GH-200 - Secure and optimize automation (15% of the exam) - Section 5.1

Use environment protections and approval gates and select trustworthy actions from the GitHub Marketplace.

Configure environment protection rules and required reviewers as approval gates before a job may deploy to a protected environment. Select actions from the GitHub Marketplace by favouring verified creators to reduce supply-chain risk.

environment protection rulesrequired reviewersapproval gatesverified creators

Practice question for this objective

Free sampleSecure and optimize automationmedium

A deployment job targets an environment named production, and the team needs GitHub itself to gate the deployment so a run pauses for human approval and is also held for a fixed delay before it can begin, with both controls enforced outside the workflow steps. Which two controls are configured as protection rules on the production environment to meet this intent? Select TWO.

AAdd a required reviewers rule to the environment so a named person or team must approve each deployment before the job proceeds. Correct
BAdd a wait timer rule to the environment so every run is held for a fixed delay before the deployment job is allowed to start. Correct
CAdd a concurrency block at the job level in the workflow file so only one deployment runs against the environment at a time.
DAdd a branch protection ruleset to the main branch so pushes are reviewed before the deployment job reads the environment secret.

Recognise that required reviewers and wait timers are the GitHub-enforced environment protection rules that gate deployments by approval and delay. Environment protection rules are configured on the environment in repository settings, and required reviewers and wait timers are two such rules: the reviewer rule blocks the job until a named approver acts, and the wait timer holds the job for a set number of minutes. Both are enforced by GitHub before the job runs and before any environment secret is exposed, unlike workflow-level concurrency or branch protection, which solve different problems.

Why A is correct: Required reviewers is a genuine environment protection rule that pauses the run until an approver acts, enforced by GitHub rather than a step.

Why B is correct: A wait timer is an environment protection rule that holds the deployment for a configured delay, providing the fixed cooling-off period before it begins.

Why C is wrong: Concurrency limits overlapping runs but lives in the workflow YAML, so it is not an environment protection rule and provides neither approval nor a fixed delay.

Why D is wrong: Branch protection reviews code changes on a branch, not deployments to an environment, so it cannot pause a run for approval or impose a deployment delay.

See more GH-200 practice questions, answers explained.

Exam traps in Secure and optimize automation

Answers that look right on this material and are not. Each one is a distractor from a different question in the GH-200 bank for this domain.

Store it as an organisation secret scoped to selected repositories, because organisation scope keeps the value tied to the staging environment's approval gate.
Why it is wrong: Tempting because organisation secrets centralise sharing, but they are available to matching repositories without any environment gate, so the value is not held back until approval.
A required reviewers rule on the environment, because naming reviewers automatically inserts a fixed delay during which the queued deployment can still be cancelled.
Why it is wrong: Tempting because required reviewers also pause a run, but that rule waits for a named person to approve rather than counting down a fixed timer, so it provides no automatic delay window.
Pick the action with the most stars and reference it by its branch name, because high popularity plus tracking the default branch keeps the team on the latest fixes automatically.
Why it is wrong: Tempting because stars suggest trust and tracking a branch sounds current, but a branch reference can change under you at any time, which is the least safe way to consume an action.

Examworthy is not affiliated with or endorsed by GitHub. Original, blueprint-aligned practice material only.