Detect, Manage, and Respond to Security Alerts GH-500 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A Dependabot alert is created for a vulnerability in a npm package. The advisory database does not yet have a patched version. What is the most appropriate action?

   • AKeep the alert open and monitor for updates, possibly applying a workaround if available.
   • BIgnore the alert until a patch is released.
   • CRemove the dependency from the project to eliminate the vulnerability.
   • DDismiss the alert because there is no fix available.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which type of security alert is generated when GitHub detects a known vulnerable version of a dependency in a repository's manifest file?

   • ACode scanning alert
   • BSecret scanning alert
   • CSecurity advisory
   • DDependabot alert
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary source of vulnerability information that Dependabot uses to identify known vulnerabilities in dependencies?

   • AGitHub Advisory Database
   • BNational Vulnerability Database (NVD)
   • CPackage registry metadata
   • DCVE list from MITRE
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A developer notices a Dependabot alert for a vulnerability in a transitive dependency. The direct dependency is not vulnerable, but the transitive one is. What is the most accurate statement about this alert?

   • AThe alert is valid because Dependabot scans the entire dependency tree, including transitive dependencies.
   • BThe alert is a false positive because the direct dependency is not vulnerable.
   • CThe alert can be ignored because the direct dependency is safe.
   • DThe alert should be dismissed because Dependabot only alerts for direct dependencies.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   An organization wants to automate the remediation of Dependabot alerts by automatically creating pull requests for patched versions, but only for dependencies that are not pinned to exact versions. They also want to avoid overwhelming developers with too many PRs. Which approach best balances automation and control?

   • AEnable Dependabot version updates and let it create PRs for all dependencies.
   • BConfigure Dependabot to group updates and set a limit on the number of open PRs, and use a workflow to filter alerts for non-pinned dependencies.
   • CManually create PRs for each alert that has a patched version.
   • DUse a GitHub Action that automatically merges Dependabot PRs without review.
   Reveal Solution Discussion Select an answer first