GH-900: GitHub Foundations
The exam validates foundational knowledge of GitHub and its core features. It covers Git concepts, repositories, collaboration tools, project management, security, administration, and modern development practices. The exam is intended for non-developers, developers, and other GitHub users who want to demonstrate proficiency with GitHub fundamentals.
What you get with membership
- The full GH-900 question bank with detailed explanations
- Readiness tracking by objective so you know when you're ready
- Access to every other exam in the Certavo library
- Content kept in step with the latest exam objectives
GH-900 exam objectives and study guide
The skills measured on the GH-900 exam, by objective domain. Percentages are the share of the exam each domain carries.
Understand Git and GitHub basics
27.5% of the exam- Describe the purpose and benefits of version control
- Explain the difference between Git and GitHub
- Identify key Git concepts such as repositories, commits, and branches
- Describe GitHub accounts, organizations, and enterprise options
- Explain the GitHub Flow for collaboration
- Identify uses of Markdown for clear communication in issues and pull requests
- Recognize when to use GitHub Desktop and GitHub Mobile
Work with GitHub repositories
12.5% of the exam- Describe the structure and key files of a GitHub repository (README, LICENSE, CONTRIBUTING, CODEOWNERS, SECURITY)
- Identify how to create, organize, and maintain repositories using templates and branches.
- Explain how to add and manage files within a repository
- Describe repository insights, stars, feature previews, repository metrics dashboards, and dependency insights for improved visibility
- Recognize best practices for repository maintenance and collaboration
Collaborate using GitHub
12.5% of the exam- Describe how to use issues, pull requests, and discussions for collaboration
- Explain how to link pull requests to issues and manage templates, filters, and assignments
- Identify the purpose of notifications and how to configure them for workflow management
- Describe how to use Gists, Wikis, and GitHub Pages to document and share information
Apply modern development practices
12.5% of the exam- Describe the purpose and capabilities of GitHub Actions
- Identify how GitHub Copilot assists with AI-powered code suggestions, including Copilot agents, Agent Mode, and multi‑model support
- Explain the differences between GitHub Copilot for Individuals, Business, and Enterprise
- Describe GitHub Codespaces and how to set up, customize, and use dev containers
- Explain when to use the github.dev editor and how it differs from Codespaces
Understand privacy, security, and administration
12.5% of the exam- Describe how to secure accounts with two-factor authentication (2FA) and passkeys
- Identify access permissions and roles for repositories and organizations
- Explain the purpose of Enterprise Managed Users (EMUs) and organization-wide Copilot policy management
- Describe repository privacy options, visibility settings, and branch protection rules
- Recognize how to manage organization settings, teams, and roles
Manage projects with GitHub
7.5% of the exam- Describe GitHub Projects and layout options
- Explain how to configure projects, labels, milestones, and workflows
- Identify how to use saved replies and assignees to streamline communication
- Describe how project insights can be used to track progress and productivity
Explore the GitHub community
7.5% of the exam- Describe the benefits of open source and GitHub Sponsors
- Explain how GitHub supports and advances open-source projects.
- Identify how to follow users and organizations to stay informed about activity.
- Describe the GitHub Marketplace and its purpose.
- Explain how InnerSource applies open-source principles within organizations.
- Recognize when to use forks, templates, and discoverable repositories to promote collaboration.
GH-900 practice questions and answers
10 free sample questions from the GH-900 bank, with the correct answer and a full explanation for each. These are original questions written to the GitHub objective domains — not real exam content.
- Question 1Explore the GitHub community
Which outcomes are common benefits of participating in open source communities on GitHub? Select three.
- ACommunity members can report bugs, improve documentation, review code, and propose changes.
- BReusable code and documentation can reduce duplicated effort when used according to the project license.
- CGitHub Sponsors can give users who depend on a project a way to fund its maintainers.
- DA sponsorship automatically gives the sponsor repository write access so they can fix issues directly.
