2 packs: 15% off with code BUY2. 3 or more: 20% off with code BUY3.

Free GitHub GH-500 Advanced Security Practice Questions

32 free GitHub GH-500 Advanced Security practice questions from the CertStash pack of 127, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 32 free here, all 127 in the pack, and each step includes the one before it.

Get all 127 questions (US$39) · Download the first 10 as a PDF

Question 1

What is a prerequisite to define a custom pattern for a repository?

  1. Change the repository visibility to Internal.
  2. Enable secret scanning.
  3. Close other secret scanning alerts.
  4. Specify additional match criteria.
Show answer and explanation

Correct answer: B. Enable secret scanning.

Secret scanning must be enabled on a repository before you can define custom patterns for it. This is a fundamental prerequisite because custom patterns are part of the secret scanning feature set and cannot exist without the parent feature being active.

Why the other options are wrong

  • A. Repository visibility does not need to be changed to Internal to define custom patterns.
  • C. Closing other secret scanning alerts is not a prerequisite for defining custom patterns.
  • D. While match criteria are specified when creating a pattern, they are not a prerequisite but rather a component of the pattern definition itself.

Question 2

Assuming security and analysis features are not configured at the repository, organization, or enterprise level, secret scanning is enabled on:

  1. private repositories.
  2. all new repositories within your organization.
  3. public repositories.
  4. user-owned private repositories.
Show answer and explanation

Correct answer: C. public repositories.

When security and analysis features are not configured at any level, secret scanning is enabled by default on public repositories only. GitHub prioritizes scanning public repositories because they are accessible to everyone and pose the greatest risk if secrets are exposed.

Why the other options are wrong

  • A. Private repositories do not have secret scanning enabled by default; this typically requires explicit enablement.
  • B. Secret scanning is not automatically enabled on all new repositories without configuration; it must be explicitly set at the organization level.
  • D. User-owned private repositories do not have secret scanning enabled by default without explicit configuration.

Question 3

Which patterns are secret scanning validity checks available to?

  1. high entropy strings
  2. custom patterns
  3. push protection patterns
  4. partner patterns
Show answer and explanation

Correct answer: D. partner patterns

Secret scanning validity checks are available to partner patterns. Partner patterns are provided by GitHub's security partners and include built-in validity checks that verify whether detected secrets are actually valid and active, reducing false positives.

Why the other options are wrong

  • A. High entropy strings are a pattern type but do not have validity checks available.
  • B. Custom patterns do not have validity checks; they are user-defined and lack the validation infrastructure of partner patterns.
  • C. Push protection patterns do not have dedicated validity checks as a primary feature.

Question 4

What role is required to change a repository’s code scanning severity threshold that fails a pull request status check?

  1. Maintain
  2. Write
  3. Admin
  4. Triage
Show answer and explanation

Correct answer: C. Admin

The Admin role is required to change a repository's code scanning severity threshold that fails a pull request status check. This is a critical repository configuration that affects enforcement policies and requires administrative-level permissions.

Why the other options are wrong

  • A. Maintain role does not have sufficient permissions to modify code scanning status check thresholds.
  • B. Write role lacks the administrative permissions needed to configure code scanning enforcement settings.
  • D. Triage role has limited permissions focused on managing issues and does not include code scanning configuration.

Question 5

What YAML syntax do you use to exclude certain files from secret scanning?

  1. paths-ignore:
  2. secret_scanning.yml
  3. branches-ignore:
  4. decrypt_secret.sh
Show answer and explanation

Correct answer: A. paths-ignore:

The YAML syntax `paths-ignore:` is used to exclude certain files from secret scanning. This configuration is placed in the repository's settings or workflow files to specify patterns of files and directories that should not be scanned for secrets.

Why the other options are wrong

  • B. secret_scanning.yml is a filename, not YAML syntax for exclusion configuration.
  • C. branches-ignore: is used for branch exclusion in workflows, not for excluding files from secret scanning.
  • D. decrypt_secret.sh is a shell script name and is not YAML syntax for any configuration.

