[Configure and Use Secret Scanning]Which of the following statements best describes secret scanning push protection?
Answer(s): A
Comprehensive and Detailed Explanation;Secret scanning push protection is a proactive feature that scans for secrets in your code during the push process. If a secret is detected, the push is blocked, preventing the secret from being added to the repository. This helps prevent accidental exposure of sensitive information.GitHub Docs
GitHub Docs About push protection
[Configure and Use Dependency Management]In a private repository, what minimum requirements does GitHub need to generate a dependency graph? (Each answer presents part of the solution. Choose two.)
Answer(s): B,D
Comprehensive and Detailed Explanation;To generate a dependency graph for a private repository, GitHub requires:Dependency graph enabled: The repository must have the dependency graph feature enabled. This can be configured at the organization level to apply to all new private repositories.Access to manifest and lock files: GitHub needs read-only access to the repository's dependency manifest and lock files (e.g., package.json, requirements.txt) to identify and map dependencies.
GitHub Docs About the dependency graph
[Use Code Scanning with CodeQL]What does a CodeQL database of your repository contain?
Answer(s): B
Comprehensive and Detailed Explanation;A CodeQL database contains a representation of your codebase, including the build of the code and extracted data. This database is used to run CodeQL queries to analyze your code for potential vulnerabilities and errors.GitHub Docs
GitHub Docs Preparing your code for CodeQL analysis
[Use Code Scanning with CodeQL]When using CodeQL, how does extraction for compiled languages work?
Answer(s): C
For compiled languages, CodeQL performs extraction by monitoring the normal build process. This means it watches your usual build commands (like make, javac, or dotnet build) and extracts the relevant data from the actual build steps being executed. CodeQL uses this information to construct a semantic database of the application.This approach ensures that CodeQL captures a precise, real-world representation of the code and its behavior as it is compiled, including platform-specific configurations or conditional logic used during build.
GitHub Docs CodeQL for compiled languages
[Configure and Use Secret Scanning]Which of the following features helps to prioritize secret scanning alerts that present an immediate risk?
Answer(s): D
Secret validation checks whether a secret found in your repository is still valid and active with the issuing provider (e.g., AWS, GitHub, Stripe). If a secret is confirmed to be active, the alert is marked as verified, which means it's considered a high-priority issue because it presents an immediate security risk.This helps teams respond faster to valid, exploitable secrets rather than wasting time on expired or fake tokens.
GitHub Docs Secret validation in secret scanning
Post your Comments and Discuss GitHub GitHub Advanced Security exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the GitHub Advanced Security content, but please register or login to continue.