- EOpen source licenses grant unrestricted use of GitHub's logos and trademarks for the project.
Show answer and explanation
Correct answers
- Community members can report bugs, improve documentation, review code, and propose changes.
- Reusable code and documentation can reduce duplicated effort when used according to the project license.
- GitHub Sponsors can give users who depend on a project a way to fund its maintainers.
Explanation
The correct answers are the options about community collaboration, reuse under the project license, and funding maintainers.
Open source communities on GitHub let people collaborate by reporting bugs, improving documentation, reviewing code, and proposing changes. Open source code and documentation can reduce duplicated effort when they are used according to the applicable license. GitHub Sponsors adds a way for people and organizations that depend on open source work to financially support maintainers.
A sponsorship does not automatically grant repository write access. Also, open source licensing does not grant unrestricted rights to use GitHub's trademarks or logos.
References:
- Question 2Explore the GitHub community
Amina, a documentation maintainer, needs to summarize how GitHub Sponsors can help sustain an open source project without limiting support to code authors. Which statements are accurate?
- AContributions such as documentation, bug reports, issue triage, mentorship, design, and project management can help qualify someone in a supported region to apply as a sponsored developer.
- BSponsored accounts can offer both one-time and monthly tiers, and publishing sponsorship tiers is optional.
- CSponsorships from personal accounts pass 100% of the sponsorship to the sponsored developer or organization.
- DA sponsored maintainer can edit the price of an existing published tier when project costs change.
- EOnly users with repository admin access can receive sponsorships for work on that repository.
Show answer and explanation
Correct answers
- Contributions such as documentation, bug reports, issue triage, mentorship, design, and project management can help qualify someone in a supported region to apply as a sponsored developer.
- Sponsored accounts can offer both one-time and monthly tiers, and publishing sponsorship tiers is optional.
- Sponsorships from personal accounts pass 100% of the sponsorship to the sponsored developer or organization.
Explanation
The correct statements describe GitHub Sponsors as a funding mechanism for many kinds of open source contribution, not only code.
- Contributions such as documentation, bug reports, issue triage, mentorship, design, and project management can qualify someone in a supported region to apply as a sponsored developer.
- Sponsored accounts can offer one-time and monthly tiers, and publishing tiers is optional.
- For sponsorships from personal accounts, GitHub Sponsors does not charge a fee, so 100% goes to the sponsored developer or organization.
- A published tier price cannot be edited; the sponsored account must retire the tier and create a new one.
- Repository admin access is not the eligibility test for sponsorship; contribution to open source work is.
References:
- Question 3Explore the GitHub community
Which account roles can sponsor open source contributors on behalf of an organization through GitHub Sponsors?
- AOrganization owners and billing managers
- BUsers with the repository `Admin` or `Maintain` role
- COrganization members assigned the security manager role
- DOutside collaborators with write access to a repository
Show answer and explanation
Correct answer
- Organization owners and billing managers
Explanation
Organization owners and billing managers can sponsor accounts on behalf of an organization. Anyone can sponsor from their own personal account, but organization sponsorships require one of those organization billing-authorized roles.
- Repository
AdminorMaintainpermissions apply to repository management, not organization sponsorship billing. - The security manager role is for organization security settings, not sponsoring accounts.
- Outside collaborator access to repositories does not authorize spending on behalf of the organization.
References:
- Question 4Explore the GitHub community
After a maintainer publishes a monthly GitHub Sponsors tier, they decide the price should be lower for future sponsors. What should the maintainer do?
- ARetire the existing tier and create a new tier with the new price.
- BEdit the price field on the published tier and save the change.
- CConvert the existing monthly tier to a one-time tier and update the amount.
- DMake the repository private, update the tier, and then make the repository public again.
Show answer and explanation
Correct answer
- Retire the existing tier and create a new tier with the new price.
Explanation
Once a GitHub Sponsors tier has been published, its price cannot be edited. The maintainer should retire the existing tier and create a new tier with the new price. Existing sponsors remain on the retired tier until they change tiers, cancel, or their one-time sponsorship period expires.
