GH-100 Question #37: Real Exam Question with Answer & Explanation

Question

Why would a GitHub App be favored over a machine account for automation tasks?

Options

• AMachine accounts are required for webhook delivery.
• BGitHub Apps provide a higher rate limit ceiling than using a personal access token on a machine
• CGitHub Apps are limited to a single repository.
• DMachine accounts are easier to audit than GitHub Apps.

Explanation

GitHub Apps receive a significantly higher rate limit ceiling - up to 15,000 requests per hour (scaling with installation size) - compared to the 5,000 requests per hour cap tied to a personal access token used by a machine account. This makes GitHub Apps the preferred choice for automation at scale, where hitting rate limits would disrupt workflows.

Why the distractors are wrong:

• A is backwards - machine accounts don't handle webhook delivery; GitHub Apps are actually the modern, preferred mechanism for receiving webhooks.
• C is wrong because GitHub Apps can be installed across multiple repositories or even an entire organization, not just one repo.
• D is the opposite of reality - GitHub Apps are easier to audit because their actions are attributed to the app itself, whereas machine accounts share authentication patterns with regular users, making audit trails murkier.

Memory tip: Think of GitHub Apps as a "service account on steroids" - they have scoped permissions, higher rate limits, and a clear identity in audit logs. When you see "rate limit" + "automation" in an exam question, GitHub Apps is almost always the answer.

No community discussion yet for this question.