A large enterprise wants to implement a secure SDLC across hundreds of repositories. They want to ensure that security checks are consistent and that security debt is reduced over time. They also want to avoid overwhelming developers with too many alerts. Which strategy is most effective?

Let each team decide which security features to enable.

Enable security features at the organization level, use security campaigns for prioritization, and tune rules to reduce noise.

Enable all security features on all repositories with default settings.

Focus only on critical repositories and ignore the rest.

A team is debating between a prevention-first and a gate-based security strategy. They want to ensure that no vulnerable code is deployed to production, but they also want to minimize friction for developers. Which strategy best balances these concerns?

Use a prevention-first approach with code scanning on pull requests and a gate-based check on the main branch.

Use only a prevention-first approach with no final gate.

Use only a gate-based approach with a security review before each release.

Disable all automated checks and rely on developer training.

A security team wants to distinguish between secret protection and code security to allocate resources effectively. Which statement correctly describes the difference?

Secret protection prevents credential leaks, while code security finds vulnerabilities in code.

Secret protection is only for cloud credentials, while code security is only for web vulnerabilities.

Secret protection scans for vulnerabilities in code, while code security blocks secrets.

Both secret protection and code security use the same scanning engine.

A security team has identified hundreds of open code scanning alerts across multiple repositories. They want to systematically reduce this security debt by assigning remediation tasks to developers. Which GitHub Advanced Security feature should they use?

Create a security campaign to track and assign alerts.

Use a branch protection rule to block merging until all alerts are closed.

Configure a webhook to send alerts to a chat channel.

Enable Dependabot security updates.

A development team wants to prevent secrets from reaching the main branch. They currently rely on a pre-commit hook that scans for common patterns, but developers often bypass it with --no-verify. They also have secret scanning enabled on the repository, but it only alerts after a push. Which additional control should they implement to enforce a prevention-first approach?

Create a code scanning workflow that runs on pull_request_target.

Enable push protection for secret scanning on the repository.

Add a branch protection rule requiring a pull request review.

Configure Dependabot alerts to monitor the default branch.

GitHubAdvanced Security (GH-500)

Domain 1Objective 2

Apply Secure SDLC and Security Strategies GH-500 Practice Questions (Page 3)

Part of the Describe GitHub Security suites, features, and ecosystem domain, which accounts for 15-20% of the GH-500 exam.

23questions here

5free pages

4concepts

15-20%of the exam

Questions 11–15

11expert · hard
A large enterprise wants to implement a secure SDLC across hundreds of repositories. They want to ensure that security checks are consistent and that security debt is reduced over time. They also want to avoid overwhelming developers with too many alerts. Which strategy is most effective?
Select an answer first
12application · medium
A team is debating between a prevention-first and a gate-based security strategy. They want to ensure that no vulnerable code is deployed to production, but they also want to minimize friction for developers. Which strategy best balances these concerns?
Select an answer first
13application · easy
A security team wants to distinguish between secret protection and code security to allocate resources effectively. Which statement correctly describes the difference?
Select an answer first
14application · medium
A security team has identified hundreds of open code scanning alerts across multiple repositories. They want to systematically reduce this security debt by assigning remediation tasks to developers. Which GitHub Advanced Security feature should they use?
Select an answer first
15application · medium
A development team wants to prevent secrets from reaching the main branch. They currently rely on a pre-commit hook that scans for common patterns, but developers often bypass it with --no-verify. They also have secret scanning enabled on the repository, but it only alerts after a push. Which additional control should they implement to enforce a prevention-first approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GH-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitHub. “GH-500” is a trademark of its owner, used for identification only.