An organization has a critical application that is deployed frequently. They want to implement a gate-based security strategy without slowing down deployments. They have code scanning and secret scanning enabled. What is the most effective way to enforce a gate?

Use a security campaign to track alerts and close them after release.

Require code scanning to pass with no critical or high severity alerts before merging to the main branch.

Run code scanning only on a weekly basis.

Require a manual security approval before each deployment.

A security team wants to use security campaigns to reduce risk. They have identified a set of code scanning alerts that need to be fixed. What is the primary benefit of using a security campaign for this task?

It blocks merging until all alerts are resolved.

It automatically fixes all alerts without developer involvement.

It provides a structured workflow to assign, track, and prioritize remediation.

It generates new alerts for the security team.

A company wants to integrate security checks into their CI/CD pipeline so that vulnerabilities are caught early in the development lifecycle. They use GitHub Actions for builds and want to ensure that code is scanned for vulnerabilities before it is merged. Which combination of features should they implement?

Configure Dependabot security updates to auto-merge.

Use a pre-commit hook to run a linter.

Enable secret scanning and Dependabot alerts only.

Enable code scanning with CodeQL and require it to pass in branch protection.

GitHubAdvanced Security (GH-500)

Domain 1Objective 2

Apply Secure SDLC and Security Strategies GH-500 Practice Questions (Page 1)

Part of the Describe GitHub Security suites, features, and ecosystem domain, which accounts for 15-20% of the GH-500 exam.

23questions here

5free pages

4concepts

15-20%of the exam

Questions 1–5

1foundation · easy
A team wants to identify a SQL injection vulnerability in their application code during development. Which GitHub Advanced Security feature is most appropriate for this task?
Select an answer first
2expert · hard
An organization has a critical application that is deployed frequently. They want to implement a gate-based security strategy without slowing down deployments. They have code scanning and secret scanning enabled. What is the most effective way to enforce a gate?
Select an answer first
3application · medium
A security team wants to use security campaigns to reduce risk. They have identified a set of code scanning alerts that need to be fixed. What is the primary benefit of using a security campaign for this task?
Select an answer first
4application · medium
A company wants to integrate security checks into their CI/CD pipeline so that vulnerabilities are caught early in the development lifecycle. They use GitHub Actions for builds and want to ensure that code is scanned for vulnerabilities before it is merged. Which combination of features should they implement?
Select an answer first
5foundation · easy
A team enforces mandatory code scanning and secret scanning checks before a release can be deployed. Which security strategy does this represent?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GH-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitHub. “GH-500” is a trademark of its owner, used for identification only.

Apply Secure SDLC and Security Strategies GH-500 Practice Questions (Page 1)

Questions 1–5

A team wants to identify a SQL injection vulnerability in their application code during development. Which GitHub Advanced Security feature is most appropriate for this task?

An organization has a critical application that is deployed frequently. They want to implement a gate-based security strategy without slowing down deployments. They have code scanning and secret scanning enabled. What is the most effective way to enforce a gate?

A security team wants to use security campaigns to reduce risk. They have identified a set of code scanning alerts that need to be fixed. What is the primary benefit of using a security campaign for this task?

A team enforces mandatory code scanning and secret scanning checks before a release can be deployed. Which security strategy does this represent?

Keep studying — Describe GitHub Security suites, features, and ecosystem