Question 6

Secret scanning will scan:

  1. a continuous integration system.
  2. the GitHub repository.
  3. any Git repository.
  4. external services.
Show answer and explanation

Correct answer: B. the GitHub repository.

Secret scanning scans the GitHub repository. It analyzes the content stored in a GitHub repository, including commit history, branches, and pull requests, to detect exposed secrets and sensitive information.

Why the other options are wrong

  • A. Secret scanning does not scan continuous integration systems; it is limited to GitHub repository content.
  • C. Secret scanning only scans the specific GitHub repository where it is enabled, not arbitrary Git repositories elsewhere.
  • D. Secret scanning does not directly scan external services; it focuses on the content within the GitHub repository.

Question 7

Which of the following features helps to prioritize secret scanning alerts that present an immediate risk?

  1. non-provider patterns
  2. push protection
  3. secret validation
  4. custom pattern dry runs
Show answer and explanation

Correct answer: C. secret validation

Secret validation helps prioritize secret scanning alerts by verifying whether detected secrets are actually valid and active. This reduces alert fatigue by confirming which secrets present an immediate risk versus which are inactive or false positives.

Why the other options are wrong

  • A. Non-provider patterns are a category of patterns but do not specifically help prioritize alerts based on risk level.
  • B. Push protection prevents secrets from being pushed but does not prioritize existing alerts.
  • D. Custom pattern dry runs are used for testing patterns before deployment, not for prioritizing alerts by risk.

Question 8

What do you need to do before you can define a custom pattern for a repository?

  1. Add a secret scanning custom pattern.
  2. Provide match requirements for the secret format.
  3. Enable secret scanning on the repository.
  4. Provide a regular expression for the format of your secret pattern
Show answer and explanation

Correct answer: C. Enable secret scanning on the repository.

You must enable secret scanning on the repository before you can define a custom pattern. Secret scanning is the parent feature that provides the infrastructure and framework within which custom patterns operate.

Why the other options are wrong

  • A. Adding a custom pattern is the action you perform after meeting the prerequisites, not a prerequisite itself.
  • B. While match requirements are specified when defining the pattern, they are not a prerequisite but rather a component of the pattern creation process.
  • D. Providing a regular expression is part of the pattern definition itself, not a prerequisite that must be completed beforehand.

Question 9

Which of the following statements most accurately describes push protection for secret scanning custom patterns?

  1. Push protection is enabled by default for new custom patterns.
  2. Push protection must be enabled for all, or none, of a repository’s custom patterns.
  3. Push protection is not available for custom patterns.
  4. Push protection is an opt-in experience for each custom pattern.
Show answer and explanation

Correct answer: D. Push protection is an opt-in experience for each custom pattern.

Push protection for custom patterns is an opt-in feature that must be explicitly enabled for each individual custom pattern. Organizations can choose which custom patterns should block pushes containing detected secrets, allowing granular control over security enforcement.

Why the other options are wrong

  • A. Push protection is not enabled by default; it requires explicit activation.
  • B. Push protection can be configured independently for each custom pattern, not all-or-nothing.
  • C. Push protection is available for custom patterns, though it must be opted into.

Question 10

Which details do you have to provide to create a custom pattern for secret scanning? Each answer presents part of the solution. (Choose two.)

  1. the secret format
  2. a list of repositories to scan
  3. the name of the pattern
  4. additional match requirements for the secret format
Show answer and explanation

Correct answer: A, C. the secret format; the name of the pattern

Creating a custom pattern requires providing the secret format (which defines the pattern to match) and the name of the pattern (to identify it). The name is essential metadata, and the secret format is the core technical definition. While additional match requirements and repository selection are useful, they are not required details for initial pattern creation.

Why the other options are wrong

  • B. Repository selection is not a required detail when creating a custom pattern; patterns are applied at the organization or repository level separately.
  • D. Additional match requirements are optional enhancements, not required details for creating the pattern.