- Editing the published tier price is not supported.
- Converting the same tier between monthly and one-time does not provide a way to change the published price.
- Requiring all existing sponsors to cancel first is not necessary; GitHub lets them remain on the retired tier.
- Repository visibility does not control sponsorship tier pricing.
References:
- Question 5Explore the GitHub community
Open source maintainers want supporters to fund the projects they depend on through GitHub. Which GitHub Sponsors actions support that goal?
- ASponsor a developer or organization that has a sponsored profile using a one-time or monthly amount.
- BUse bulk sponsorships to fund multiple maintainers from a CSV file.
- CReceive maintainer permissions to the sponsored repository automatically when payment succeeds.
- DBypass the open source license terms for dependencies that are sponsored.
- EChange the sponsored account's tier rewards during checkout.
Show answer and explanation
Correct answers
- Sponsor a developer or organization that has a sponsored profile using a one-time or monthly amount.
- Use bulk sponsorships to fund multiple maintainers from a CSV file.
Explanation
GitHub Sponsors lets supporters fund developers or organizations that design, create, or maintain open source projects they depend on. Sponsors can use one-time or monthly amounts, and bulk sponsorships can fund multiple maintainers using a CSV file.
- Sponsoring a developer or organization with a sponsored profile is the core GitHub Sponsors flow.
- Bulk sponsorships help support multiple dependency maintainers at once.
- Sponsoring does not automatically grant repository maintainer permissions.
- Sponsorship does not bypass open source license terms for dependencies.
- Tier rewards are determined by the sponsored account; the sponsor does not edit the sponsored account's rewards during checkout.
References:
- Question 6Understand privacy, security, and administration
On a developer profile, the contribution calendar omits activity from repositories that are not public. The developer wants to show activity without revealing repository names or content. Which statements describe the relevant privacy behavior?
- AUse the profile contribution settings to show or hide private contributions.
- BActivity from private and internal repositories is shown in an anonymized form on the profile.
- CHiding an individual achievement makes that badge visible only to the user.
- DChanging the profile setting changes the visibility of repositories the user contributes to.
- ERepository administrators configure this from the Branches settings for the repository.
Show answer and explanation
Correct answers
- Use the profile contribution settings to show or hide private contributions.
- Activity from private and internal repositories is shown in an anonymized form on the profile.
- Hiding an individual achievement makes that badge visible only to the user.
Explanation
The profile-level private contribution setting controls whether anonymized activity from private and internal repositories appears on the profile. It does not change repository visibility or grant access to repository contents. Separately, an individual achievement can be hidden so that the badge is only visible to the user.
- The setting is managed from the profile contribution settings, not repository Branches settings.
- It does not make repository names, code, or private repository details public.
- Repository visibility remains controlled by the repository visibility setting.
References:
- en/account-and-profile/how-tos/contribution-settings/manage-visibility-settings-for-private-contributions-and-achievements
- en/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility
- en/repositories/creating-and-managing-repositories/about-repositories
- Question 7Understand privacy, security, and administration
After a branch protection rule is converted to a ruleset, the original rule remains because the deletion option was not selected. The Branches settings page says the rule is fully covered by rulesets. What should you do to avoid enforcing duplicate protections while keeping the ruleset model?
- AConfirm the active ruleset behaves as expected, then delete the original branch protection rule from Branches settings.
- BDisable the ruleset and keep the original branch protection rule as the enforced policy.
- CRemove required status checks from the original branch protection rule and keep both protections.
- DChange the repository visibility so the generated ruleset supersedes the branch protection rule.
Show answer and explanation
Correct answer
- Confirm the active ruleset behaves as expected, then delete the original branch protection rule from Branches settings.
