DEV Community: Radiodin

Microsoft GH-200 Exam Report 2026: Don't Use 2024 Microsoft GH-200 Exam Guides Until You Read This

Radiodin — Wed, 08 Jul 2026 07:18:05 +0000

Are you still preparing for the GH-200 with a guide, course, or question bank from 2024? If so, you're probably studying for an exam that doesn't exist anymore.
The GH-200 went through a major objectives revision in January 2026: new topics were added, several were removed, and existing ones were reworded. Yet most GH-200 pass reports and prep resources still floating around online are describing the old version. I took the exam under the current, post-revision format, and I'm writing this so you don't walk in unprepared the way a lot of outdated guides would leave you.

Why I'm Writing This Article:

If you search for GH-200 prep advice today, you'll mostly find content written before the January 2026 changes. That content isn't necessarily wrong it's just outdated. Topics that used to carry more weight have shifted, and the exam now leans more heavily into enterprise-scale and security-oriented scenarios. I'm documenting my experience with the current version so future test-takers know what to expect.

Exam Results:

I passed with a score of 75% (passing score is 700/1000). It was my first time taking a multiple-choice certification exam of this scale, and I felt the time pressure more than I expected. Scenario-based questions took longer to reason through than I'd planned for. I found myself second-guessing answers I'd normally have been confident about. I didn't have time to review every flagged question.

Exam Date: April 15, 2026
Location: Private room in a co-working space (Singapore)
Device: MacBook Air (2024, M2, 14.5-inch)
Format: Multiple-choice, proctored via Pearson VUE

Why the Old 2024 Guides Won't Cut It Anymore

This is the core reason for the title. The GH-200 exam changed significantly in January 2026 objectives were added, removed, and reworded. If you're studying from a 2024 guide, you're likely missing entire areas that are now tested, including:

Reusable workflows (workflow call) and passing inputs/secrets between them
workflow dispatch input validation (types, required fields, defaults)
Service containers (services:) configuring dependent services like databases or queues, including health checks and port/container options
Runner management at scale self-hosted vs. GitHub-hosted runners, runner groups, and scaling strategies.
Security and governance OIDC-based cloud authentication, secrets management, GITHUB TOKEN permission scoping, and organization-level policy enforcement
GitHub Packages and third-party service integrations A 2024 guide won't cover these the way the current exam expects. If your prep material hasn't been updated since the revision, you're studying for a different exam than the one you'll actually sit.

Learning Resources Used:

Microsoft Learn (Official GitHub Actions Training)

I used Microsoft's official GitHub Actions training path on Microsoft Learn to build my foundational, conceptual understanding of GitHub Actions the basics of workflows, actions, and CI/CD concepts. It's free, well-structured, and directly maintained by Microsoft/GitHub, so the content stays aligned with the actual product. However, it's built for learning, not for exam simulation there's no dedicated question bank, no timed practice test, and no way to gauge how ready you actually are for the real exam format.

Certboosters with its Microsoft GH-200 Prep Martial:

Certboosters' question bank, on the other hand, ended up helping me far more when it came to actual exam preparation. It included:

Web-based practice test
GH-200 Questions & Answers (PDF)
Desktop practice test software
The 3-in-1 Microsoft GH-200 exam Prep

This is where I got used to the scenario-based question style, the time pressure, and the pattern of plausible but wrong answer choices that the real exam relies on heavily.

Which one is better?

They're not really competing with each other they serve two different purposes. Microsoft Learn is better if you want a solid, accurate, and free foundation in how GitHub Actions actually works. Certboosters is better if your foundation is already reasonably solid and you specifically need exam-format practice timed questions, answer patterns, and repetition to get exam-ready.
If I had to pick just one for someone starting from zero, I'd say start with Microsoft Learn first, since it's free and accurate. But if you're closer to your exam date and need to sharpen your test-taking speed and accuracy, Certboosters is what actually moved the needle for me.

Tips:

he GH-200 exam isn't just testing whether you've memorized YAML syntax most questions are scenario-based: a workflow snippet, a description of unexpected behavior, and a few plausible-looking answers. Only one actually matches how GitHub Actions resolves triggers, job dependencies, and context scope at runtime.
A few things that helped me approach these questions more accurately:

Read the trigger first. On push and on pull request behave very differently depending on branch filters a lot of questions hinge on this distinction alone.
Check job dependencies (needs) carefully.This affects execution order and how failures propagate, and it's often less intuitive than it looks.
Don't assume you know the context scope. github.event, secrets, and env don't always behave the way they appear to at first glance. Slow down before answering.
When practicing, don't just check if you got the right answer. Understand why the other three were wrong. That's usually where the real learning happens, and it prepares you better for questions phrased slightly differently on the actual exam.
Watch for best practice style questions, where two answers are technically valid. Still, only one matches how GitHub Actions is meant to be used e.g., reusable workflows over copy-pasted YAML, environment protection rules over hardcoded conditionals.