Question 11

How many alerts are created when two instances of the same secret value are in the same repository?

  1. 4
  2. 2
  3. 3
  4. 1
Show answer and explanation

Correct answer: D. 1

When the same secret value appears multiple times in a repository, GitHub creates only one alert for that secret. GitHub deduplicates alerts based on the secret value itself rather than creating an alert per occurrence. This prevents alert fatigue and makes it easier to manage secret exposure incidents when the same secret has been accidentally committed in multiple locations.

Why the other options are wrong

  • A. GitHub does not create four alerts; the deduplication process ensures a single alert per unique secret value.
  • B. GitHub does not create two alerts; multiple instances of the same secret value result in one consolidated alert.
  • C. GitHub does not create three alerts; the alert count is based on unique secret values, not instance counts.

Question 12

Which of the following workflow events would trigger a dependency review? (Each answer presents a complete solution. Choose two.)

  1. commit
  2. trigger
  3. workflow_dispatch
  4. pull_request
Show answer and explanation

Correct answer: C, D. workflow_dispatch; pull_request

Dependency review workflows are triggered by the `pull_request` event, which allows the review to occur during pull request submission and updates, and the `workflow_dispatch` event, which allows manual triggering of the workflow. The `commit` event is not a valid workflow trigger for dependency review, and `trigger` is not a standard GitHub Actions event name, dependency review is associated with pull request workflows, not arbitrary commit-based triggers.

Why the other options are wrong

  • A. The `commit` event is not a recognized GitHub Actions workflow trigger for dependency review; review happens at the pull request level.
  • B. The `trigger` event is not a valid GitHub Actions event name and is not used for dependency review workflows.

Question 13

Which of the following would raise secret scanning alerts?

  1. GitHub personal access token
  2. server-side request forgery
  3. cross site scripting (XSS)
  4. structured query language (SQL) injection
Show answer and explanation

Correct answer: A. GitHub personal access token

Secret scanning alerts are triggered by the detection of actual secrets and credentials, such as GitHub personal access tokens (A), which represent a real security risk if exposed. Server-side request forgery (B), cross-site scripting (C), and SQL injection (D) are vulnerability types detected by code scanning or SAST tools, not by secret scanning, which specifically looks for exposed credentials and authentication tokens.

Why the other options are wrong

  • B. SSRF is a code vulnerability type, not a secret or credential that secret scanning detects.
  • C. XSS is a code vulnerability type, not a credential or secret.
  • D. SQL injection is a code vulnerability type, not a secret that would trigger secret scanning.

Question 14

Assuming that notification settings and Dependabot alert recipients have not been customized, which user account setting should you use to get an alert when a vulnerability is detected in one of your repositories?

  1. enable all in existing repositories
  2. enable all for Dependabot alerts
  3. enable all for Dependency graph
  4. enable by default for new public repositories
Show answer and explanation

Correct answer: B. enable all for Dependabot alerts

To receive alerts when vulnerabilities are detected in repositories with default notification settings, you must enable Dependabot alerts. This is the user account setting that specifically controls vulnerability detection notifications. Option A enables repositories but doesn't specifically configure alerts, option C enables the dependency graph (which supports alerts but isn't the alert configuration itself), and option D only applies to new public repositories going forward.

Why the other options are wrong

  • A. Enabling existing repositories doesn't specifically configure vulnerability alert notifications.
  • C. The dependency graph enables vulnerability detection but isn't the alert notification setting itself.
  • D. This setting only applies to new public repositories created in the future, not existing ones.

Question 15

A secret scanning alert should be closed as “used in tests” when a secret is:

  1. in a test file.
  2. solely used for tests.
  3. in the readme.md file.
  4. not a secret in the production environment.
Show answer and explanation

Correct answer: B. solely used for tests.

A secret scanning alert should be closed as 'used in tests' when the secret is solely used for testing purposes, meaning it has no real value outside of test environments and poses no actual security risk to production systems. This classification indicates the alert can be safely dismissed because the exposed credential was never intended for or used in production.

