Define Governance, Access, and Code Security Workflows GH-500 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security team wants to automate the process of dismissing false-positive alerts. They have a list of alert IDs that are known false positives and want to dismiss them across multiple repositories. What is the most efficient approach?

   • AUse the GitHub REST API to update the alert status to 'dismissed' for each alert ID.
   • BManually dismiss each alert in the GitHub web interface.
   • CUse the GitHub CLI to dismiss alerts in bulk.
   • DUse a GitHub Action that runs on a schedule and dismisses alerts based on a predefined list.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary benefit of using the GitHub API for security governance at scale?

   • AIt automatically fixes security vulnerabilities in code.
   • BIt allows you to automate the configuration of security settings across many repositories.
   • CIt replaces the need for security policies.
   • DIt provides a graphical interface for managing security alerts.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security team needs to automate the process of adding new repositories to the organization's security program. They want to ensure that each new repository has code scanning enabled, secret scanning pushed protection enabled, and the default branch protection ruleset applied. They also want to be notified if any of these steps fail. What is the most efficient approach?

   • AUse a scheduled GitHub Action that runs daily and checks for new repositories, applying settings as needed.
   • BUse the GitHub REST API to create a script that runs on a server and polls for new repositories.
   • CUse organization-level security settings to automatically enable code scanning and secret scanning for all new repositories.
   • DUse a GitHub Action that runs on the 'repository' event and uses the API to apply the settings, with error handling to send notifications.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An organization has multiple teams with different security requirements. The 'core' team needs strict branch protection rules, while the 'experimental' team wants more flexibility. How should the organization configure rulesets to accommodate both teams?

   • AUse repository-level branch protection settings for each team's repositories.
   • BCreate two separate rulesets: one for the 'core' team with strict rules and one for the 'experimental' team with relaxed rules.
   • CApply the strict ruleset to all repositories and let the experimental team request exceptions on a case-by-case basis.
   • DCreate a single organization-level ruleset with strict rules and add the 'experimental' team to the bypass list.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A development team wants to customize the CodeQL analysis for their repository to exclude certain directories and set a specific query suite. They have created a custom workflow file. What is the best way to ensure this workflow is used for code scanning?

   • AUse the GitHub API to upload the workflow file to the repository.
   • BUpload the workflow file to the repository's root directory.
   • CEnable code scanning in the repository settings and select the custom workflow from a dropdown.
   • DPlace the workflow file in the .github/workflows directory of the repository.
   Reveal Solution Discussion Select an answer first