Define Governance, Access, and Code Security Workflows GH-500 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An organization wants to ensure that only the security team can manage security alerts, while developers should be able to view alerts but not dismiss them. The security team is a GitHub team called 'security-team'. What is the most efficient way to configure this?

   • AUse a ruleset to restrict who can dismiss alerts to the 'security-team'.
   • BSet the organization's default permission for 'Dismiss alerts' to 'Security managers only' and add the 'security-team' to the 'security_manager' role.
   • CAdd the 'security-team' to the 'security_manager' role in the organization.
   • DCreate a custom repository role with 'Dismiss alerts' permission set to 'No' and assign it to all developers.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the purpose of defining exceptions for specific users or teams in a GitHub ruleset?

   • ATo prevent those users or teams from accessing the repository.
   • BTo give those users or teams additional permissions to modify the ruleset.
   • CTo automatically apply the ruleset to those users or teams.
   • DTo allow those users or teams to bypass the ruleset's enforcement for certain actions.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which automation method is commonly used to apply security policies consistently across multiple repositories in GitHub?

   • AUsing GitHub Pages to host security policies.
   • BUsing GitHub Discussions to communicate security policies.
   • CManually configuring each repository through the web interface.
   • DGitHub Actions workflows that use the GitHub API to configure repository settings.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security team wants to automate the assignment of the 'security_manager' role to users who complete a security training course. They have a system that tracks training completion and can trigger a webhook. What is the most efficient way to automate this?

   • AUse GitHub's built-in role assignment feature to automatically assign roles based on training completion.
   • BManually add users to the 'security_manager' team after they complete training.
   • CUse the GitHub API to add users to the 'security_manager' team when the webhook is received.
   • DUse a GitHub Action that runs on a schedule and checks the training system for completed users.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the scope of an organization-level security policy (ruleset) in GitHub?

   • AIt applies only to repositories that are publicly visible.
   • BIt applies only to repositories that have been explicitly selected by an administrator.
   • CIt applies only to repositories created after the policy is enabled.
   • DIt applies to all repositories owned by the organization, unless overridden by an enterprise-level policy.
   Reveal Solution Discussion Select an answer first