Why the other options are wrong

  • A. Being in a test file alone is insufficient; the secret must be used only for tests, not for actual authentication elsewhere.
  • C. A secret in a readme.md file would be exposed publicly and should not be dismissed as a test secret.
  • D. This is too broad; secrets not used in production could still be legitimate production secrets that are simply dormant.

Question 16

Assuming there is no custom Dependabot behavior configured, where possible, what does Dependabot do after sending an alert about a vulnerable dependency in a repository?

  1. scans repositories for vulnerable dependencies on a schedule and adds those files to a manifest
  2. scans any push to all branches and generates an alert for each vulnerable repository
  3. creates a pull request to upgrade the vulnerable dependency to the minimum possible secure version
  4. constructs a graph of all the repository’s dependencies and public dependents for the default branch
Show answer and explanation

Correct answer: C. creates a pull request to upgrade the vulnerable dependency to the minimum possible secure version

After sending an alert about a vulnerable dependency, Dependabot automatically creates a pull request to upgrade the vulnerable dependency to the minimum secure version where possible. This automated remediation reduces the time between vulnerability detection and resolution. Dependabot does not add files to manifests, does not scan only on push events, and does not construct dependency graphs as part of its alert response, those are separate features.

Why the other options are wrong

  • A. Dependabot does not add files to manifests; it creates pull requests with version updates to existing dependency declarations.
  • B. Dependabot scans on a regular schedule and responds to dependency changes, not solely on push events to all branches.
  • D. Constructing dependency graphs is a separate feature; Dependabot's response to alerts is to create pull requests for upgrades.

Question 17

Where in the repository can you give additional users access to secret scanning alerts?

  1. Secrets
  2. Insights
  3. Settings
  4. Security
Show answer and explanation

Correct answer: C. Settings

Repository Settings is where administrators configure access permissions for secret scanning alerts. Through Settings, users can manage who has visibility and access to sensitive security information discovered by secret scanning. The Secrets, Insights, and Security tabs serve different purposes and are not the configuration location for managing alert access.

Why the other options are wrong

  • A. The Secrets section stores repository secrets but is not where alert access is configured.
  • B. Insights provides repository analytics and statistics, not alert access management.
  • D. The Security tab shows security information but access controls are configured in Settings.

Question 18

Which of the following Watch settings could you use to get Dependabot alert notifications? Each answer presents part of the solution. (Choose two.)

  1. the Participating and @mentions setting
  2. the Custom setting
  3. the Ignore setting
  4. the All Activity setting
Show answer and explanation

Correct answer: B, D. the Custom setting; the All Activity setting

To receive Dependabot alert notifications through Watch settings, you can use the Custom setting to specifically select which events trigger notifications (including Dependabot alerts), and the All Activity setting which captures all repository activity including Dependabot alerts. Option A (Participating and @mentions) only notifies on direct participation or mentions, and option C (Ignore) explicitly disables notifications.

Why the other options are wrong

  • A. The Participating and @mentions setting only notifies on direct involvement, not all Dependabot alerts.
  • C. The Ignore setting disables notifications rather than enabling them.

Question 19

What filter or sort settings can be used to prioritize the secret scanning alerts that present the most risk?

  1. Sort to display the oldest first.
  2. Filter to display active secrets.
  3. Select only the custom patterns.
  4. Sort to display the newest first.
Show answer and explanation

Correct answer: B. Filter to display active secrets.

Filtering to display only active secrets prioritizes the most critical alerts, as active secrets still pose an immediate security risk. An active secret means the credential remains valid and functional, representing higher risk than revoked or invalidated secrets. Sorting by date or selecting custom patterns does not effectively prioritize based on risk level.

Why the other options are wrong

  • A. Sorting by oldest first does not prioritize based on risk; older secrets may be less critical than recent ones.
  • C. Selecting only custom patterns does not relate to risk prioritization and may exclude important default patterns.
  • D. Sorting by newest first shows recent alerts but does not account for whether secrets are still active and pose risk.

