[Describe GitHub Advanced Security Best Practices]As a contributor, you discovered a vulnerability in a repository. Where should you look for the instructions on how to report the vulnerability?
Answer(s): D
The correct place to look is the SECURITY.md file. This file provides contributors and security researchers with instructions on how to responsibly report vulnerabilities. It may include contact methods, preferred communication channels (e.g., security team email), and disclosure guidelines.This file is considered a GitHub best practice and, when present, activates a "Report a vulnerability" button in the repository's Security tab.
GitHub Docs Adding a security policy to your repository
[Configure and Use Dependency Management]Assuming there is no custom Dependabot behavior configured, where possible, what does Dependabot do after sending an alert about a vulnerable dependency in a repository?
Answer(s): A
After generating an alert for a vulnerable dependency, Dependabot automatically attempts to create a pull request to upgrade that dependency to the minimum required secure version--if a fix is available and compatible with your project.This automated PR helps teams fix vulnerabilities quickly with minimal manual intervention. You can also configure update behaviors using dependabot.yml, but in the default state, PR creation is automatic.
GitHub Docs About Dependabot alerts; About Dependabot security updates
[Configure and Use Secret Scanning]What is the first step you should take to fix an alert in secret scanning?
Answer(s): C
The first step when you receive a secret scanning alert is to revoke the secret if it is still valid. This ensures the secret can no longer be used maliciously. Only after revoking it should you proceed to remove it from the code history and apply other mitigation steps.Simply deleting the secret from the code does not remove the risk if it hasn't been revoked -- especially since it may already be exposed in commit history.
GitHub Docs About secret scanning alerts; Remediating a secret scanning alert
[Configure and Use Dependency Management]A dependency has a known vulnerability. What does the warning message include?
When a vulnerability is detected, GitHub shows a warning that includes a brief description of the vulnerability. This typically covers the name of the CVE (if available), a short summary of the issue, severity level, and potential impact. The message also links to additional advisory data from the GitHub Advisory Database.This helps developers understand the context and urgency of the vulnerability before applying the fix.
GitHub Docs About Dependabot alerts; Reviewing and managing alerts
Post your Comments and Discuss GitHub GitHub-Advanced-Security exam prep with other Community members:
Pholas Commented on July 14, 2025 thank you for the questions SOUTH AFRICA
Chinnappa Commented on July 14, 2025 Very helpful.. robust & reliable document Anonymous
Chandika Commented on July 14, 2025 Good work. Thanks Anonymous
Our website is free, but we have to fight against bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the GitHub-Advanced-Security content, but please register or login to continue.