GH-500 · Question #84
How does Dependabot use the dependency graph in GitHub Advanced Security (GHAS)?
The correct answer is D. To cross-reference dependency data with the GitHub Advisory Database. Dependabot leverages the dependency graph by cross-referencing the list of detected dependencies against the GitHub Advisory Database to identify packages with known security vulnerabilities.
Question
How does Dependabot use the dependency graph in GitHub Advanced Security (GHAS)?
Options
- ATo identify and address security vulnerabilities in the codebase.
- BTo automatically update project dependencies to their latest, secure versions.
- CTo generate alerts for potential security vulnerabilities in project dependencies.
- DTo cross-reference dependency data with the GitHub Advisory Database.
How the community answered
(21 responses)- B5% (1)
- C5% (1)
- D90% (19)
Why each option
Dependabot leverages the dependency graph by cross-referencing the list of detected dependencies against the GitHub Advisory Database to identify packages with known security vulnerabilities.
While Dependabot does help identify vulnerabilities, this answer omits the specific mechanism of cross-referencing with the GitHub Advisory Database, making it an incomplete and imprecise description.
Automatically updating dependencies to their latest versions describes Dependabot version updates, a distinct feature that is not specifically about how Dependabot uses the dependency graph for security purposes.
Generating alerts is the outcome of Dependabot's process, not a description of how it uses the dependency graph; the underlying mechanism is the cross-reference with the advisory database.
Dependabot uses the dependency graph as input data and cross-references it with the GitHub Advisory Database - a curated list of known CVEs and security advisories - to determine which project dependencies have disclosed vulnerabilities, which is the specific mechanism that powers Dependabot alerts.
Concept tested: Dependabot dependency graph and GitHub Advisory Database integration
Source: https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts
Topics
Community Discussion
No community discussion yet for this question.