Configure Policies, Permissions, and Integrations GH-500 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary function of Dependabot version updates?

   • ATo scan code for secret tokens
   • BTo automatically fix security vulnerabilities in code
   • CTo automatically create pull requests that update dependencies to newer versions
   • DTo enforce code review policies on pull requests
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   You need to send security alert events to an internal SIEM system for monitoring. The SIEM expects to receive events via a specific endpoint. What should you configure in GitHub to achieve this?

   • ASet up a webhook in the repository or organization that sends security alert events to the SIEM endpoint.
   • BUse GitHub Actions to poll the security alerts API and send them to the SIEM.
   • CUse the GitHub API to manually export alerts and send them to the SIEM.
   • DConfigure email notifications to the SIEM's email address.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   Your organization uses a third-party code scanning tool that is not a GitHub Action. You want to integrate its results into GitHub Advanced Security. What is the most appropriate way to do this?

   • AConfigure a webhook to send the tool's results to GitHub.
   • BUse Dependabot to import the results.
   • CUse the GitHub API to upload the tool's results as code scanning alerts.
   • DManually create issues for each finding.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   Your organization uses GitHub Advanced Security. The security team wants secret scanning alerts for the `prod-config` repository to be triaged by the DevOps team, while dependency vulnerabilities should be handled by the application security team. Both teams need to see the alerts, but only the assigned team should be able to change the alert state. What should you configure?

   • AConfigure a webhook to send alerts to each team's Slack channel and let them coordinate manually.
   • BUse the alert assignment feature to assign secret scanning alerts to the DevOps team and dependency alerts to the application security team, ensuring both teams have read access.
   • CCreate two separate repositories, one for each team, and mirror the code between them.
   • DAdd both teams to the repository with write access, then use issue assignment to assign alerts to the appropriate team.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   Your organization wants to generate an SBOM for each release of your software. You are using GitHub Actions for your CI/CD. What is the most efficient way to generate and publish an SBOM?

   • AEnable a GitHub setting that automatically generates SBOMs.
   • BUse a GitHub Actions workflow that runs a tool like Syft or CycloneDX to generate the SBOM and upload it as a release asset.
   • CManually generate the SBOM using a local tool and upload it to the release.
   • DUse Dependabot to generate the SBOM.
   Reveal Solution Discussion Select an answer first