Free GitHub GH-500 Advanced Security practice questions

10 free GitHub GH-500 Advanced Security practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 127 questions. Work through them, then open each answer to check your reasoning.

Get all 127 questions (US$39) · Download these 10 as a PDF

Question 1

A secret scanning alert should be closed as “used in tests” when a secret is:

  1. in a test file.
  2. solely used for tests.
  3. in the readme.md file.
  4. not a secret in the production environment.
Show answer and explanation

Correct answer: B. solely used for tests.

The 'used in tests' closure reason applies specifically when a secret is solely used for testing purposes, meaning it has no actual value in production and poses no real security risk. This classification indicates the alert is a false positive in terms of actual exposure.

Why the other options are wrong

  • A. Being in a test file doesn't guarantee the secret is only used for tests; it could still be a valid secret.
  • C. Secrets in readme.md files should be treated as exposed secrets, not test-only secrets, regardless of documentation context.
  • D. A secret not used in production could still be a real secret used in staging or development environments.

Question 2

What happens when you enable secret scanning on a private repository?

  1. Repository administrators can view Dependabot alerts.
  2. Dependency review, secret scanning, and code scanning are enabled.
  3. Your team is subscribed to security alerts.
  4. GitHub performs a read-only analysis on the repository.
Show answer and explanation

Correct answer: D. GitHub performs a read-only analysis on the repository.

When secret scanning is enabled on a private repository, GitHub performs a read-only analysis of the repository's content to detect secrets. This non-intrusive analysis scans the codebase without modifying it or automatically enabling other features.

Why the other options are wrong

  • A. Enabling secret scanning does not automatically enable Dependabot alerts or grant Dependabot-specific permissions.
  • B. Secret scanning alone does not automatically enable dependency review or code scanning; these are separate features that must be enabled independently.
  • C. Enabling secret scanning does not automatically subscribe the team to security alerts; subscription settings are configured separately.

Question 3

Which of the following statements best describes secret scanning push protection?

  1. Buttons for sensitive actions in the GitHub UI are disabled.
  2. Commits that contain secrets are blocked before code is added to the repository.
  3. Users need to reply to a 2FA challenge before any push events.
  4. Secret scanning alerts must be closed before a branch can be merged into the repository.
Show answer and explanation

Correct answer: B. Commits that contain secrets are blocked before code is added to the repository.

Secret scanning push protection is a preventative feature that blocks commits containing detected secrets before they are pushed to the repository. This protects sensitive information from ever reaching the repository by intercepting the push operation at the client side.

Why the other options are wrong

  • A. Push protection blocks commits themselves, not UI buttons; it operates at the git push level, not the GitHub UI level.
  • C. Push protection does not involve 2FA challenges; it uses pattern matching to detect secrets and blocks the push directly.
  • D. Push protection blocks commits before they are added to the repository, not after via merge gate requirements on branches.

Question 4

What is a security policy?

  1. a security alert issued to a community in response to a vulnerability
  2. a file in a GitHub repository that provides instructions to users about how to report a security vulnerability
  3. an alert about dependencies that are known to contain security vulnerabilities
  4. an automatic detection of security vulnerabilities and coding errors in new or modified code
Show answer and explanation

Correct answer: B. a file in a GitHub repository that provides instructions to users about how to report a security vulnerability

A security policy is a SECURITY.md file in a GitHub repository that provides clear instructions for users on how to responsibly report security vulnerabilities. It establishes a channel for private vulnerability disclosure rather than public issue reporting.

Why the other options are wrong

  • A. A security alert is a notification about a vulnerability, not a documented policy file.
  • C. That describes a Dependabot alert about known vulnerable dependencies, not a security policy.
  • D. That describes the functionality of code scanning or secret scanning tools, not a security policy document.

Question 5

Which of the following information can be found in a repository’s Security tab?

  1. number of alerts per GHAS feature
  2. GHAS settings
  3. access management
  4. two-factor authentication (2FA) options
Show answer and explanation

Correct answer: A. number of alerts per GHAS feature

The Security tab displays the number of alerts for each GHAS (GitHub Advanced Security) feature, including code scanning, secret scanning, and Dependabot alerts. This provides a dashboard summary of security findings across the repository.

Why the other options are wrong

  • B. GHAS settings are configured elsewhere in repository settings, not displayed as a count in the Security tab.
  • C. Access management and permissions are found in the Settings or Collaborators sections, not the Security tab.
  • D. Two-factor authentication options are part of personal account settings, not repository-level security features visible in the Security tab.