Question 20

What is a security policy?

  1. a security alert issued to a community in response to a vulnerability
  2. a file in a GitHub repository that provides instructions to users about how to report a security vulnerability
  3. an alert about dependencies that are known to contain security vulnerabilities
  4. an automatic detection of security vulnerabilities and coding errors in new or modified code
Show answer and explanation

Correct answer: B. a file in a GitHub repository that provides instructions to users about how to report a security vulnerability

A security policy is a file in a GitHub repository (typically named SECURITY.md) that provides clear instructions to users and security researchers about how to responsibly report security vulnerabilities. This file establishes a framework for coordinated disclosure and responsible reporting.

Why the other options are wrong

  • A. A security alert is a notification about a specific vulnerability, not the policy document itself.
  • C. That describes a Dependabot alert about vulnerable dependencies, not a security policy.
  • D. That describes code scanning, an automated feature that detects vulnerabilities, not a policy.

Question 21

Assuming that no custom Dependabot behavior is configured, who has the ability to merge a pull request created via Dependabot security updates?

  1. a repository member of an enterprise organization
  2. an enterprise administrator
  3. a user who has read access to the repository
  4. a user who has write access to the repository
Show answer and explanation

Correct answer: D. a user who has write access to the repository

A user with Write access to the repository can merge pull requests created by Dependabot security updates. Write access is the standard permission level required to merge pull requests. Repository members of enterprise organizations (option A) may not have write access, enterprise administrators (option B) have broader but unnecessary permissions for this task, and Read access (option C) is insufficient for merging.

Why the other options are wrong

  • A. Enterprise organization membership doesn't automatically grant write/merge permissions.
  • B. Enterprise administrators have broader permissions than necessary for merging a single repository's PRs.
  • C. Read access does not include permissions to merge pull requests.

Question 22

Which security feature shows a vulnerable dependency in a pull request?

  1. dependency review
  2. dependency graph
  3. Dependabot alert
  4. the repository’s Security tab
Show answer and explanation

Correct answer: A. dependency review

Dependency review is the GitHub security feature that displays vulnerable dependencies detected in pull requests before they are merged. It provides a detailed analysis of dependency changes and highlights known vulnerabilities in the proposed additions or updates. The dependency graph shows all dependencies but does not specifically highlight vulnerabilities in PRs, Dependabot alerts are notifications rather than the review feature itself, and the Security tab shows historical alerts but is not the active PR review mechanism.

Why the other options are wrong

  • B. The dependency graph displays all dependencies in a repository but does not show vulnerabilities specifically within a pull request review context.
  • C. Dependabot alerts are notifications about vulnerabilities but are not the review feature that appears inline during pull request review.
  • D. The Security tab displays alerts and information but is not the specific feature that shows vulnerable dependencies during the pull request process.

Question 23

Secret scanning will ignore a secret_scanning.yml file that

  1. contains 1,000 or more entries.
  2. has 1,000 or more directories
  3. is 1 MB or larger
  4. is 100 KB or larger.
Show answer and explanation

Correct answer: C. is 1 MB or larger

Secret scanning ignores a secret_scanning.yml file that is 1 MB or larger. This file size limit prevents performance issues and ensures the scanning process remains efficient when processing configuration files.

Why the other options are wrong

  • A. Entry count is not the limiting factor for secret_scanning.yml files.
  • B. Directory count is not the limiting factor for secret_scanning.yml files.
  • D. The actual threshold is 1 MB, not 100 KB.

Question 24

If notification and alert recipients are not customized, which users receive notifications about new Dependabot alerts in an affected repository?

  1. users with Maintain privileges to the repository
  2. users with Read permissions to the repository
  3. users with Write permissions to the repository
  4. users with Admin privileges to the repository
Show answer and explanation

Correct answer: C. users with Write permissions to the repository

By default, Dependabot alert notifications in GitHub are sent to users who have Write permissions or higher to the repository. Write permissions include the ability to receive security-related notifications about vulnerabilities in the codebase, which is essential for developers who can directly address and merge fixes for Dependabot alerts.

