GH-500 Exam Questions

A secret scanning alert should be closed as "used in tests" when a secret is:

What happens when you enable secret scanning on a private repository?

Which of the following statements best describes secret scanning push protection?

What is a security policy?

Which of the following information can be found in a repository's Security tab?

Which of the following benefits do code scanning, secret scanning, and dependency review provide?

Which alerts do you see in the repository's Security tab? Each answer presents part of the solution. (Choose three.)

A dependency has a known vulnerability. What does the warning message include?

Which features require GitHub Advanced Security to be enabled for internal and private repositories in an organization? Each correct answer presents part of the solution. (Choose t...

Which of the following is the best way to dispose of a compromised secret?

Assuming that no custom patterns are configured, what type of secret is detected by secret scanning?

What is the best method to ensure all new code is scanned for vulnerabilities?

What is the first step you should take to fix an alert in secret scanning?

Where in the repository can you give additional users access to secret scanning alerts?

What filter or sort settings can be used to prioritize the secret scanning alerts that present the most risk?

Which of the following secret scanning features can verify whether a secret is still active?

What is a prerequisite to define a custom pattern for a repository?

Assuming security and analysis features are not configured at the repository, organization, or enterprise level, secret scanning is enabled on:

Which patterns are secret scanning validity checks available to?

What role is required to change a repository's code scanning severity threshold that fails a pull request status check?

Which of the following is the most proactive and practical way to prevent new secret scanning alerts?

By default, where will secret scanning look in a repository in order to execute its job? Each correct answer presents part of the solution. (Choose three.)

Which of the following would raise secret scanning alerts?

What is the purpose of push protection?

Which of the following pre-defined roles is required to manage code scanning alerts in a repository?

Where is secret scanning enabled on a private repository?

Which of the following is the most complete method for Dependabot to find vulnerabilities in third- party dependencies?

In a private repository, what minimum requirements does GitHub need to generate a dependency graph? (Each answer presents part of the solution. Choose two.)

You have enabled security updates for a repository. When does GitHub mark a Dependabot alert as resolved for that repository?

Assuming that notification settings and Dependabot alert recipients have not been customized, which user account setting should you use to get an alert when a vulnerability is dete...

What are Dependabot security updates?

Which of the following Watch settings could you use to get Dependabot alert notifications? Each answer presents part of the solution. (Choose two.)

If default code security settings have not been changed at the repository, organization, or enterprise level, which repositories receive Dependabot alerts?

Who can fix a code scanning alert on a private repository?

Assuming that no custom Dependabot behavior is configured, who has the ability to merge a pull request created via Dependabot security updates?

Which key is required in the update settings of the Dependabot configuration file?

Where can you find a deleted line of code that contained a secret value?

Which security feature shows a vulnerable dependency in a pull request?

What should you do after receiving an alert about a dependency added in a pull request?

Assuming that notification and alert recipients are not customized, what does GitHub do when it identifies a vulnerable dependency in a repository where Dependabot alerts are enabl...

Which GitHub security feature should you use to see details of any vulnerable dependency versions within a pull request?

What is the best way to ensure that added dependencies' licenses are checked and new code is analyzed at the repository level?

What classification is used to categorize Dependabot alerts? Each correct answer presents part of the solution. (Choose three.)

Assuming that default security and analysis settings have not been changed at the repository, organization, or enterprise level, which scenario would generate a dependency graph fo...

What scenario demonstrates the use of Dependabot security updates?

Which of the following dependencies could trigger a Dependabot alert? Each answer presents a complete solution. (Choose two.)

Where can you find the vulnerable dependencies that GitHub detected in your repository?

You have enabled Dependabot alerts on your repository. If Dependabot detects a vulnerable dependency, it sends an alert when:

What is the minimum role needed in order to view the secret scanning alerts list within the Security tab of a repository?

By default, which roles can enable Dependabot alerts?