Question 6

Which of the following benefits do code scanning, secret scanning, and dependency review provide?

  1. Automatically raise pull requests, which reduces your exposure to older versions of dependencies.
  2. View alerts about dependencies that are known to contain security vulnerabilities.
  3. Search for potential security vulnerabilities, detect secrets, and show the full impact of changes to dependencies.
  4. Confidentially report security vulnerabilities and privately discuss and fix security vulnerabilities in your repository’s code.
Show answer and explanation

Correct answer: C. Search for potential security vulnerabilities, detect secrets, and show the full impact of changes to dependencies.

Code scanning, secret scanning, and dependency review work together to provide comprehensive security analysis: code scanning searches for vulnerabilities and coding errors, secret scanning detects exposed secrets, and dependency review shows the full security impact of dependency changes on pull requests.

Why the other options are wrong

  • A. These features detect and alert about vulnerabilities but do not automatically raise pull requests; Dependabot handles automated dependency updates.
  • B. That describes only Dependabot alerts, not the combined benefits of all three GHAS features.
  • D. That describes the security policy and private vulnerability reporting process, not the scanning and review features themselves.

Question 7

Which alerts do you see in the repository’s Security tab? Each answer presents part of the solution. (Choose three.)

  1. secret scanning alerts
  2. Dependabot alerts
  3. code scanning alerts
  4. security status alerts
  5. repository permissions
Show answer and explanation

Correct answer: A, B, C

A. secret scanning alerts B. Dependabot alerts C. code scanning alerts The repository's Security tab displays three main categories of alerts: secret scanning alerts (detected exposed secrets), Dependabot alerts (known vulnerabilities in dependencies), and code scanning alerts (detected code vulnerabilities and errors). These represent the primary GHAS findings presented to users.

Why the other options are wrong

  • D. Security status alerts is not a distinct alert category in the Security tab; alerts are organized by feature type (secret, dependency, code).
  • E. Repository permissions are access control settings found elsewhere in repository settings, not security alerts displayed in the Security tab.

Question 8

A dependency has a known vulnerability.

What does the warning message include?

  1. an easily understandable visualization of dependency change
  2. a brief description of the vulnerability
  3. how many projects use these components
  4. the security impact of these changes
Show answer and explanation

Correct answer: B. a brief description of the vulnerability

When a dependency has a known vulnerability, the warning message includes a brief description of the vulnerability, helping developers quickly understand the nature and scope of the security risk without overwhelming detail.

Why the other options are wrong

  • A. Dependency visualizations show the tree structure of dependencies, not the security impact of individual vulnerabilities.
  • C. The number of projects using a component is not included in vulnerability warnings; warnings focus on the specific risk to the current repository.
  • D. While security impact is important, the standard warning message provides a brief description rather than detailed impact analysis; full details can be accessed by viewing the full alert.

Question 9

Which features require GitHub Advanced Security to be enabled for internal and private repositories in an organization? Each correct answer presents part of the solution. (Choose two.)

  1. security policy
  2. secret scanning
  3. packages
  4. dependency review
Show answer and explanation

Correct answer: B, D

B. secret scanning D. dependency review GitHub Advanced Security enables secret scanning and dependency review for internal and private repositories. Secret scanning detects exposed credentials and API keys, while dependency review analyzes pull requests for vulnerable dependencies. These features require the Advanced Security license for non-public repositories, whereas security policy and packages are available under standard GitHub features.

Why the other options are wrong

  • A. Security policy is a standard GitHub feature available without Advanced Security.
  • C. Packages functionality does not require Advanced Security to be enabled.

Question 10

Which of the following is the best way to dispose of a compromised secret?

  1. Create a new secret.
  2. Revoke the secret.
  3. Update any services that use the secret.
  4. Remove the secret from the code base.
Show answer and explanation

Correct answer: B. Revoke the secret.

The best practice for handling a compromised secret is to revoke it immediately, which deactivates the secret at its source and prevents further unauthorized access. While creating a new secret, updating services, and removing code are all necessary follow-up steps, revoking the compromised secret is the critical first action that stops active threats.

Why the other options are wrong

  • A. Creating a new secret alone does not address the compromised credential still being valid.
  • C. Updating services is a follow-up step, not the primary disposal method.
  • D. Removing from the codebase does not invalidate a secret already exposed in version history.

That was 10 of 127.

The full GitHub GH-500 Advanced Security pack has all 127 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.

Get the full pack