Explanation
When the original branch protection rule is fully covered by rulesets, GitHub indicates that it can be safely deleted. You should first confirm the active ruleset behaves as expected, then delete the original branch protection rule. Disabling the ruleset keeps the legacy protection model. Removing individual requirements from the old rule can weaken or complicate protections. Changing repository visibility does not cause a ruleset to supersede a branch protection rule.
References:
- en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/converting-branch-protections-to-rulesets
- en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets
- en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule
- Question 8Understand privacy, security, and administration
Which repository visibility allows anyone on the internet to read the repository while still requiring explicit write permissions to change it?
- APublic
- BPrivate
- CInternal
- DArchived
Show answer and explanation
Correct answer
- Public
Explanation
A public repository is visible to anyone on the internet, but write access still requires the appropriate repository permission. A private repository restricts read access to authorized accounts. An internal repository is limited to enterprise members. Archiving is a repository state that makes the repository read-only; it is not a visibility setting.
References:
- Question 9Understand privacy, security, and administration
On a protected default branch, repository administrators and users with a custom role that can bypass branch protections still merge changes that do not meet the configured requirements. Which branch protection setting addresses this without changing the repository visibility?
- AEnable `Do not allow bypassing the above settings`.
- BEnable `Restrict who can push to matching branches`.
- CEnable `Require deployments to succeed before merging`.
- DEnable `Allow force pushes`.
Show answer and explanation
Correct answer
- Enable `Do not allow bypassing the above settings`.
Explanation
By default, branch protection restrictions do not apply to repository administrators or custom roles with permission to bypass branch protections. Enabling
Do not allow bypassing the above settingsapplies the configured protections to those users. Restricting who can push controls push access, required deployments add a deployment gate, and allowing force pushes relaxes a protection; none of those specifically prevents administrators or bypass roles from bypassing the rule requirements.References:
- Question 10Understand privacy, security, and administration
Select the statements that correctly describe GitHub repository and profile visibility behavior.
- AA public repository can be viewed by anyone on the internet.
- BA private repository limits repository contents to accounts that have been granted access.
- CAn internal repository on GitHub Enterprise Cloud is visible to enterprise members.
- DThe Private contributions profile setting shows private repository names on the public contribution calendar.
- EArchiving a repository changes its visibility to internal.
Show answer and explanation
Correct answers
- A public repository can be viewed by anyone on the internet.
- A private repository limits repository contents to accounts that have been granted access.
- An internal repository on GitHub Enterprise Cloud is visible to enterprise members.
Explanation
Public repositories are visible to anyone on the internet. Private repositories restrict repository contents to accounts that have been granted access through user, team, organization, or ownership permissions. On GitHub Enterprise Cloud, internal repositories are visible to enterprise members. The Private contributions setting shows anonymized private activity on a profile; it does not reveal private repository names. Archiving a repository makes it read-only but does not change its visibility to internal.
References:
- en/repositories/creating-and-managing-repositories/about-repositories
- en/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility
- en/account-and-profile/how-tos/contribution-settings/manage-visibility-settings-for-private-contributions-and-achievements
Membership includes 188 questions and explanations aligned to the GH-900 curriculum.
Other GitHub certifications
Every one of these is included with the same membership as GH-900.
GH-900 exam FAQ
How many questions are on the GH-900 exam?+
The GH-900 (GitHub Foundations) exam has around 50 questions. Question counts vary slightly between exam forms, so treat this as the typical number rather than a guarantee.
How long is the GH-900 exam?+
You get 100 minutes for the GH-900 exam itself. Allow extra time at the test centre or for the online check-in process before the timer starts.
What level is GH-900?+
GH-900 is a GitHub fundamentals-level certification, so it assumes no prior certification and is a common starting point.
Are there free GH-900 practice questions?+
Yes. 10 free GH-900 practice questions are on this page, each with the correct answer and a full explanation. The complete bank of 188 questions is included with membership.
Are these real GH-900 exam questions?+
No. Every question is original, written to match the published GH-900 objective domains and question styles. Real exam content is confidential, and reusing it would breach GitHub's exam policies.