Your organization wants to enforce a security policy that requires all repositories to have secret scanning enabled and to block commits that contain secrets. You need to apply this policy across the entire organization. What is the most efficient way to enforce this?

Create a repository-level ruleset for each repository

Send an email to all repository admins asking them to enable secret scanning

Use a security campaign to enforce the policy

Create an organization-level ruleset that requires secret scanning and blocks secrets

Your organization has a backlog of 500 dependency alerts across 20 repositories. You need to reduce this backlog in a coordinated way, involving multiple teams. What is the most effective approach?

Create a security campaign to track and manage the remediation of the alerts

Use the API to automatically dismiss all low-severity alerts

Create a new branch protection rule to block all dependency alerts

Assign all alerts to a single team and let them work through the backlog

Why is it important to assign ownership of security alerts to specific teams or individuals in GitHub Advanced Security?

To prevent all users from seeing the alert

To automatically close alerts after a set time

To increase the severity level of the alert

To ensure accountability and tracking of alert resolution

Your organization requires that all code changes be reviewed by at least two people before merging, and that the security team must approve any changes to security-sensitive files. What is the best way to enforce this?

Ask the security team to manually review all pull requests

Create a ruleset that requires two reviewers for all files

Use a security campaign to track reviews

Create a branch protection rule that requires two reviewers and a code owner review for security-sensitive files

GitHubAdvanced Security (GH-500)

Domain 5Objective 4

Collaborate Across Roles and Enforce Governance GH-500 Practice Questions (Page 3)

Part of the Security operations: best practices, prioritization, and remediation domain, which accounts for 15-20% of the GH-500 exam.

28questions here

6free pages

8concepts

15-20%of the exam

Questions 11–15

11application · medium
Your organization wants to enforce a security policy that requires all repositories to have secret scanning enabled and to block commits that contain secrets. You need to apply this policy across the entire organization. What is the most efficient way to enforce this?
Select an answer first
12application · medium
Your organization has a backlog of 500 dependency alerts across 20 repositories. You need to reduce this backlog in a coordinated way, involving multiple teams. What is the most effective approach?
Select an answer first
13foundation · easy
Why is it important to assign ownership of security alerts to specific teams or individuals in GitHub Advanced Security?
Select an answer first
14application · medium
Your organization requires that all code changes be reviewed by at least two people before merging, and that the security team must approve any changes to security-sensitive files. What is the best way to enforce this?
Select an answer first
15foundation · easy
Which GitHub feature allows team members to discuss a specific security alert directly within the context of the alert?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GH-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitHub. “GH-500” is a trademark of its owner, used for identification only.