Why the other options are wrong

  • A. Maintain privileges is a role between Write and Admin, but Write is the minimum threshold for default Dependabot notifications.
  • B. Read permissions do not include notification eligibility for Dependabot alerts by default; a higher permission level is required.
  • D. Admin privileges would receive notifications, but this is more restrictive than necessary since Write permissions are sufficient and more inclusive of the team members who need these alerts.

Question 25

In a private repository, what minimum requirements does GitHub need to generate a dependency graph? (Each answer presents part of the solution. Choose two.)

  1. read-only access to all the repository’s files
  2. dependency graph enabled at the organization level for all new private repositories
  3. write access to the dependency manifest and lock files for an enterprise
  4. read-only access to the dependency manifest and lock files for a repository
Show answer and explanation

Correct answer: B, D. dependency graph enabled at the organization level for all new private repositories; read-only access to the dependency manifest and lock files for a repository

GitHub requires read-only access to dependency manifest and lock files in the repository (D) to parse dependencies, and the dependency graph feature must be enabled at the organization level for private repositories (B). Write access (C) is not necessary as GitHub only needs to read these files. Option A specifies all repository files, but GitHub only requires access to dependency manifest and lock files.

Why the other options are wrong

  • A. GitHub only needs access to dependency manifest and lock files, not all repository files.
  • C. Write access is not required; read-only access is sufficient for GitHub to analyze dependencies.

25 questions in. Want the rest? The first half of the pack, free by email · The full pack

Question 26

What is the first step you should take to fix an alert in secret scanning?

  1. Remove the secret in a commit to the main branch.
  2. Archive the repository.
  3. Update your dependencies.
  4. Revoke the alert if the secret is still valid.
Show answer and explanation

Correct answer: D. Revoke the alert if the secret is still valid.

The first step in addressing a secret scanning alert is to revoke the secret if it remains valid and active. Revocation immediately invalidates the compromised credential at the service provider, preventing unauthorized access. This must be done before other remediation steps. Only after revocation should the secret be removed from the codebase and services updated.

Why the other options are wrong

  • A. Removing the secret in a commit is a later step; revocation must happen first to immediately neutralize the threat.
  • B. Archiving the repository does not address the compromised secret or revoke its validity.
  • C. Updating dependencies is unrelated to secret scanning alerts and does not address the compromised credential.

Question 27

Assuming that notification and alert recipients are not customized, what does GitHub do when it identifies a vulnerable dependency in a repository where Dependabot alerts are enabled? (Each answer presents part of the solution. Choose two.)

  1. It generates a Dependabot alert and displays it on the Security tab for the repository.
  2. It consults with a security service and conducts a thorough vulnerability review.
  3. It generates Dependabot alerts by default for all private repositories.
  4. It notifies the repository administrators about the new alert.
Show answer and explanation

Correct answer: A, D. It generates a Dependabot alert and displays it on the Security tab for the repository; It notifies the repository administrators about the new alert.

When Dependabot alerts are enabled and a vulnerable dependency is detected, GitHub generates a Dependabot alert and displays it on the Security tab of the repository, and it notifies repository administrators about the new alert through GitHub's notification system. A security service consultation is not part of the automated process, and alerts are not generated by default for all private repositories, they are only generated when vulnerabilities are actually found and the feature is enabled.

Why the other options are wrong

  • B. GitHub does not consult external security services as part of its standard Dependabot alert generation; it uses its own vulnerability database.
  • C. Dependabot does not generate alerts for all private repositories by default; it only generates alerts when actual vulnerable dependencies matching known CVEs are detected.

Question 28

Where can you find a deleted line of code that contained a secret value?

  1. Issues
  2. Dependency graph
  3. Commits
  4. Insights
Show answer and explanation

Correct answer: C. Commits

Deleted lines of code containing secret values can be found in the commit history. Even after deletion, commits retain the full history of changes, including removed lines with sensitive data. Issues (option A) don't store code history, the Dependency graph (option B) tracks dependencies not code content, and Insights (option D) provides statistics rather than detailed code line access.

