[Describe the GHAS Security Features and Functionality]Which of the following information can be found in a repository's Security tab?
Answer(s): A
The Security tab in a GitHub repository provides a central location for viewing security-related information, especially when GitHub Advanced Security is enabled. The following can be accessed:Number of alerts related to:Code scanningSecret scanningDependency (Dependabot) alertsSummary and visibility into open, closed, and dismissed security issues.It does not show 2FA options, access control settings, or configuration panels for GHAS itself. Those belong to account or organization-level settings.
GitHub Docs Managing security and analysis settings for your repository
[Configure and Use Secret Scanning]How many alerts are created when two instances of the same secret value are in the same repository?
When multiple instances of the same secret value appear in a repository, only one alert is generated. Secret scanning works by identifying exposed credentials and token patterns, and it groups identical matches into a single alert to reduce noise and avoid duplication.This makes triaging easier and helps teams focus on remediating the actual exposed credential rather than reviewing multiple redundant alerts.
GitHub Docs About secret scanning alerts
[Configure and Use Secret Scanning]What happens when you enable secret scanning on a private repository?
Answer(s): C
When secret scanning is enabled on a private repository, GitHub performs a read-only analysis of the repository's contents. This includes the entire Git history and files to identify strings that match known secret patterns or custom-defined patterns.GitHub does not alter the repository, and enabling secret scanning does not automatically enable code scanning or dependency review -- each must be configured separately.
GitHub Docs Managing secret scanning for repositories
[Configure and Use Dependency Management]You have enabled security updates for a repository. When does GitHub mark a Dependabot alert as resolved for that repository?
Answer(s): D
A Dependabot alert is marked as resolved only after the related pull request is merged into the repository. This indicates that the vulnerable dependency has been officially replaced with a secure version in the active codebase.Simply generating a PR or passing checks does not change the alert status; merging is the key step.
GitHub Docs About Dependabot security updates; Managing Dependabot alerts
[Use Code Scanning with CodeQL]How would you build your code within the CodeQL analysis workflow? (Each answer presents a complete solution. Choose two.)
Answer(s): D,F
Comprehensive and Detailed Explanation;When setting up CodeQL analysis for compiled languages, there are two primary methods to build your code:GitHub DocsAutobuild: CodeQL attempts to automatically build your codebase using the most likely build method. This is suitable for standard build processes.GitHub DocsCustom Build Steps: For complex or non-standard build processes, you can implement custom build steps by specifying explicit build commands in your workflow. This provides greater control over the build process.GitHub DocsThe init action initializes the CodeQL analysis but does not build the code. The jobs.analyze.runs-on specifies the operating system for the runner but is not directly related to building the code. Uploading compiled binaries is not a method supported by CodeQL for analysis.
GitHub Docs CodeQL code scanning for compiled languages
[Configure and Use Dependency Management]Which of the following workflow events would trigger a dependency review? (Each answer presents a complete solution. Choose two.)
Answer(s): A,B
Comprehensive and Detailed Explanation;Dependency review is triggered by specific events in GitHub workflows:pull_request: When a pull request is opened, synchronized, or reopened, GitHub can analyze the changes in dependencies and provide a dependency review.workflow_dispatch: This manual trigger allows users to initiate workflows, including those that perform dependency reviews.The trigger and commit options are not recognized GitHub Actions events and would not initiate a dependency review.
GitHub Docs Events that trigger workflows
[Configure and Use Dependency Management]You are a maintainer of a repository and Dependabot notifies you of a vulnerability. Where could the vulnerability have been disclosed? (Each answer presents part of the solution. Choose two.)
Answer(s): A,C
Comprehensive and Detailed Explanation;Dependabot alerts are generated based on data from various sources:National Vulnerability Database (NVD): A comprehensive repository of known vulnerabilities, which GitHub integrates into its advisory database.GitHub DocsSecurity Advisories Reported on GitHub: GitHub allows maintainers and security researchers to report and discuss vulnerabilities, which are then included in the advisory database.The dependency graph and manifest/lock files are tools used by GitHub to determine which dependencies are present in a repository but are not sources of vulnerability disclosures themselves.
GitHub Docs About Dependabot alerts
[Configure and Use Secret Scanning]Which of the following statements most accurately describes push protection for secret scanning custom patterns?
Answer(s): B
Comprehensive and Detailed Explanation;Push protection for secret scanning custom patterns is an opt-in feature. This means that for each custom pattern defined in a repository, maintainers can choose to enable or disable push protection individually. This provides flexibility, allowing teams to enforce push protection on sensitive patterns while leaving it disabled for others.
GitHub Docs Working with push protection from the command line
Post your Comments and Discuss Microsoft GH-500 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the GH-500 content, but please register or login to continue.