When a token is used to perform actions across different GitHub resources, how is this reflected in audit logs?

Question

Options

• AEach API action made with the token generates a separate audit log entry
• BOnly the first repository accessed is recorded
• CGitHub creates a ZIP archive of all token activity
• DThe audit log stores only the token name and not its actions

• A
  88% (36)
• B
  2% (1)
• C
  7% (3)
• D
  2% (1)

Explanation

Option A is correct because GitHub's audit log is designed to provide granular accountability - every individual API call made with a token is recorded as its own distinct event, capturing the specific action, resource, and timestamp. This allows security teams to trace exactly what a token did across an organization's repositories, packages, or other resources.

Why the distractors are wrong:

• B is wrong because audit logging is comprehensive, not limited to the first resource touched - all subsequent repository accesses are also logged.
• C is wrong because GitHub has no such ZIP archive mechanism; audit logs are queryable records, not downloadable archives of token activity.
• D is wrong because the audit log captures the actions performed (the whole point of auditing), not just the token's name as metadata.

Memory tip: Think of GitHub audit logs like a bank statement - every transaction (API action) gets its own line item, not a single "account was used" summary entry. One action = one log entry.

No community discussion yet for this question.