Why the other options are wrong

  • A. Issues do not contain code history or show deleted lines of code.
  • B. The dependency graph tracks package dependencies, not code content or deleted lines.
  • D. Insights provides repository statistics and trends, not historical code content access.

Question 29

Assuming that no custom patterns are configured, what type of secret is detected by secret scanning?

  1. usernames
  2. sealed boxes
  3. Personal Identifiable Information (PII)
  4. private keys
Show answer and explanation

Correct answer: D. private keys

GitHub secret scanning detects private keys and other cryptographic secrets using pattern matching against known secret formats. Without custom patterns configured, the system focuses on detecting high-confidence secrets like private keys, API keys, and similar credentials. Usernames, PII, and sealed boxes are not detected by default secret scanning patterns.

Why the other options are wrong

  • A. Usernames alone are not detected by default secret scanning patterns.
  • B. Sealed boxes are not a standard secret type detected by GitHub secret scanning.
  • C. PII detection requires additional configuration beyond the default secret scanning feature.

Question 30

Who can fix a code scanning alert on a private repository?

  1. users who have the security manager role within the repository
  2. users who have Write access to the repository
  3. users who have the Triage role within the repository
  4. users who have Read permissions within the repository
Show answer and explanation

Correct answer: B. users who have Write access to the repository

Users with Write access to a repository can fix code scanning alerts. Write access is the permission level required to dismiss, reopen, or resolve security alerts on private repositories. The security manager role (option A) is not a standard GitHub role, the Triage role (option C) allows reviewing but not fixing alerts, and Read permissions (option D) are insufficient for alert management.

Why the other options are wrong

  • A. Security manager is not a standard GitHub repository role with alert-fixing permissions.
  • C. The Triage role allows viewing and commenting but not fixing or dismissing alerts.
  • D. Read-only access does not grant permissions to modify alert status.

Question 31

By default, who will receive an e-mail when a secret has been detected in a repository? Each answer presents a complete solution. (Choose two.)

  1. users with the Maintain repository role
  2. user who committed the secret
  3. users with the Write repository role
  4. users with the Admin repository role
  5. security analyst
Show answer and explanation

Correct answer: B, D. user who committed the secret; users with the Admin repository role

By default, when a secret is detected, email notifications are sent to the user who committed the secret and users with the Admin repository role. These two groups represent both the responsible party and the organization's security leadership, enabling appropriate response and remediation.

Why the other options are wrong

  • A. Users with the Maintain role do not receive notifications by default.
  • C. Users with the Write role do not receive notifications by default.
  • E. Security analysts are not a default notification recipient group.

Question 32

Which of the following benefits do code scanning, secret scanning, and dependency review provide?

  1. Automatically raise pull requests, which reduces your exposure to older versions of dependencies.
  2. View alerts about dependencies that are known to contain security vulnerabilities.
  3. Search for potential security vulnerabilities, detect secrets, and show the full impact of changes to dependencies.
  4. Confidentially report security vulnerabilities and privately discuss and fix security vulnerabilities in your repository’s code.
Show answer and explanation

Correct answer: C. Search for potential security vulnerabilities, detect secrets, and show the full impact of changes to dependencies.

Code scanning, secret scanning, and dependency review together provide comprehensive security coverage by searching for potential vulnerabilities in code, detecting exposed secrets, and analyzing the full impact of dependency changes. This combination creates a complete picture of security risks.

Why the other options are wrong

  • A. These features detect and report vulnerabilities but do not automatically raise pull requests.
  • B. That specifically describes Dependabot alerts alone, not the combined benefit of all three features.
  • D. That describes the security advisory process and responsible disclosure, not the primary function of these scanning features.

That was 32 of 127.

The full GitHub GH-500 Advanced Security pack has all 127 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.

Get the full pack

Not ready yet? Get the first 56 free as one PDF by email. Get the Half Pack →