A startup wants to adopt a prevention-first security strategy. They want to catch issues as early as possible in the development process. Which practice aligns with this strategy?

Enable secret scanning push protection and code scanning on every pull request.

Run a security review only before a production release.

Conduct a penetration test after each deployment.

Rely on Dependabot alerts to fix vulnerabilities after release.

A security team wants to reduce the number of open secret scanning alerts across the organization. They have identified that many alerts are false positives. What is the best way to handle these false positives while still ensuring real secrets are addressed?

Automatically close all alerts after 30 days.

Disable secret scanning to eliminate all alerts.

Use security campaigns to review and dismiss false positives, and focus on real secrets.

Ignore all alerts because most are false positives.

A team wants to implement a prevention-first strategy for secrets. They want to stop secrets from being pushed to the remote repository. Which GitHub feature should they enable?

Branch protection rules requiring a pull request.

Push protection for secret scanning.

GitHubAdvanced Security (GH-500)

Domain 1Objective 2

Apply Secure SDLC and Security Strategies GH-500 Practice Questions (Page 2)

Part of the Describe GitHub Security suites, features, and ecosystem domain, which accounts for 15-20% of the GH-500 exam.

23questions here

5free pages

4concepts

15-20%of the exam

Questions 6–10

6application · medium
A startup wants to adopt a prevention-first security strategy. They want to catch issues as early as possible in the development process. Which practice aligns with this strategy?
Select an answer first
7foundation · easy
A developer accidentally commits a database connection string that includes a password. Which GitHub Advanced Security feature is specifically designed to detect and alert on this type of exposure?
Select an answer first
8foundation · easy
A security team wants to reduce risk by ensuring that all repositories fix a specific type of vulnerability within a quarter. Which GitHub Advanced Security feature is best suited for this?
Select an answer first
9application · medium
A security team wants to reduce the number of open secret scanning alerts across the organization. They have identified that many alerts are false positives. What is the best way to handle these false positives while still ensuring real secrets are addressed?
Select an answer first
10application · easy
A team wants to implement a prevention-first strategy for secrets. They want to stop secrets from being pushed to the remote repository. Which GitHub feature should they enable?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GH-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitHub. “GH-500” is a trademark of its owner, used for identification only.

Apply Secure SDLC and Security Strategies GH-500 Practice Questions (Page 2)

Questions 6–10

A startup wants to adopt a prevention-first security strategy. They want to catch issues as early as possible in the development process. Which practice aligns with this strategy?

A developer accidentally commits a database connection string that includes a password. Which GitHub Advanced Security feature is specifically designed to detect and alert on this type of exposure?

A security team wants to reduce risk by ensuring that all repositories fix a specific type of vulnerability within a quarter. Which GitHub Advanced Security feature is best suited for this?

A security team wants to reduce the number of open secret scanning alerts across the organization. They have identified that many alerts are false positives. What is the best way to handle these false positives while still ensuring real secrets are addressed?

A team wants to implement a prevention-first strategy for secrets. They want to stop secrets from being pushed to the remote repository. Which GitHub feature should they enable?

Keep studying — Describe GitHub Security suites, features, and ecosystem