuable or sensitive runners with restricted groups. A production runner should not automatically be available to every repository.

IP allow lists and networking

IP allow lists restrict access based on approved addresses. Private networking can connect Actions workloads to private resources without exposing those resources publicly. The current blueprint specifically includes Azure private networking.

Learn to reason about:

• Required network paths
• Name resolution and firewall rules
• Inbound compared with outbound access
• GitHub service connectivity
• Private endpoints and approved address ranges
• Runner reachability
• Troubleshooting from logs and network evidence

Secrets and third-party vaults

Secrets can exist at repository or organization level. Access should be limited to the repositories and workflows that need the value.

Third-party vault integration can provide centrally managed, short-lived, or dynamically retrieved credentials. This may be better than copying the same long-lived secret into many repositories.

Never print secrets into logs, store them in artifacts or caches, or expose them to untrusted workflows. Use protected environments and short-lived credentials where the scenario supports them.

Runner performance troubleshooting

When a runner is slow or unavailable, check:

1. Whether the job labels match an online runner.
2. Whether the repository can access the runner group.
3. Runner status, service logs, and version.
4. CPU, memory, disk, and network capacity.
5. Concurrency limits and queued jobs.
6. Firewall, proxy, DNS, and GitHub connectivity.
7. Whether the workflow itself creates unnecessary work.

Do not add more runners until you know whether the real problem is capacity, access, connectivity, or workflow design.

Domain 5: Monitor and Optimize GitHub Usage (10–15%)

This domain uses evidence to improve adoption, cost, security, and reliability.

Audit logs and API activity

Audit information can show administrative changes, access events, app activity, membership changes, and token-related operations. The API allows approved tools to retrieve data for reporting or security monitoring.

Students should understand:

• Searching by actor, action, repository, or organization
• Identifying actions performed through a token
• Exporting data for analysis
• Streaming audit events to an approved monitoring system
• Managing API authentication and rate limits
• Protecting audit information

Adoption and underused features

Administration is not only enforcement. A healthy GitHub program also measures whether teams are using features effectively.

Useful questions include:

• Which organizations and repositories are active?
• Which licensed security features are enabled?
• Where are alerts not being reviewed?
• Which teams are not using approved workflows?
• Are self-hosted runners overloaded or idle?
• Which integrations are still needed?
• Are licenses assigned to inactive users?

The goal is to improve outcomes, not to collect data without a purpose.

Cost and performance optimization

Optimization should keep required service levels and security controls. Possible recommendations include:

• Remove unnecessary user access through an approved offboarding process.
• Review unused licenses and inactive accounts.
• Right-size runner capacity.
• Reduce duplicate or unnecessary workflow runs.
• Use caching carefully to reduce repeated work.
• Apply retention settings suitable for artifacts and logs.
• Monitor metered-product reports.
• Retire unused integrations after confirming ownership and impact.

Avoid a shortcut that saves money but weakens security, availability, or compliance.

High-Value GH-100 Comparisons

What you get when you prepare with us

Our GH-100 preparation approach is designed to make a wide enterprise syllabus easier to understand and review. Students receive a structured learning experience focused on the current official objectives rather than random product facts.

Current blueprint coverage

Practice content is organized around the five domains measured from July 2026. This helps you avoid spending valuable time on an outdated six-domain outline.

Student-friendly practice questions

Questions use clear wording while still testing realistic administration decisions. You practice identity, access, deployment, security, applications, runners, monitoring, licensing, and support scenarios.

Explanations that teach the decision

An answer is more useful when you understand why it is correct. Review explanations should connect the requirement to the right GitHub feature, scope, or administrator responsibility.

Topic-based review

Domain grouping helps you focus on the exact area that needs attention. Instead of repeating an entire mock test, you can review a weak topic such as SCIM, rulesets, GitHub Apps, runner groups, or audit logs.

Exam-style timing practice

Timed sessions help you build a steady pace for the 100-minute exam. The purpose is not to rush; it is to avoid spending too long on one uncertain question.

A practical study path

Practice questions work best with official documentation and hands-on administration tasks. Our approach encourages you to test a concept, review the explanation, verify it with an official source, and apply it in a safe environment.

Progress through review, not memorization

Repeated questions should not become a memory exercise. The real improvement comes from recording why you missed a question and correcting the underlying knowledge, reading, or experience gap.

Visit our Practice Test Platform to begin with a diagnostic set, review each explanation, and build focused practice into your weekly schedule.

How to Use a GH-100 Practice Test Effectively

1. Start with a diagnostic set

Take 20 to 30 mixed questions without searching for answers. This first result is a baseline, not a final judgment.

2. Record why each mistake happened

Use these categories:

• Knowledge gap: You did not know the feature.
• Scope error: You confused enterprise, organization, repository, or environment scope.
• Reading error: You missed a word such as least privilege, all repositories, or centrally managed.
• Experience gap: You understood the explanation only after trying the setting.
• Outdated information: Your study source used the older GH-100 outline or behavior.

