Your organization wants to enforce a policy that all pull requests must include a dependency review check and an SBOM must be generated for every release. You also want to send a notification to a compliance team when a release is published. What is the most efficient way to implement this?

Create one workflow that runs on both pull requests and releases, performing all tasks.

Use a webhook to trigger SBOM generation and dependency review.

Use branch protection to require dependency review and manually generate SBOMs.

Create a single GitHub Actions workflow that runs on pull requests to perform dependency review, and another workflow that runs on release publication to generate an SBOM and send a notification.

Your organization uses a third-party tool that generates a Software Bill of Materials (SBOM) in SPDX format. You want to automatically upload this SBOM to GitHub for each release. What is the most efficient way to achieve this?

Use a GitHub Actions workflow that runs on release publication, generates the SBOM using the third-party tool, and uploads it as a release asset.

Manually upload the SBOM to each release.

Use the GitHub API to upload the SBOM after each release.

Use a webhook to trigger the third-party tool to upload the SBOM.

Your team wants Dependabot to create pull requests for dependency updates, but only for security-related updates. What is the best way to configure this?

Set Dependabot to create PRs for all updates and manually review them.

Configure Dependabot to ignore all non-security updates.

Use a GitHub Actions workflow to filter Dependabot PRs and close non-security ones.

Enable Dependabot security updates and disable version updates.

GitHubAdvanced Security (GH-500)

Domain 3Objective 4

Configure Policies, Permissions, and Integrations GH-500 Practice Questions (Page 5)

Part of the Configure and use supply chain security (formerly Dependabot/Dependency Review) domain, which accounts for 15-20% of the GH-500 exam.

25questions here

5free pages

7concepts

15-20%of the exam

Questions 21–25

21expert · hard
Your organization wants to enforce a policy that all pull requests must include a dependency review check and an SBOM must be generated for every release. You also want to send a notification to a compliance team when a release is published. What is the most efficient way to implement this?
Select an answer first
22foundation · easy
Which file is used to configure Dependabot version updates for a repository?
Select an answer first
23foundation · easy
Which GitHub feature allows you to assign a security alert to a team that is responsible for a specific codebase?
Select an answer first
24expert · hard
Your organization uses a third-party tool that generates a Software Bill of Materials (SBOM) in SPDX format. You want to automatically upload this SBOM to GitHub for each release. What is the most efficient way to achieve this?
Select an answer first
25application · medium
Your team wants Dependabot to create pull requests for dependency updates, but only for security-related updates. What is the best way to configure this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GH-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GitHub. “GH-500” is a trademark of its owner, used for identification only.

Configure Policies, Permissions, and Integrations GH-500 Practice Questions (Page 5)

Questions 21–25

Your organization wants to enforce a policy that all pull requests must include a dependency review check and an SBOM must be generated for every release. You also want to send a notification to a compliance team when a release is published. What is the most efficient way to implement this?

Which file is used to configure Dependabot version updates for a repository?

Which GitHub feature allows you to assign a security alert to a team that is responsible for a specific codebase?

Your organization uses a third-party tool that generates a Software Bill of Materials (SBOM) in SPDX format. You want to automatically upload this SBOM to GitHub for each release. What is the most efficient way to achieve this?

Your team wants Dependabot to create pull requests for dependency updates, but only for security-related updates. What is the best way to configure this?

Keep studying — Configure and use supply chain security (formerly Dependabot/Dependency Review)