Exam Environment:

The conditions for the exam environment are strict: a private space without noise, nothing on the desk, and so on. I didn't have such an environment at home, so I rented a private room in a co-working space in Singapore. Interaction with the proctor happens via chat, so there's no verbal conversation. That said, even slight noise seems to get flagged, so choosing a private room is the safer option.
Instructions from the proctor came in English, and communication was straightforward throughout. I responded in English for basic things like OK and thanks.
Following the proctor's instructions, I used the webcam to show the room (ceiling, floor, desk, walls), both ears, both wrists, and my powered-off smartphone. It took about 15 minutes before the exam actually started.I didn't use an external monitor at the co-working space, and in hindsight, a larger workspace would have made things easier. I should have used one.
During the exam, I didn't really notice the proctor's presence. But at one point, when I was stuck on a problem and touched my chin, a chat message appeared: Please refrain from gestures that cover your face.

Final Thoughts:

The real challenge was not learning GitHub Actions syntax. I knew that going in. The harder part was unlearning what pre-2026 guides assume the exam still looks like. If you are preparing right now, check whether your resource actually reflects the January 2026 revision especially around reusable workflows, service containers, runner management, and security governance. That distinction alone probably separated passing from failing for me.

Between Microsoft Learn for fundamentals and CertBoosters for exam-style practice, I felt reasonably prepared. But the time pressure on scenario-based questions still caught me off guard. Sixty-five questions in 100 minutes sounds manageable. Under actual exam conditions, it is not.

The last few months were personally difficult. Work was demanding and I felt like I was standing still professionally. Passing GH-200 was a reminder that momentum is something you build deliberately not something that arrives. With GH-200 done, I am planning to continue into the broader Microsoft GitHub Certification track. GitHub Advanced Security (GH-500) is next. This felt like the right foundation to build from.

The AWS Shared Responsibility Model Is the Only Security Framework Your Cloud Business Actually Needs

Radiodin — Thu, 16 Apr 2026 09:43:48 +0000

You moved your workloads to AWS to save time, cut costs, and scale faster.
But here's the part nobody told you upfront: moving to the cloud doesn't mean AWS handles your security.
That misconception has cost businesses millions in breaches, compliance failures, and data loss. And the fix isn't a new tool, a bigger budget, or a third-party framework.
It's understanding one model. The right model. The AWS Shared Responsibility Model.

What Is the AWS Shared Responsibility Model?

At its core, the AWS Shared Responsibility Model defines exactly who is responsible for what in a cloud environment.
AWS takes ownership of cloud security. You take ownership of cloud security.
Simple in theory. Catastrophically misunderstood in practice.
AWS protects the global infrastructure, including the physical data centers, hardware, networking equipment, hypervisors, and the managed services that run on top of it. That's their lane. They own it completely.
Your lane? Everything you put inside that infrastructure.

What AWS Is Responsible For No More, No Less

AWS's responsibility covers what they call the "Security of the Cloud." This includes:
Physical infrastructure: AWS manages and secures its global network of data centers across Regions and Availability Zones. You'll never touch a server rack. You don't need to.
Compute, storage, and networking hardware: The physical machines, storage devices, and network components that power your cloud environment are entirely under AWS's control.
Managed services security: Services such as Amazon S3, RDS, and Lambda include AWS-managed security at the infrastructure level. Patch management, hardware failure and physical access, AWS handles it.
This is the foundation. It's rock solid. But it only goes so far.

What YOU Are Responsible For: This Is Where Most Teams Fail:

Here's where the model gets critical and where most cloud breaches actually originate.
Your responsibility covers Security in the Cloud. Depending on what services you use, this includes:
• Customer data: Encryption, classification, and protection of your data is entirely up to you.
• Identity and Access Management (IAM): Who can access what, with what permissions? That's your job to define and enforce.
• Operating system patches: If you're running EC2 instances, you're responsible for patching the OS. AWS won't do it for you.
• Application-level security: Vulnerabilities in your code, your APIs, your application logic, yours.
• Network configuration: Security groups, NACLs, VPC settings, firewall rules — all configured and maintained by you.
• Encryption settings — AWS gives you the tools. Using them correctly is your call.
Miss any one of these, and you've left a door wide open.