3. Verify answers with official sources

Use the current Microsoft study guide and GitHub documentation. Search results may show older localized pages before newer English documentation, so always check the update date and domain list.

4. Practice the task

Use a safe organization or training environment where possible. Review roles, create a team, inspect a ruleset, filter an audit log, configure a security feature, or examine runner-group access.

5. Retest by domain

Focus first on the lowest-scoring domain. Do not simply remember the answer letter. Explain why every option does or does not meet the requirement.

6. Finish with timed mixed sets

Once domain scores improve, take mixed sessions under a 100-minute plan. Leave time to review questions you marked as uncertain.

Four-Week GH-100 Study Plan

Week 1: Identity and access

• Review personal accounts and Enterprise Managed Users.
• Compare authentication with authorization.
• Study SAML, 2FA, SCIM, and team synchronization.
• Review enterprise, organization, repository, and team roles.
• Practice least-privilege scenarios.
• Take a Domain 1 quiz and review every error.

Week 2: Enterprise administration and security

• Compare GitHub Enterprise Cloud deployment models with GitHub Enterprise Server.
• Review support responsibilities and diagnostic evidence.
• Study licensing, metered products, and usage reports.
• Practice policies, rulesets, audit logs, and security response.
• Review secret scanning, CodeQL, Dependabot, and security advisories.
• Spend extra time here because security is the largest domain.

Week 3: Applications and GitHub Actions

• Compare PATs, GitHub Apps, and OAuth Apps.
• Learn application approval and rate-limit concepts.
• Review action and reusable-workflow policies.
• Compare GitHub-hosted and self-hosted runners.
• Practice runner groups, IP allow lists, and private networking concepts.
• Review secret scope and third-party vault integration.

Week 4: Monitoring and final practice

• Search and interpret audit events.
• Review adoption, license use, and metered usage.
• Practice cost and runner-performance scenarios.
• Complete two or three timed mixed tests on separate days.
• Revisit every guessed and incorrect answer.
• Check the official GH-100 study guide for updates.
• Use the official exam sandbox before exam day.

Hands-On Tasks for GH-100 Students

Complete as many of these tasks as your training environment allows:

1. Create an organization and review member privileges.
2. Create teams and assign repository access through a team.
3. Compare repository roles and document a least-privilege choice.
4. Create a ruleset for a test branch.
5. Review SAML, SCIM, and team-sync configuration documentation.
6. Enable a suitable security feature on a test repository.
7. Review a Dependabot alert or example alert workflow.
8. Inspect code-scanning setup choices.
9. Filter an organization or enterprise audit log.
10. Review a GitHub App’s requested permissions.
11. Create an Actions policy plan for approved actions.
12. Compare a reusable workflow with an action.
13. Design runner groups for development and production.
14. Troubleshoot a deliberately mismatched runner label.
15. Review organization and repository secret scopes.
16. Read a license or metered-usage report and propose a safe optimization.

Keep a short record of each task: the requirement, the setting scope, the decision, and the security impact.

How to Know You Are Ready for GH-100

You are approaching exam readiness when you can:

• Explain all five current domains without reading the list
• Identify enterprise, organization, repository, and team scope
• Compare managed users with personal accounts
• Explain SAML, SCIM, and team synchronization clearly
• Choose least-privilege roles in scenarios
• Compare GitHub Enterprise Cloud with Server responsibilities
• Select the right security feature for a stated risk
• Compare a PAT, GitHub App, and OAuth App
• Design controlled runner-group access
• Explain when an administrator should contact GitHub Support
• Find relevant evidence in audit and usage reports
• Complete timed practice without rushing
• Explain why incorrect options fail the requirement

Do not depend on one high mock-test score. Consistent performance, clear explanations, and hands-on confidence are stronger signals.

GH-100 Exam-Day Tips

Read the scope carefully

Look for words such as enterprise, organization, repository, selected repositories, all users, or one team. Many wrong answers solve the right problem at the wrong scope.

Identify the main goal

Is the question asking for security, least privilege, centralized management, troubleshooting, cost control, or minimum administration? Select the answer that satisfies the full requirement.

Do not assume every problem needs the highest role

Owner and administrator roles are not the default answer. Choose the narrowest role or policy that completes the task.

Protect the 100-minute timer

Answer clear questions first and mark uncertain items for review if the exam interface allows it. Do not spend too long trying to recall one small detail.

Prepare without in-exam documentation

Microsoft’s exam duration and experience guidance states that access to Microsoft Learn is not available during GitHub exams. Prepare to answer from your knowledge and reasoning.

Use the exam sandbox

The certification page includes a sandbox that demonstrates the test interface. Using it before exam day reduces navigation stress.

Common GH-100 Preparation Mistakes

Using the old six-domain blueprint

The exam changed significantly in July 2026. Older percentages and domain names may lead to an unbalanced study plan.