The Responsibility Shift | Why Service Type Changes Everything:

Here's something most guides skip over entirely.
Your responsibilities don't stay the same across all AWS services. They shift based on the service model you're using.
Infrastructure as a Service (IaaS): With services like Amazon EC2, you manage the most. The OS, middleware, runtime, application, and data are all in your hands.
Platform as a Service (PaaS): Services like AWS Elastic Beanstalk abstract the OS and runtime. AWS manages more. You manage less, but you still own your data and application.
Software as a Service (SaaS): AWS-managed services like Amazon WorkMail push even more responsibility to AWS. Your obligation narrows significantly.
Understanding this shift isn't optional. It's the difference between a secure deployment and a vulnerable one.

Why This Model Makes the AWS Shared Responsibility Model Superior to Generic Security Frameworks:

Generic security frameworks like ISO 27001 or NIST are built for broad environments.
They weren't designed around the specific architecture of AWS infrastructure. They don't account for IAM roles, S3 bucket policies, VPC peering, or Security Group inheritance.
The AWS Shared Responsibility Model is purpose-built for the cloud. It maps directly to the services you're actually using. It gives you clear delineation, no ambiguity about who patches what or who encrypts what.
For businesses running on AWS, it's not just a framework. It's the framework.
And for anyone pursuing the AWS Certified Cloud Practitioner exam, it's one of the most heavily tested domains you'll face on exam day.

The Real-World Cost of Getting This Wrong

Don't think this is just an academic concept.
In 2019, a major financial institution suffered a massive cloud breach not because AWS failed, but because a misconfigured WAF exposed sensitive customer data. AWS's infrastructure was fine. The customer's configuration wasn't.
That's the model in action, or rather, the consequences of ignoring it.
Misconfigured S3 buckets have exposed millions of records. Overly permissive IAM roles have enabled attackers to achieve lateral movement across entire cloud environments. Public-facing EC2 instances with unpatched OS vulnerabilities have been exploited in hours.
Every single one of those failures falls inside the customer's lane.

How to Apply the Model Before You Deploy Anything

How to Apply the Model Before You Deploy Anything
Before you launch your next workload on AWS, ask yourself four questions:

What service type am I using? IaaS, PaaS, or SaaS, your responsibility level changes immediately based on this answer.
Is my data encrypted at rest and in transit? AWS provides tools such as KMS and SSL/TLS support. Using them is your job.
Have I applied least-privilege IAM policies? Every user, role, and service should have the minimum permissions needed, nothing more.
Are my security groups and NACLs properly scoped? Wide-open inbound rules are one of the most common and preventable security mistakes in AWS. Answer these four questions honestly before go-live, and you've dramatically reduced your attack surface.

Preparing for the CLF-C02 Exam? This Model Is Non-Negotiable

If you're studying for the AWS Certified Cloud Practitioner exam, the shared responsibility model will appear in multiple questions, often wrapped in realistic scenarios designed to test whether you truly understand the boundary.
Expect questions like: A company's EC2 instance OS is outdated. Whose responsibility is this? Or AWS experiences a hardware failure in a data center. Who is accountable?

The answer is always rooted in the model.

To sharpen your understanding and test yourself against real exam-style questions, CertBoosters Practice Questions are an excellent resource. They're built to mirror the scenario-based format AWS uses on the actual exam, including questions that specifically target the shared responsibility model.
Practice doesn't just build confidence. It reveals the gaps you didn't know existed. The Entities and Concepts You Must Know Cold:

To fully command this topic, whether for the exam or your job, make sure you understand how the model connects to:
• AWS Global Infrastructure (Regions, Availability Zones, Edge Locations)
• IAM (users, groups, roles, policies)
• Amazon S3 bucket policies and ACLs
• Security Groups vs. NACLs
• AWS Key Management Service (KMS)
• AWS Shield and AWS WAF (AWS-provided tools, customer-configured)
• Amazon Inspector and AWS Config (your responsibility to enable and act on)
• Compliance programs (AWS maintains certifications; you maintain your compliance posture)
Each of these entities lives somewhere on the responsibility spectrum. Knowing exactly where is what separates a cloud practitioner from a cloud professional.

The Bottom Line:

The AWS Shared Responsibility Model isn't a bureaucratic concept buried in documentation. It is the operational truth of every workload you run on AWS. Every security decision you make maps back to it. Every breach that could have been prevented was caused by someone not understanding it deeply enough.
Master this model, and you don't just pass an exam; you build genuinely secure cloud environments.

And speaking of the exam, if you're ready to validate your knowledge with targeted practice, CLF-C02 Practice Questions from **CertBoosters **are aligned directly to the current exam domains, including the security and compliance section, where this model is tested hardest.