Studying repository settings but ignoring enterprise scope

GH-100 is an enterprise administration exam. Identity systems, organization governance, security policies, billing, runners, and audit evidence all matter.

Memorizing menus

The interface changes. Learn the purpose, scope, permissions, and effect of each feature.

Ignoring security because you are an administrator

Security and compliance is the largest current domain. Administrators are expected to configure, govern, monitor, and respond—not write security policy and forget it.

Treating SAML, SCIM, and team sync as identical

They solve connected but different identity problems. Practice explaining each one in a sentence.

Assuming self-hosted runners are automatically better

Self-hosted runners provide control but create security, patching, scaling, isolation, and reliability responsibilities.

Repeating the same mock test

If you remember the answer position, the score stops measuring readiness. Rotate questions, practice by domain, and explain each choice.

Using unauthorized exam content

Leaked or copied exam questions may be outdated, inaccurate, and against exam rules. Use original practice questions, official documentation, and legitimate training environments.

Microsoft GH-100 Frequently Asked Questions

What is Microsoft GH-100?

GH-100 is the exam code for the GitHub Administration certification. It measures intermediate GitHub Enterprise administration skills.

Is the certification called GitHub Administration or GitHub Enterprise Administrator?

The Microsoft certification page uses “GitHub Administration,” while the official GH-100 study guide uses “GitHub Enterprise Administrator.” Both refer to the GH-100 exam covered here.

Who maintains the GH-100 exam?

The certification page states that Microsoft provides the exam while GitHub maintains the exam and associated certification.

How long is the GH-100 exam?

Candidates currently have 100 minutes to complete the assessment.

What score is needed to pass GH-100?

The official study guide states that a score of 700 or higher is required. This is a scaled score, not a guarantee that answering exactly 70% correctly will pass.

How many questions are on GH-100?

Microsoft does not guarantee a fixed GH-100 question count. Exam content can change, so use the official duration rather than relying on an unofficial number.

Is GH-100 available in languages other than English?

The current English certification page lists English as the available exam language. Check the scheduling page in case availability changes.

Can I take GH-100 online?

Yes. GitHub’s registration documentation says its certification exams can be taken online with proctoring or at a local Pearson VUE test center, subject to availability and testing requirements.

How much does GH-100 cost?

The official page says the price depends on the country or region where the exam is proctored. Check the scheduling page for the current local price and taxes.

Does GH-100 have prerequisite exams?

No formal prerequisite exam is required. GitHub recommends working knowledge of GitHub and the related learning modules.

Is GH-100 suitable for beginners?

It is an intermediate exam. A new student can prepare for it, but should first learn GitHub repositories, organizations, roles, pull requests, basic Actions, and security concepts.

What changed in the July 2026 GH-100 update?

Microsoft states that the exam changed significantly: objectives were added, removed, moved, and reworded. The current version has five domains, with security and compliance carrying the largest weight.

Which domain is most important?

Implement secure software development and compliance has the largest range at 25–30%. GitHub Actions follows at 20–25%. Every domain can still affect the result.

Do I need GitHub Enterprise Server experience?

The audience profile includes both GitHub Enterprise Cloud and GitHub Enterprise Server deployments. You should understand their major administration and responsibility differences even if most of your experience is in one platform.

Do I need to know GitHub Actions for GH-100?

Yes. Managing GitHub Actions is 20–25% of the current blueprint and includes policies, reusable components, runners, networking, performance, and secrets.

Do I need to write CodeQL queries?

The administration exam focuses more on enabling, governing, and managing code scanning and CodeQL than on becoming an advanced query writer. Follow the exact current study objectives when deciding depth.

What is the difference between GH-100 and GH-200?

GH-100 focuses on GitHub Enterprise administration, identity, governance, security, Actions administration, and usage. GH-200 focuses specifically on creating, using, troubleshooting, securing, and optimizing GitHub Actions automation.

Is the GH-100 exam open book?

No. Microsoft says Microsoft Learn access is not available during GitHub certification exams.

How many practice tests should I take?

There is no official number. One diagnostic, several domain-focused sets, and two or three timed mixed tests are a practical approach when every answer is reviewed.

What practice score means I am ready?

No third-party score guarantees an exam result. Look for consistent performance, balanced domain knowledge, good timing, and the ability to explain the reasoning.

Can practice tests replace hands-on work?

No. Practice tests reveal knowledge gaps; hands-on tasks build the administrative judgment needed to solve scenarios.

What should I do if I fail GH-100?

Use the score report to find weaker domains and rebuild those topics before another full test. Under the current Microsoft retake policy, candidates who fail the first attempt must wait 24 hours before retaking. A 14-day wait applies between later attempts, with other annual limits listed in the policy. Verify the policy before rebooking.

Should I register with a personal or work Microsoft account?

The official certification page strongly recommends a personal Microsoft account. It warns that exam records linked to an organizational work or school account can be lost if you leave that organization.